Jenkins Integration

DRAFT - maybe to be deleted

To integrate Signum into a Jenkins pipeline, connect Jenkins to Signum through an Agent and standard signing interfaces, such as PKCS#11, KSP, or platform-specific tooling like SignTool or jarsigner.

Because Jenkins just executes shell commands, and Signum integrates via:

• Standard cryptographic providers

• Standard signing tools

• No proprietary Jenkins plugin dependency

Below is a practical, implementation-focused overview.

Install the Signum Agent on the Jenkins Build Node

Install the Signum agent on a Jenkins build agent/node.

The agent:

• Authenticates to Signum SaaS

• Exposes signing interfaces locally (KSP, PKCS#11, etc.)

Configure Signing Tooling

Depending on what you're signing:

• Windows (.exe, .dll): Use: signtool.exe,configure Signum’s KSP provider

Example manual test:

signtool sign /fd SHA256 /n "My Signing Cert" myapp.exe

• Java (JAR files) Use: jarsigner Configure Signum PKCS#11 provider

Example:

jarsigner -keystore NONE \
-storetype PKCS11 \
-signedjar app-signed.jar app.jar mykey

• Containers: Use: cosign andConfigure with Signum-backed key

Add Signing to Jenkins Pipeline

Declarative Pipeline Example (Windows signing):

pipeline {
    agent { label 'windows-signing-node' }

    stages {
        stage('Build') {
            steps {
                bat 'dotnet build MyApp.sln -c Release'
            }
        }

        stage('Sign') {
            steps {
                bat '''
                signtool sign ^
                /fd SHA256 ^
                /n "My Signing Cert" ^
                .\\bin\\Release\\MyApp.exe
                '''
            }
        }

        stage('Archive') {
            steps {
                archiveArtifacts artifacts: 'bin/Release/*.exe'
            }
        }
    }
}

No special Jenkins plugin is required — Signum integrates at the cryptographic provider level.

Authentication Options

Signum typically authenticates the agent via:

• API credentials

• Service principal

• Identity provider (SAML / OAuth)

• Token-based authentication

For production pipelines:

• Use machine/service identity

• Avoid embedding credentials directly in the Jenkinsfile

• Store secrets in Jenkins Credentials Manager