Bamboo fails to find certificate for SignTool

[Greg McElroy]

At the end of the build process, we sign our binaries using a SafeNet USB token and SignTool. When we run the command using CMD or in a batch script it works fine, when we run the same command as a Bamboo Command task or a Bamboo Script it fails to find a valid certificate. 
The command we are using; 

SignTool sign /a /t http://timestamp.verisign.com/scripts/timestamp.dll /v Help\Help.exe

The error:

SignTool Error: No certificates were found that met all the given criteria.

What are the differences?

[Minh Tran]

@Greg McElroy The SignTool command looks strange to me. It did not pass any certificate

[Greg McElroy]

Do you mean a *.pfx file? We use a USB Hardware token and use /a to automatically select the best cert, we only have one cert installed. 

[Minh Tran]

I still don't understand how can Bamboo build agents are able to read these certificates when they are in the USB?

[Greg McElroy]

I believe when /a is used SignTool will search for the best certificate to match and by default looks in personal certificates. I have imported the certificate to Atlassian Bamboo Bamboo/personal certificates folder but still no luck. 

[Greg McElroy]

If I start Bamboo using "Start in Console" it is fine and signs the binaries. So there is an issue when Bamboo is started as a service. 

[Charlie Misonne]

A difference between running Bamboo as a service and the start script can be related to customizations in the setenv.bat file.

Do you have any custom java properties or environment variables in setenv.bat?

In that case you should put them in your tomcat service configuration.

Also: do you use local or remote agents?

[robhit]

Yes, that could be the case.

Are you having Bamboo on Windows? If yes, then please ensure your Bamboo is started using a local user when using Windows Service and that user should have the certificate installed in his profile. Probably using the same user (the user which has been used to start the Bamboo from the console) will solve the problem.

You can refer the below document for setting up a local user for the Windows Service:

https://confluence.atlassian.com/bamboo/running-bamboo-as-a-windows-service-as-the-local-user-416580754.html

Thanks,

Robhit

[Greg McElroy]

Hi @Charlie Misonne

No, there is no custom environment variables. It is a clean install of Win 7 only running Bamboo. Its a single agent. 

Hi @robhit

Yes it is a Windows installation. I am not sure how I would install the certificate as a local user because it is a Hardware USB token and is installed using SafeNet Auth client. 
I have a single user - Build-PC with admin rights. There will be no other users on the system. 

[Greg McElroy]

Hi @robhit,

I followed your instructions for setting up a local user for windows service, but this didn't fix the issue. 

If I select Local User Account and use "/sm" option for signtool to force the tool to look in the local computer certificate store, rather than the local user it can find the certificate. The next issue I face is entering the password. There is an option to enable single logon, but it seems that each call to signtool is happening in a different context so it prompts me to enter a password every call and fails. 

It seems the only option I have is to run Bamboo from the console for the time being. 

[Greg McElroy]

simple 06-Apr-2018 08:10:08 Starting task 'Temp Sign Tool' of type 'com.atlassian.bamboo.plugins.scripttask:task.builder.command'
command 06-Apr-2018 08:10:08 Beginning to execute external process for build 'V14 SetupFactory Release - feature-BambooBuildChanges - Checkout RunTest #38 (V14-V14REL0-JOB1-38)'\n ... running command line: \nC:\Program Files (x86)\Microsoft SDKs\Windows\v7.1A\Bin\signtool.exe sign /a /t http://timestamp.verisign.com/scripts/timestamp.dll /v Help\Help.exe\n ... in: C:\bamboo-home\xml-data\build-dir\196609\V14-V14REL0-JOB1\V14Dev\V14Dev\n ... using extra environment variables: \nbamboo_planRepository_1_branch=feature/BambooBuildChanges\nbamboo_planRepository_4_branchName=develop\nbamboo_planRepository_2_branch=master\nbamboo_planRepository_1_branchDisplayName=feature/BambooBuildChanges\nbamboo_repository_revision_number=8e40f34d52c1d47567416ba57020491fec229c53\nbamboo_planRepository_3_type=bbCloud\nbamboo_capability_system_builder_msbuild_MSBuild_v4_0__32bit_=C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe\nbamboo_repository_2621451_name=DDC LIB Dev Branch\nbamboo_repository_2621443_revision_number=8e40f34d52c1d47567416ba57020491fec229c53\nbamboo_capability_SetupFactory_6=C:\Program Files (x86)\Setup Factory 6.0\SUF60Design.exe\nbamboo_planRepository_5_username=\nbamboo_planRepository_3_revision=f66443e43c3ef3f891690487ed9d4f75f366755a\nbamboo_buildKey=V14-V14REL0-JOB1\nbamboo_capability_system_vstestdiscoverer_VS_2013_MS_Windows_Phone_Container_Discoverer=Supported File Types: .dll, .exe, .appx, .xap\nbamboo_planRepository_4_type=bbCloud\nbamboo_planRepository_5_branch=develop\nbamboo_planRepository_4_branch=develop\nbamboo_planRepository_3_branch=develop\nbamboo_planRepository_2_branchDisplayName=master\nbamboo_capability_system_jdk_JDK_1_8_0_131=C:\Program Files\Java\jdk1.8.0_131\nbamboo_shortJobName=Checkout RunTest\nbamboo_buildResultsUrl=http://10.1.1.72:8085/browse/V14-V14REL0-JOB1-38\nbamboo_repository_2621451_previous_revision_number=7daa2c84a330edd5c660c743dcf56b5906e7f1c0\nbamboo_capability_system_builder_msbuild_MSBuild_v2_0__64bit_=C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe\nbamboo_planRepository_repositoryUrl=https://bitbucket.org/sierra-cp/v14dev\nbamboo_agentId=196609\nbamboo_planRepository_4_username=\nbamboo_planRepository_4_repositoryUrl=ssh://git@bitbucket.org/sierra-cp/ddc_lib\nbamboo_repository_2621451_revision_number=7daa2c84a330edd5c660c743dcf56b5906e7f1c0\nbamboo_planRepository_revision=8e40f34d52c1d47567416ba57020491fec229c53\nbamboo_planRepository_5_name=DDC LIB Dev Branch\nbamboo_planRepository_previousRevision=f7b14486ff4de4ebe70dc37b4481c3db897548ec\nbamboo_repository_branch_name=feature/BambooBuildChanges\nbamboo_planRepository_3_previousRevision=f66443e43c3ef3f891690487ed9d4f75f366755a\nbamboo_capability_system_builder_msbuild_MSBuild_v2_0__32bit_=C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe\nbamboo_planRepository_4_branchDisplayName=develop\nbamboo_capability_system_builder_msbuild_MSBuild_v3_5__32bit_=C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe\nbamboo_dependenciesDisabled=false\nbamboo_planRepository_branch=feature/BambooBuildChanges\nbamboo_capability_system_vstestdiscoverer_VS_2013_MS_C___Windows_Phone_Test_Discoverer=Supported File Types: .dll\nbamboo_capability_system_builder_msbuild_MSBuild_v12_0__64bit_=C:\Program Files (x86)\MSBuild\12.0\bin\amd64\MSBuild.exe\nbamboo_planRepository_3_branchName=develop\nbamboo_planRepository_5_revision=7daa2c84a330edd5c660c743dcf56b5906e7f1c0\nbamboo_repository_2621444_revision_number=518513ec3f10a321d272a75c0649b400dc089e26\nbamboo_planRepository_1_type=bbCloud\nbamboo_planRepository_branchName=feature/BambooBuildChanges\nbamboo_capability_system_jdk_JDK=C:\Program Files\Java\jdk1.8.0_131\nbamboo_planRepository_3_name=INtime DDC Dev Branch\nbamboo_hg_cache_directory=C:\bamboo-home\xml-data\build-dir\_hg-repositories-cache\nbamboo_planRepository_1_username=GregMcElroy\nbamboo_planRepository_type=bbCloud\nbamboo_repository_2621444_branch_name=master\nbamboo_ManualBuildTriggerReason_userName=gjm@sierra-cp.com\nbamboo_git_cache_directory=C:\bamboo-home\xml-data\build-dir\_git-repositories-cache\nbamboo_repository_2621445_branch_name=develop\nbamboo_planRepository_2_branchName=master\nbamboo_tmp_directory=C:\bamboo-home\temp\nbamboo_planKey=V14-V14REL0\nbamboo_planRepository_username=GregMcElroy\nbamboo_repository_2621443_branch_name=feature/BambooBuildChanges\nbamboo_repository_2621445_name=INtime DDC Dev Branch\nbamboo_planRepository_1_branchName=feature/BambooBuildChanges\nbamboo_repository_2621450_revision_number=7daa2c84a330edd5c660c743dcf56b5906e7f1c0\nbamboo_capability_system_vstestdiscoverer_VS_2013_MS_App_Container_Discoverer=Supported File Types: .dll, .appx, .exe\nbamboo_artifacts_path_SF_DDC_Binaries=V14Dev/V14Dev/Drivers/Bin/RTOS\nbamboo_repository_2621445_previous_revision_number=f66443e43c3ef3f891690487ed9d4f75f366755a\nbamboo_resultsUrl=http://10.1.1.72:8085/browse/V14-V14REL0-JOB1-38\nbamboo_capability_system_vstestdiscoverer_VS_2013_Generic_Test_Discoverer=Supported File Types: .generictest\nbamboo_build_working_directory=C:\bamboo-home\xml-data\build-dir\196609\V14-V14REL0-JOB1\nbamboo_planRepository_1_name=V14 Dev\nbamboo_shortPlanName=feature-BambooBuildChanges\nbamboo_planRepository_5_repositoryUrl=ssh://git@bitbucket.org/sierra-cp/ddc_lib\nbamboo_repository_2621443_name=V14 Dev\nbamboo_capability_system_builder_msbuild_MSBuild_v3_5__64bit_=C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe\nbamboo_planRepository_2_username=GregMcElroy\nbamboo_planRepository_name=V14 Dev\nbamboo_buildNumber=38\nbamboo_capability_system_builder_command_SetupFactory_6_0=C:\Program Files (x86)\Setup Factory 6.0\SUF60Design.exe\nbamboo_repository_2621445_revision_number=f66443e43c3ef3f891690487ed9d4f75f366755a\nbamboo_repository_2621450_previous_revision_number=7daa2c84a330edd5c660c743dcf56b5906e7f1c0\nbamboo_ManualBuildTriggerReason_stageName=Build Installer\nbamboo_repository_2621444_name=INtime DDC Repository\nbamboo_planName=V14 SetupFactory Release - feature-BambooBuildChanges\nbamboo_build_commandline_com_atlassian_bamboo_plugins_scripttask_task_builder_script_7=C:\bamboo-home\temp\V14-V14REL0-JOB1-38-ScriptBuildTask-6629825155627195771.ps1\nbamboo_shortPlanKey=V14REL0\nbamboo_shortJobKey=JOB1\nbamboo_planRepository_2_name=INtime DDC Repository\nbamboo_planRepository_5_branchName=develop\nbamboo_buildTimeStamp=2018-04-06T08:10:07.836+01:00\nbamboo_repository_previous_revision_number=f7b14486ff4de4ebe70dc37b4481c3db897548ec\nbamboo_capability_system_builder_vstestconsole_VSTest_Console__VS_2013_=C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe\nbamboo_build_commandline_com_atlassian_bamboo_plugins_scripttask_task_builder_script_5=V14BinSign.bat\nbamboo_capability_system_builder_command_SignTool=C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1A\Bin\signtool.exe\nbamboo_buildResultKey=V14-V14REL0-JOB1-38\nbamboo_buildPlanName=V14 SetupFactory Release - feature-BambooBuildChanges - Checkout RunTest\nbamboo_capability_system_vstestdiscoverer_VS_2013_Ordered_Test_Discoverer=Supported File Types: .orderedtest\nbamboo_capability_system_builder_msbuild_MSBuild_v12_0__32bit_=C:\Program Files (x86)\MSBuild\12.0\bin\MSBuild.exe\nbamboo_planRepository_1_revision=8e40f34d52c1d47567416ba57020491fec229c53\nbamboo_planRepository_3_username=GregMcElroy\nbamboo_repository_name=DDC LIB Dev Branch\nbamboo_planRepository_4_name=DDC LIB Repository\nbamboo_repository_2621444_previous_revision_number=518513ec3f10a321d272a75c0649b400dc089e26\nbamboo_capability_VB6=C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.exe\nbamboo_planRepository_2_previousRevision=518513ec3f10a321d272a75c0649b400dc089e26\nbamboo_buildFailed=false\nbamboo_planRepository_3_repositoryUrl=https://bitbucket.org/sierra-cp/ddc\nbamboo_build_commandline_com_atlassian_bamboo_plugin_dotnet_msbuild_6=C:\Program Files (x86)\MSBuild\12.0\bin\MSBuild.exe @C:\Bamboo\temp\V14-V14REL0-JOB1-38-MsBuildTaskType-3614357757471931489.rsp\nbamboo_planRepository_4_previousRevision=7daa2c84a330edd5c660c743dcf56b5906e7f1c0\nbamboo_capability_system_vstestdiscoverer_VS_2013_MS_C___Test_Discoverer=Supported File Types: .dll\nbamboo_agentWorkingDirectory=C:\bamboo-home\xml-data\build-dir\196609\nbamboo_planRepository_2_revision=518513ec3f10a321d272a75c0649b400dc089e26\nbamboo_planRepository_1_previousRevision=f7b14486ff4de4ebe70dc37b4481c3db897548ec\nbamboo_planRepository_branchDisplayName=feature/BambooBuildChanges\nbamboo_planRepository_5_previousRevision=7daa2c84a330edd5c660c743dcf56b5906e7f1c0\nbamboo_planRepository_5_branchDisplayName=develop\nbamboo_planRepository_2_type=bbCloud\nbamboo_repository_2621450_branch_name=develop\nbamboo_capability_system_builder_devenv_Visual_Studio_2013=C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\nbamboo_capability_system_builder_devenv_Visual_Studio_2012=C:\Program Files (x86)\Microsoft Visual Studio 11.0\Common7\IDE\nbamboo_plan_storageTag=plan-2424838\nbamboo_planRepository_2_repositoryUrl=https://bitbucket.org/sierra-cp/ddc\nbamboo_artifacts_path_SF_DDC_Lib_Binaries=C:\bamboo-home\xml-data\build-dir\196609\V14-V14REL0-JOB1\V14Dev\V14Dev\Drivers\Bin\RTOS\ddclib.dll\nbamboo_capability_system_builder_msbuild_MSBuild_v4_0__64bit_=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe\nbamboo_planRepository_5_type=bbCloud\nbamboo_planRepository_3_branchDisplayName=develop\nbamboo_repository_2621450_name=DDC LIB Repository\nbamboo_build_commandline_com_atlassian_bamboo_plugin_dotnet_msbuild_3=C:\Program Files (x86)\MSBuild\12.0\bin\MSBuild.exe @C:\Bamboo\temp\V14-V14REL0-JOB1-38-MsBuildTaskType-2423862308387341858.rsp\nbamboo_working_directory=C:\bamboo-home\xml-data\build-dir\196609\V14-V14REL0-JOB1\nbamboo_capability_system_vstestdiscoverer_VS_2013_MS_Test_Discoverer=Supported File Types: .dll, .exe\nbamboo_RerunBuildTriggerReason_noOfRetries=12\nbamboo_planRepository_1_repositoryUrl=https://bitbucket.org/sierra-cp/v14dev\nbamboo_planRepository_4_revision=7daa2c84a330edd5c660c743dcf56b5906e7f1c0\nbamboo_capability_system_jdk_JDK_1_8=C:\Program Files\Java\jdk1.8.0_131\nbamboo_repository_2621443_previous_revision_number=f7b14486ff4de4ebe70dc37b4481c3db897548ec\nbamboo_repository_2621451_branch_name=develop\n
error 06-Apr-2018 08:10:08 SignTool Error: No certificates were found that met all the given criteria.
simple 06-Apr-2018 08:10:08 Failing task since return code of [C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1A\Bin\signtool.exe sign /a /t http://timestamp.verisign.com/scripts/timestamp.dll /v Help\Help.exe] was 1 while expected 0
simple 06-Apr-2018 08:10:08 Finished task 'Temp Sign Tool' with result: Failed

Changed to the bamboo checkout directory and ran the command

C:\bamboo-home\xml-data\build-dir\196609\V14-V14REL0-JOB1\V14Dev\V14Dev>"C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1A\Bin\signtool.exe" sign /a /t http:
.verisign.com/scripts/timestamp.dll /v "Help\Help.exe"
The following certificate was selected:
 Issued to: XXXXXXXXXXXXXXXXXXXXXXXXX
 Issued by: GlobalSign CodeSigning CA - SHA256 - G3
 Expires: Mon Oct 08 15:03:58 2018
 SHA1 hash: XXXXXXXXXXXXXXXXXXXXXXXXX

Done Adding Additional Store
Successfully signed and timestamped: Help\Help.exe

Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0

C:\bamboo-home\xml-data\build-dir\196609\V14-V14REL0-JOB1\V14Dev\V14Dev>

[robhit]

Hi Greg,

Thanks for your question!

What do you see in the logs when it is a success and during a failure? Maybe that would give us some hints.