Signing build artifacts with Azure Artifact Signing

Azure Artifact Signing (AAS) is Microsoft's managed service for signing build artifacts without managing code signing certificates manually. Such a thing is useful for developer teams that need to sign installers, executables, scripts, or other build outputs, but do not want private code signing keys stored on developer machines or build agents.

The basic setup has three parts:

• an Artifact Signing account
• an identity validation
• a certificate profile.

The account and certificate profile can be managed with Azure tooling. Identity validation is completed in the Azure portal.

First, register the Azure resource provider:

az provider register --namespace "Microsoft.CodeSigning"

Then add the Azure CLI extension:

az extension add --name artifact-signing

Next, create yourself an account:

az artifact-signing create ^
    --name MySigningAccount ^
    --resource-group MyResourceGroup ^
    --location northeurope ^
    --sku Basic

After identity validation has been completed, create a certificate profile:

az artifact-signing certificate-profile create ^
    --resource-group MyResourceGroup ^
    --account-name MySigningAccount ^
    --name MyCertificateProfile ^
    --profile-type PublicTrust ^
    --identity-validation-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

For local signing with SignTool, create a metadata file that points to the signing account and certificate profile. Here's an example JSON:

{
  "Endpoint": "https://neu.codesigning.azure.net",
  "CodeSigningAccountName": "MySigningAccount",
  "CertificateProfileName": "MyCertificateProfile",
  "CorrelationId": "local-test"
}

The endpoint must match the Azure region where the Artifact Signing account was created. Then SignTool can use the Artifact Signing client library:

signtool.exe sign ^
    /v ^
    /fd SHA256 ^
    /tr "http://timestamp.acs.microsoft.com" ^
    /td SHA256 ^
    /dlib "C:\Tools\ArtifactSigning\x64\Azure.CodeSigning.Dlib.dll" ^
    /dmdf "C:\Signing\metadata.json" ^
    "C:\BuildOutput\MyApp.exe"

The important part is that the certificate private key is not sitting on the build machine. The signing operation goes through the managed Artifact Signing service. For teams, the most interesting place to use this is usually the build pipeline, not a developer workstation. Artifact Signing has integrations for Azure DevOps, GitHub Actions, SignTool, PowerShell Authenticode signing, and SDK-based scenarios.

Remember to always use timestamping when signing build artifacts. Artifact Signing certificates are short-lived, and timestamping allows the signature to remain valid after the signing certificate itself has expired.

Good things to decide before adopting Artifact Signing:

• which artifacts need to be signed?
• which Azure identity is allowed to sign?
• which certificate profile should be used for test and production builds?
• where should signing happen in the pipeline?
• how are signed artifacts audited?

For small projects, this may be more setup than you need. For professional build pipelines, centralized signing is a much cleaner model than copying certificate files and passwords between machines.