Update aas-sign to 1.1.0; drop shell-level retry

aas-sign 1.1.0 retries transient TLS / network errors internally
(TransientNetworkError is caught and the failing call is retried
with linear backoff). The shell wrapper no longer needs its own
retry loop, so drop sign() and revert to a single direct
aas-sign sign invocation backed by xargs again.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Dockerfile

@@ -204,8 +204,8 @@ RUN curl --insecure --location --remote-name-all --remote-header-name \
  && tar xJf 7z$Z7_VERSION-src.tar.xz -C 7z
 
 FROM base AS dl-aas-sign
-ARG AAS_SIGN_VERSION=1.0.0 \
-    AAS_SIGN_SHA256=cd12b1de361bcd131cf2670e8316e87ec92f2219c32dbeffb01e27675f955c83
+ARG AAS_SIGN_VERSION=1.1.0 \
+    AAS_SIGN_SHA256=4ba127b0434f6e0f8af639e51a0c961e95b5adeb06391dd6ef02445e0b027c3f
 WORKDIR /dl
 RUN curl --insecure --location --remote-name-all --remote-header-name \
     https://github.com/skeeto/aas-sign/releases/download/v$AAS_SIGN_VERSION/aas-sign-$AAS_SIGN_VERSION.tar.gz \

src/sign-and-pack.sh

@@ -9,6 +9,9 @@
 # must be forwarded with `docker run -e`. The signing target (endpoint /
 # account / profile) is taken from environment variables below; they're
 # not secret but they're configuration the container shouldn't bake in.
+#
+# aas-sign 1.1.0+ retries transient TLS / network errors internally,
+# so this script just calls it once and trusts it.
 
 set -e
 : "${AAS_SIGN_ENDPOINT:?AAS_SIGN_ENDPOINT not set}"
@@ -19,38 +22,24 @@ set -e
 # that progress output doesn't corrupt the binary stream on stdout.
 exec 3>&1 1>&2
 
-# Wrap aas-sign in a small retry loop. Azure occasionally returns a
-# spurious TLS handshake error under concurrency (mbedTLS reports it as
-# "Generic error" or "This is a bug in the library"); retrying clears
-# it. aas-sign's inject_signature overwrites any existing signature, so
-# re-signing already-signed files is harmless, just slower.
-sign() {
-    attempt=1
-    until aas-sign sign --max-parallel 8 \
-                        --endpoint "$AAS_SIGN_ENDPOINT" \
-                        --account  "$AAS_SIGN_ACCOUNT" \
-                        --profile  "$AAS_SIGN_PROFILE" \
-                        "$@"; do
-        if [ $attempt -ge 3 ]; then
-            echo "aas-sign failed after $attempt attempts" >&2
-            return 1
-        fi
-        attempt=$((attempt + 1))
-        echo "aas-sign failed; retrying (attempt $attempt of 3)..." >&2
-        sleep $((attempt * 3))
-    done
-}
-
 # Sign every executable and DLL inside the toolchain. Toolchain paths
-# don't contain whitespace, so plain word splitting is fine here.
-sign $(find "$PREFIX" -type f \( -name '*.exe' -o -name '*.dll' \))
+# don't contain whitespace, so plain word splitting through xargs is
+# fine here.
+find "$PREFIX" -type f \( -name '*.exe' -o -name '*.dll' \) -print0 \
+  | xargs -0 aas-sign sign --max-parallel 8 \
+                           --endpoint "$AAS_SIGN_ENDPOINT" \
+                           --account  "$AAS_SIGN_ACCOUNT" \
+                           --profile  "$AAS_SIGN_PROFILE"
 
 # Pack the (now-signed) toolchain.
 7z a -mx=9 -mtm=- w64devkit.7z "$PREFIX"
 
 # Concatenate the SFX prefix with the archive, then sign the result.
 cat /7z/7z.sfx w64devkit.7z >/w64devkit.7z.exe
-sign /w64devkit.7z.exe
+aas-sign sign --endpoint "$AAS_SIGN_ENDPOINT" \
+              --account  "$AAS_SIGN_ACCOUNT" \
+              --profile  "$AAS_SIGN_PROFILE" \
+              /w64devkit.7z.exe
 
 exec 1>&3 3>&-
 exec cat /w64devkit.7z.exe