I cannot access a USB device (for code signing) from the custom Windows runner

Question

I was under the impression that I will have access to the hardware connected to that computer.

However I am trying to sign generated code with a certificate stored on a USB, and it does not appear to work (with error message "SignTool error : No certificates were found that met all the given criteria.").

The command works perfectly in a PowerShell terminal...

Any clues on what is going wrong? Any workarounds?

Ellite Hanry · Answer

It looks like the runner environment doesn't have direct access to the USB token, which is why code signing works fine in PowerShell but fails in the build job. Most CI/Custom runners can't talk to hardware devices unless the vendor's CSP/KSP middleware is fully available in that session. A common workaround is moving to a cloud HSM or key vault that integrates with signtool, or using a signing service that exposes the cert via the Windows cert store. That way, your build can still perform code signing without depending on the USB hardware. Hope it helps!

SuperRey · Answer

Hello Mark,

Sorry for the late reply.

It was all my fault, as the command I was using had utf characters, and the encoding of the file was not the proper one.

After fixing that I can confirm that the command to sign the code works perfectly.

Mark C · Answer

Hi @SuperRey

Welcome to the community.

You can essentially connect to your USB device since Windows runners runs directly to your host machine via PowerShell. You can use PowerShell to interact with USB devices, provided the necessary drivers and permissions are in place.

Unfortunately, we don't have an official documentation regarding this, however, could you confirm what sample commands are you using to connect?

Regards,
Mark C