TeamCity | SignPath

Setup

Self-hosted setup

For SignPath to integrate with the TeamCity server, you have to deploy the SignPath TeamCity Connector container image in a location that can reach the TeamCity server and install the SignPath TeamCity Plugin providing the dedicated build runners.

Contact our support team for access to these components.

On SignPath

Add a custom trusted build system and copy the Trusted Build System Token to your TeamCity connector configuration.
Link the trusted build system with all projects built on TeamCity.

Checks performed by SignPath

The TeamCity connector performs the following checks:

Control plane verification:
- The build was actually performed by a TeamCity build configuration, not by some other entity in possession of the API token.
- Origin metadata is provided by the TeamCity server, not the build script, and can therefore not be forged.
Artifact integrity: The artifact is published as an interim TeamCity artifact before it is submitted for signing. This ensures the actual provenance of the artifact.
No personal builds: Prevents siging of builds containing uncommitted changes.

Usage

Usage with versioned settings

The SignPath TeamCity Plugin provides a build runner that can be used for submitting signing requests to SignPath.

import jetbrains.buildServer.configs.kotlin.buildSteps.signPathSubmitSigningRequest

project {
    buildType {
        // Other build type settings ...
        steps {
            // Other build steps ...
            signPathSubmitSigningRequest {
                connectorUrl = "https://your-teamcity-connector-instance-base.url"     
                organizationId = "%SignPath.OrganizationId%"
                apiToken = "<Signpath api token>"
                projectSlug = "<SignPath project slug>"
                signingPolicySlug = "<SignPath signing policy slug>"
                inputArtifactPath = "path/to/your/artifact => tc_artifact_name"
                outputArtifactPath = "path/to/store/the/signed/artifact"
                waitForCompletion = true
                parameters = """
                    version: 1.0.0
                    other_param: other value
                """.trimIndent()
            }
        }
    }
}

Usage without versioned settings

Add a build step of type SignPath: Submit Signing Request

Build step parameters

Parameter	Default Value	Description
`connectorUrl`	(mandatory)	The base URL of the SignPath connector.
`organizationId`	(mandatory)	The SignPath organization ID.
`apiToken`	(mandatory)	The SignPath API token.
`projectSlug`	(mandatory)	The SignPath project slug.
`signingPolicySlug`	(mandatory)	The SignPath signing policy slug.
`artifactConfigurationSlug`		The SignPath artifact configuration slug. If not specified, the default is used.
`inputArtifactPath`	(mandatory)	The path to the artifact to be signed. Both absolute paths and relative paths from the working directory are accepted. The artifact is published as an interim artifact. You can also use the TeamCity syntax `<file_path> => <published_artifact_name>` to specify the name of the published artifact. (No directories, wildcards, or target archives supported.)
`waitForCompletion`	(mandatory)	If true, the action will wait for the signing request to complete. Defaults to `true`.
`outputArtifactPath`		Path to where the signed artifact will be stored. Both absolute paths and relative paths from the working directory are accepted.
`parameters`		Multiline-string of values that map to user-defined parameters in the Artifact Configuration. Use one line per parameter with the format `<name>: <value>`.
`waitForCompletionTimeoutInSeconds`	`600`	Maximum time in seconds that the action will wait for the signing request to complete.
`serviceUnavailableTimeoutInSeconds`	`600`	Total time in seconds that the action will wait for a single service call to succeed (across several retries).
`uploadAndDownloadSignedArtifactTimeoutInSeconds`	`300`	HTTP timeout used for upload or download of the artifact.Defaults to 5 minutes.
`publishUnsignedArtifactTimeoutInSeconds`	`300`	Timeout used for publishing the unsigned artifact to the TeamCity server before sending the signing request.

Build step output parameters

After the build step is run, the following parameters will be available to subsequent build steps:

signingRequestId: ID of the created signing request
signingRequestWebUrl: URL of the signing request in SignPath UI
signPathApiUrl: SignPath API base URL
signedArtifactDownloadUrl: Download URL of the signed artifact in SignPath

Example

For a reference implementation, see the demo repository.

Trusted Build Systems ❯ TeamCity