[Question]: Trusted Signing settings ignored in settings.json file

[mcebailly]

AL-Go version

6.0

Describe the issue

I have run the new trusted signing build with settings and they are being ignored.

My current sign process continues to state:

Invoking signing tool using clientId/clientSecret

I've added the following settings (my params x'd out) to my settings.json inside my .AL-Go folder. I've tried all of the casing options including TrustedSigning, trustedSigning and capital letters for Endpoint, Account, CertificateProfile etc. Am I doing something wrong here?

"trustedSigning": {
"endpoint": "xx"
"account": "xx",
"certificateProfile": "xx"
}

Expected behavior

The trusted signing section should be read into the Sign process to sign a trusted app file

Steps to reproduce

Add a trustedSigning section to settings.json under .AL-Go folder

Run a CI/CD on an AppSource app

Additional context (logs, screenshots, etc.)

No response

[freddydk]

Did you run Update AL-Go System Files with AL-Go preview?
Please supply a log of the build for us to see what might be wrong.

It should also work with the project settings, but I can see that I added it under repo setting here:

https://github.com/microsoft/bcsamples-bingmaps.appsource/blob/main/.github/AL-Go-Settings.json

[mcebailly]

Log file attached, can confirm I pulled preview logs_30302768542.zip

[freddydk]

Looking in the logs, it says: microsoft/AL-Go-Actions/[email protected]

Which is v6.0 and not preview.

preview would be: microsoft/AL-Go/Actions/Sign@<ref> (where ref is the github ref of the preview build)

[mcebailly]

I see. When I updated system files I put in the URL for the preview branch of Al-Go, is that not the appropriate method to get preview going? Do I change the yaml to say <ref> manually? From: Freddy Kristiansen ***@***.***> Sent: Wednesday, October 30, 2024 5:09 PM To: microsoft/AL-Go ***@***.***> Cc: Mike Calvert ***@***.***>; Author ***@***.***> Subject: Re: [microsoft/AL-Go] [Bug]: Trusted Signing settings ignored in settings.json file (Issue #1285) Caution! External Sender: This email originated from outside of the firm. Please Note: Email from 'known' contacts could still be dangerous. Never click links or open attachments without separately verifying with the sender using alternative means Looking in the logs, it says: ***@***.******@***.***> Which is v6.0 and not preview. preview (today) would be: microsoft/AL-Go/Actions/Sign@<ref> (where ref is the github ref of the preview build) - Reply to this email directly, view it on GitHub<#1285 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BKRA56QUYBEWZXN6PFMDXKLZ6FDFFAVCNFSM6AAAAABQ4WBP3KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINBYGM4DKMZZGI>. You are receiving this because you authored the thread.Message ID: ***@***.******@***.***>>

…

________________________________ Confidentiality Note: This email message, including any attachment(s), is for the sole use of the intended recipient(s) and may contain information that is confidential, privileged, or otherwise protected by law. Any unauthorized use, disclosure, or distribution of this communication is strictly prohibited. If you have received this communication in error, please contact the sender immediately by reply email and destroy the original and all copies of the email, including any attachment(s).

[freddydk]

You need to run Update AL-Go System Files with microsoft/AL-Go-AppSource@preview
You should not change the .yaml files yourself.

[mcebailly]

This got me a lot further. It is now showing trusted signing in the Sign build with success.

When I download the artifact, it does not appear to be signed appropriately though. I would expect to see a tab that says “Digital Signature” correct?

[freddydk]

No, you would only see that if you have the NAVSIP.dll installed on your computer.

If the sign step passes and you have something like this in the log:

  Invoking signing tool using trusted signing
  info: Sign.Core.ISigner[0]
        Submitting D:\a\bcsamples-bingmaps.appsource\bcsamples-bingmaps.appsource\Library Apps\.buildartifacts\Apps\Freddy Kristiansen_FreddyDK.Licensing_4.8.207.0.app for signing.
  info: Sign.Core.ISigner[0]
        SignAsync called for D:\a\bcsamples-bingmaps.appsource\bcsamples-bingmaps.appsource\Library Apps\.buildartifacts\Apps\Freddy Kristiansen_FreddyDK.Licensing_4.8.207.0.app. Using C:\Users\runneradmin\AppData\Local\Temp\txl3onlb.dsx\biufpkrp.app locally.
  info: Sign.Core.IDataFormatSigner[0]
        Signing SignTool job with 1 files.
  info: Sign.Core.IDataFormatSigner[0]
        Signing C:\Users\runneradmin\AppData\Local\Temp\txl3onlb.dsx\biufpkrp.app.
  info: Sign.Core.IDataFormatSigner[0]
        Signing C:\Users\runneradmin\AppData\Local\Temp\txl3onlb.dsx\biufpkrp.app succeeded.
  info: Sign.Core.ISigner[0]
        Completed in 2796 ms.

then you are good.