From f46fe3ec0867c8bfa57f5c0c6979d1633648ebfe Mon Sep 17 00:00:00 2001
From: Christopher Wellons <wellons@nullprogram.com>
Date: Sun, 3 May 2026 10:20:40 -0400
Subject: [PATCH] Update aas-sign to 1.1.0; drop shell-level retry

aas-sign 1.1.0 retries transient TLS / network errors internally
(TransientNetworkError is caught and the failing call is retried
with linear backoff). The shell wrapper no longer needs its own
retry loop, so drop sign() and revert to a single direct
aas-sign sign invocation backed by xargs again.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 Dockerfile           |  4 ++--
 src/sign-and-pack.sh | 39 ++++++++++++++-------------------------
 2 files changed, 16 insertions(+), 27 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 97b4589..6c9c762 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -204,8 +204,8 @@ RUN curl --insecure --location --remote-name-all --remote-header-name \
  && tar xJf 7z$Z7_VERSION-src.tar.xz -C 7z
 
 FROM base AS dl-aas-sign
-ARG AAS_SIGN_VERSION=1.0.0 \
-    AAS_SIGN_SHA256=cd12b1de361bcd131cf2670e8316e87ec92f2219c32dbeffb01e27675f955c83
+ARG AAS_SIGN_VERSION=1.1.0 \
+    AAS_SIGN_SHA256=4ba127b0434f6e0f8af639e51a0c961e95b5adeb06391dd6ef02445e0b027c3f
 WORKDIR /dl
 RUN curl --insecure --location --remote-name-all --remote-header-name \
     https://github.com/skeeto/aas-sign/releases/download/v$AAS_SIGN_VERSION/aas-sign-$AAS_SIGN_VERSION.tar.gz \
diff --git a/src/sign-and-pack.sh b/src/sign-and-pack.sh
index 06d12a2..e7702e9 100755
--- a/src/sign-and-pack.sh
+++ b/src/sign-and-pack.sh
@@ -9,6 +9,9 @@
 # must be forwarded with `docker run -e`. The signing target (endpoint /
 # account / profile) is taken from environment variables below; they're
 # not secret but they're configuration the container shouldn't bake in.
+#
+# aas-sign 1.1.0+ retries transient TLS / network errors internally,
+# so this script just calls it once and trusts it.
 
 set -e
 : "${AAS_SIGN_ENDPOINT:?AAS_SIGN_ENDPOINT not set}"
@@ -19,38 +22,24 @@ set -e
 # that progress output doesn't corrupt the binary stream on stdout.
 exec 3>&1 1>&2
 
-# Wrap aas-sign in a small retry loop. Azure occasionally returns a
-# spurious TLS handshake error under concurrency (mbedTLS reports it as
-# "Generic error" or "This is a bug in the library"); retrying clears
-# it. aas-sign's inject_signature overwrites any existing signature, so
-# re-signing already-signed files is harmless, just slower.
-sign() {
-    attempt=1
-    until aas-sign sign --max-parallel 8 \
-                        --endpoint "$AAS_SIGN_ENDPOINT" \
-                        --account  "$AAS_SIGN_ACCOUNT" \
-                        --profile  "$AAS_SIGN_PROFILE" \
-                        "$@"; do
-        if [ $attempt -ge 3 ]; then
-            echo "aas-sign failed after $attempt attempts" >&2
-            return 1
-        fi
-        attempt=$((attempt + 1))
-        echo "aas-sign failed; retrying (attempt $attempt of 3)..." >&2
-        sleep $((attempt * 3))
-    done
-}
-
 # Sign every executable and DLL inside the toolchain. Toolchain paths
-# don't contain whitespace, so plain word splitting is fine here.
-sign $(find "$PREFIX" -type f \( -name '*.exe' -o -name '*.dll' \))
+# don't contain whitespace, so plain word splitting through xargs is
+# fine here.
+find "$PREFIX" -type f \( -name '*.exe' -o -name '*.dll' \) -print0 \
+  | xargs -0 aas-sign sign --max-parallel 8 \
+                           --endpoint "$AAS_SIGN_ENDPOINT" \
+                           --account  "$AAS_SIGN_ACCOUNT" \
+                           --profile  "$AAS_SIGN_PROFILE"
 
 # Pack the (now-signed) toolchain.
 7z a -mx=9 -mtm=- w64devkit.7z "$PREFIX"
 
 # Concatenate the SFX prefix with the archive, then sign the result.
 cat /7z/7z.sfx w64devkit.7z >/w64devkit.7z.exe
-sign /w64devkit.7z.exe
+aas-sign sign --endpoint "$AAS_SIGN_ENDPOINT" \
+              --account  "$AAS_SIGN_ACCOUNT" \
+              --profile  "$AAS_SIGN_PROFILE" \
+              /w64devkit.7z.exe
 
 exec 1>&3 3>&-
 exec cat /w64devkit.7z.exe