Struct AuthenticodeConfig 

pub struct AuthenticodeConfig {
    pub cert_file: Option<String>,
    pub cert_env: Option<String>,
    pub password_env: Option<String>,
    pub timestamp_url: Option<String>,
    pub name: Option<String>,
    pub url: Option<String>,
    pub tool: Option<String>,
    pub artifacts: Option<String>,
    pub required: Option<bool>,
}

Authenticode (Windows PE/MSI/DLL) signing backend for a SignConfig.

Unlike the generic cosign/gpg signs: path — which produces a detached .sig next to the artifact — Authenticode signing embeds the signature into the PE/MSI container, mutating the artifact in place. Downstream checksums and archives then pick up the signed bytes; no separate signature artifact is registered.

Everything is derived so the opt-in is minimal — authenticode: {} plus a WINDOWS_CERT_FILE (and optional WINDOWS_CERT_PASSWORD) env var is enough:

signs:
  - authenticode: {}   # signs every .exe/.msi/.dll via osslsigncode/signtool

A fully-specified config overrides the derived defaults:

signs:
  - id: authenticode
    authenticode:
      cert_file: "{{ .Env.MY_CERT }}"     # or cert_env: MY_CERT_PATH
      password_env: MY_CERT_PASSWORD
      timestamp_url: "http://timestamp.sectigo.com"
      name: "Acme Corp"
      url: "https://acme.example"
      tool: osslsigncode
      artifacts: windows
      required: true

Fields

cert_file: Option<String>

Literal path to the PKCS#12 (.p12 / .pfx) cert file. May be a template (e.g. "{{ .Env.MY_CERT }}"). For a non-secret cert path checked into config; for a secret path prefer cert_env.

cert_env: Option<String>

Name of the env var holding the path to the PKCS#12 cert file (never the cert bytes). Defaults to WINDOWS_CERT_FILE when neither this nor cert_file is set.

password_env: Option<String>

Name of the env var holding the cert password. Defaults to WINDOWS_CERT_PASSWORD. The value is read at execution time, passed to the signer, and redacted from all logs.

timestamp_url: Option<String>

RFC 3161 timestamp server URL. Defaults to DEFAULT_TIMESTAMP_URL.

name: Option<String>

Product / publisher name embedded in the signature (osslsigncode -n, signtool /d). Templated. Derived from the project name when unset.

url: Option<String>

Info URL embedded in the signature (osslsigncode -i, signtool /du). Omitted when unset.

tool: Option<String>

Override the signer binary. Defaults to signtool on a Windows host, osslsigncode elsewhere.

artifacts: Option<String>

Artifact selector. Defaults to "windows" — Binary/Installer/Library artifacts whose path ends in .exe, .msi, or .dll.

required: Option<bool>

When true, a missing cert HARD-FAILS the sign stage. When false (the default), a missing cert SKIPS gracefully (mirrors the keyless-cosign-under-harness skip).

Implementations

impl AuthenticodeConfig

pub const DEFAULT_CERT_ENV: &'static str = "WINDOWS_CERT_FILE"

Default env var naming the cert path when neither cert_file nor cert_env is set ("WINDOWS_CERT_FILE").

pub const DEFAULT_PASSWORD_ENV: &'static str = "WINDOWS_CERT_PASSWORD"

Default env var holding the cert password ("WINDOWS_CERT_PASSWORD").

pub const DEFAULT_TIMESTAMP_URL: &'static str = "http://timestamp.digicert.com"

Default RFC 3161 timestamp server ("http://timestamp.digicert.com").

pub const DEFAULT_ARTIFACTS: &'static str = "windows"

Default artifact selector ("windows").

pub const DEFAULT_TOOL_WINDOWS: &'static str = "signtool"

Signer binary on a Windows host ("signtool").

pub const DEFAULT_TOOL_UNIX: &'static str = "osslsigncode"

Signer binary on a non-Windows host ("osslsigncode").

pub fn resolved_cert_env(&self) -> &str

Resolve the env var naming the cert path, falling back to DEFAULT_CERT_ENV.

pub fn resolved_password_env(&self) -> &str

Resolve the env var holding the cert password, falling back to DEFAULT_PASSWORD_ENV.

pub fn resolved_timestamp_url(&self) -> &str

Resolve the RFC 3161 timestamp URL, falling back to DEFAULT_TIMESTAMP_URL.

pub fn resolved_artifacts(&self) -> &str

Resolve the artifact selector, falling back to DEFAULT_ARTIFACTS.

pub fn resolved_tool(&self) -> &str

Resolve the signer binary, falling back to the host-appropriate default (signtool on Windows, osslsigncode elsewhere).

pub fn is_required(&self) -> bool

Whether a missing cert HARD-FAILS (true) versus skips gracefully (false, the default).

Trait Implementations

impl Clone for AuthenticodeConfig

fn clone(&self) -> AuthenticodeConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthenticodeConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthenticodeConfig

fn default() -> AuthenticodeConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AuthenticodeConfig

where AuthenticodeConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for AuthenticodeConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for AuthenticodeConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.