digicert/DigiCert Binary Signing
Code signing for Win/Linux/Mac. Includes private key security, MFA, easy automation and bulk signing for high volume releases
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| digicert-cdn | DigiCert CDN or STM environment to download the required STM tools. Default https://pki-downloads.digicert.com/stm/latest | no | https://pki-downloads.digicert.com/stm/latest |
| keypair-alias | Keypair alias | no | — |
| input | File or Directory(files) to sign | no | — |
| digest-alg | Digest(Hash) algorithm | no | "" |
| diegest-alg | [DEPRECATED] Use digest-alg instead. This parameter has a typo and will be removed in a future version. | no | — |
| fail-fast | Continue signing all the files even if there are errors in some. Applies only if input is a directory with mulitple supported files. | no | true |
| zero-exit-code-on-failure | Return 0 exit code from the process even if there are errors (Not recommended). | — | false |
| unsigned | Sign only unsigned files. | no | false |
| timestamp | Timestamping | no | true |
| use-binary-sha256-checksum | Use the SHA-256 checksum file provided on the CDN to handle caching. This ensures that new versions are automatically downloaded when they are available. If this option is not enabled, the system instead relies on cache-version to determine whether a new download is needed. This workflow functions when cache-version is updated and 'use-github-caching-service' is enabled. | no | true |
| cache-version | Makes use of Github tool cache feature, useful only with self-hosted runners. Change this to make Github runner download the next latest version of the tool. This is not the actual version of the tool but is only used for caching to avoid redundant downloads. The default value uses a semantic version format with a '-0' suffix (e.g., '0.0.0-0') to ensure compatibility with caching mechanisms that expect semantic versioning. This value is arbitrary and does not reflect the tool's actual version. | no | 0.0.0-0 |
| simple-signing-mode | Setup Software Trust Manager for simplified signing. Only installs smctl. | no | false |
| use-github-caching-service | Default tool caching doesn't work on Github runners. So use this to enable Github provided caching service to cache Software Trust Manager tools across runs. | no | true |
| bulk-sign-mode | Sign multiple files in a single operation. This action only works when you are simple signing. | no | false |
Outputs
| name | description |
|---|---|
| PKCS11_CONFIG | Absolute path to the generated pkcs11Properties.cfg file used for PKCS#11 configuration |