cli: codesign the cli binaries

closes https://github.com/hasura/graphql-engine/issues/7147

PR-URL: https://github.com/hasura/graphql-engine-mono/pull/2100
Co-authored-by: Aravind K P <8335904+scriptonist@users.noreply.github.com>
GitOrigin-RevId: 1816493b6cdf1b00b267ee8852c7b8a7c5fc3ee9

.circleci/cli-builder.dockerfile

@@ -9,7 +9,14 @@ RUN	go get github.com/mitchellh/gox \
 
 # install UPX, netcat and gcloud cli
 RUN apt-get update && apt-get install -y \
-    xz-utils netcat libpq5 postgresql-client jq zip \
+    xz-utils netcat libpq5 postgresql-client jq zip build-essential pkg-config libssl-dev libcurl4-openssl-dev \
+    && wget https://github.com/mtrojnar/osslsigncode/releases/download/2.2/osslsigncode-2.2.0.tar.gz \
+    && tar -xzf osslsigncode-2.2.0.tar.gz \
+    && cd osslsigncode-2.2.0 \
+    && ./configure && make install && cd .. \
+    && rm -rf osslsigncode* \
+    && wget http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/multiarch-support_2.27-3ubuntu1.4_amd64.deb \
+    && apt-get install ./multiarch-support_2.27-3ubuntu1.4_amd64.deb \
     && curl -s https://packages.microsoft.com/config/debian/9/prod.list > /etc/apt/sources.list.d/mssql-release.list \
     && curl -s https://packages.microsoft.com/keys/microsoft.asc | apt-key add - \
     && echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list \

.circleci/extension-cli-builder.dockerfile

@@ -1,14 +1,17 @@
-FROM node:12
+FROM node:12-bullseye
 
 ARG upx_version="3.94"
 
 # install dependencies
-RUN apt-get update && apt-get install -y \
-    zip \
-    xvfb \
+RUN apt-get update && apt-get install -y zip xvfb build-essential pkg-config libssl-dev libcurl4-openssl-dev \
+    && wget https://github.com/mtrojnar/osslsigncode/releases/download/2.2/osslsigncode-2.2.0.tar.gz \
+    && tar -xzf osslsigncode-2.2.0.tar.gz \
+    && cd osslsigncode-2.2.0 \
+    && ./configure && make && make install && cd .. \
+    && rm -rf osslsigncode* \
     && curl -Lo /tmp/upx-${upx_version}.tar.xz https://github.com/upx/upx/releases/download/v${upx_version}/upx-${upx_version}-amd64_linux.tar.xz \
     && xz -d -c /tmp/upx-${upx_version}.tar.xz \
-        | tar -xOf - upx-${upx_version}-amd64_linux/upx > /bin/upx \
+    | tar -xOf - upx-${upx_version}-amd64_linux/upx > /bin/upx \
     && chmod a+x /bin/upx \
     && apt-get -y auto-remove \
     && apt-get -y clean \

CHANGELOG.md

@@ -17,7 +17,7 @@
 - console: add request transforms for events
 - metadata SDK: add type definitions for config v3
 - cli: fix cli-console failing to add migrations if there are tabs in SQL body (#7362)
-
+- cli: sign windows binary of Hasura CLI (#7147)
 - cli: core CLI features are not blocked in environments without internet (#7695)
 
 ### Bug fixes and improvements

cli/Makefile

@@ -39,7 +39,7 @@ endif
 # compress
 .PHONY: compress
 compress:
-	ls $(OUTPUT_DIR)/$(VERSION)/cli-hasura-* | grep -v darwin | xargs upx
+	ls $(OUTPUT_DIR)/$(VERSION)/cli-hasura-* | grep -v darwin | grep -v windows | xargs upx
 
 # to be executed in circle-ci only
 ci-copy-binary: