VS-155: Migrate signing to Garasign (#83)

Author: BorisDog

evergreen/evergreen.yml

@@ -149,9 +149,8 @@ functions:
         env:
           ARTIFACTORY_PASSWORD: ${ARTIFACTORY_PASSWORD}
           ARTIFACTORY_USERNAME: ${ARTIFACTORY_USERNAME}
-          AZURE_NUGET_SIGN_TENANT_ID: ${AZURE_NUGET_SIGN_TENANT_ID}
-          AZURE_NUGET_SIGN_CLIENT_ID: ${AZURE_NUGET_SIGN_CLIENT_ID}
-          AZURE_NUGET_SIGN_CLIENT_SECRET: ${AZURE_NUGET_SIGN_CLIENT_SECRET}
+          GRS_USERNAME: ${GRS_USERNAME}
+          GRS_PASSWORD: ${GRS_PASSWORD}
           PACKAGE_VERSION: ${PACKAGE_VERSION}
         script: |
           ${PREPARE_SHELL}

evergreen/run-pack.sh

@@ -5,9 +5,8 @@ set +o xtrace  # Disable tracing.
 # Environment variables used as input:
 # ARTIFACTORY_PASSWORD
 # ARTIFACTORY_USERNAME
-# AZURE_NUGET_SIGN_TENANT_ID
-# AZURE_NUGET_SIGN_CLIENT_ID
-# AZURE_NUGET_SIGN_CLIENT_SECRET
+# GRS_USERNAME
+# GRS_PASSWORD
 # PACKAGE_VERSION
 
 if [ -z "$PACKAGE_VERSION" ]; then
@@ -23,15 +22,9 @@ dotnet pack ./src/MongoDB.Analyzer.Package/MongoDB.Analyzer.Package.csproj -o ./
 
 echo "${ARTIFACTORY_PASSWORD}" | docker login --password-stdin --username "${ARTIFACTORY_USERNAME}" artifactory.corp.mongodb.com
 
-docker run --platform="linux/amd64" --rm -v $(pwd):/workdir -w /workdir \
-  artifactory.corp.mongodb.com/release-tools-container-registry-local/azure-keyvault-nuget \
-  NuGetKeyVaultSignTool sign "artifacts/nuget/*"."$PACKAGE_VERSION".nupkg \
-    --force \
-    --file-digest=sha256 \
-    --timestamp-rfc3161=http://timestamp.digicert.com \
-    --timestamp-digest=sha256 \
-    --azure-key-vault-url=https://mdb-authenticode.vault.azure.net \
-    --azure-key-vault-tenant-id="$AZURE_NUGET_SIGN_TENANT_ID" \
-    --azure-key-vault-client-secret="$AZURE_NUGET_SIGN_CLIENT_SECRET" \
-    --azure-key-vault-client-id="$AZURE_NUGET_SIGN_CLIENT_ID" \
-    --azure-key-vault-certificate=authenticode-2021
+echo "GRS_CONFIG_USER1_USERNAME=${GRS_USERNAME}" >> "signing-envfile"
+echo "GRS_CONFIG_USER1_PASSWORD=${GRS_PASSWORD}" >> "signing-envfile"
+
+docker run --platform="linux/amd64" --env-file=signing-envfile --rm -v $(pwd):/workdir -w /workdir \
+  artifactory.corp.mongodb.com/release-tools-container-registry-local/garasign-jsign \
+  /bin/bash -c "jsign --tsaurl "http://timestamp.digicert.com" -a mongo-authenticode-2021 "./artifacts/nuget/*.$PACKAGE_VERSION.nupkg""