mirror of
https://github.com/PowerShell/PowerShell
synced 2026-06-08 12:12:50 +00:00
Add authenticode signing for assemblies on linux builds (#18440)
This commit is contained in:
Aditya Patwardhan
@@ -100,7 +100,7 @@ stages:
|
||||
- template: templates/linux.yml
|
||||
parameters:
|
||||
buildName: rpm
|
||||
uploadDisplayName: Upload and Sign
|
||||
parentJob: build_deb
|
||||
|
||||
- template: templates/linux.yml
|
||||
parameters:
|
||||
@@ -111,6 +111,29 @@ stages:
|
||||
parameters:
|
||||
buildName: alpine
|
||||
|
||||
- template: templates/linux-authenticode-sign.yml
|
||||
|
||||
- template: templates/linux-packaging.yml
|
||||
parameters:
|
||||
buildName: deb
|
||||
parentJob: sign_linux_builds
|
||||
|
||||
- template: templates/linux-packaging.yml
|
||||
parameters:
|
||||
buildName: rpm
|
||||
uploadDisplayName: Upload and Sign
|
||||
parentJob: sign_linux_builds
|
||||
|
||||
- template: templates/linux-packaging.yml
|
||||
parameters:
|
||||
buildName: alpine
|
||||
parentJob: sign_linux_builds
|
||||
|
||||
- template: templates/linux-packaging.yml
|
||||
parameters:
|
||||
buildName: fxdependent
|
||||
parentJob: sign_linux_builds
|
||||
|
||||
- stage: windows
|
||||
dependsOn: ['prep']
|
||||
jobs:
|
||||
|
||||
@@ -0,0 +1,127 @@
|
||||
jobs:
|
||||
- job: sign_linux_builds
|
||||
displayName: Sign all linux builds
|
||||
condition: succeeded()
|
||||
pool:
|
||||
name: PowerShell1ES
|
||||
demands:
|
||||
- ImageOverride -equals PSMMS2019-Secure
|
||||
dependsOn: ['build_fxdependent', 'build_rpm']
|
||||
variables:
|
||||
- name: runCodesignValidationInjection
|
||||
value: false
|
||||
- name: NugetSecurityAnalysisWarningLevel
|
||||
value: none
|
||||
- group: ESRP
|
||||
|
||||
steps:
|
||||
- checkout: self
|
||||
clean: true
|
||||
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuild
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuild
|
||||
displayName: Download deb build
|
||||
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildMinSize
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize
|
||||
displayName: Download min-size build
|
||||
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildArm32
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32
|
||||
displayName: Download arm32 build
|
||||
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildArm64
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64
|
||||
displayName: Download arm64 build
|
||||
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshMarinerBuildAmd64
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64
|
||||
displayName: Download mariner build
|
||||
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildAlpine
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildAlpine
|
||||
displayName: Download alpine build
|
||||
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildFxdependent
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildFxdependent
|
||||
displayName: Download fxdependent build
|
||||
|
||||
- template: SetVersionVariables.yml
|
||||
parameters:
|
||||
ReleaseTagVar: $(ReleaseTagVar)
|
||||
|
||||
- template: cloneToOfficialPath.yml
|
||||
|
||||
- template: insert-nuget-config-azfeed.yml
|
||||
parameters:
|
||||
repoRoot: $(PowerShellRoot)
|
||||
|
||||
- powershell: |
|
||||
Set-Location $env:POWERSHELLROOT
|
||||
import-module "$env:POWERSHELLROOT/build.psm1"
|
||||
Sync-PSTags -AddRemoteIfMissing
|
||||
displayName: SyncTags
|
||||
condition: and(succeeded(), ne(variables['SkipBuild'], 'true'))
|
||||
|
||||
- checkout: ComplianceRepo
|
||||
clean: true
|
||||
|
||||
- template: shouldSign.yml
|
||||
|
||||
- template: signBuildFiles.yml
|
||||
parameters:
|
||||
binLocation: pwshLinuxBuild
|
||||
buildPrefixName: 'PowerShell Linux'
|
||||
|
||||
- template: signBuildFiles.yml
|
||||
parameters:
|
||||
binLocation: pwshLinuxBuildMinSize
|
||||
buildPrefixName: 'PowerShell Linux Minimum Size'
|
||||
|
||||
- template: signBuildFiles.yml
|
||||
parameters:
|
||||
binLocation: pwshLinuxBuildArm32
|
||||
buildPrefixName: 'PowerShell Linux Arm32'
|
||||
|
||||
- template: signBuildFiles.yml
|
||||
parameters:
|
||||
binLocation: pwshLinuxBuildArm64
|
||||
buildPrefixName: 'PowerShell Linux Arm64'
|
||||
|
||||
- template: signBuildFiles.yml
|
||||
parameters:
|
||||
binLocation: pwshMarinerBuildAmd64
|
||||
buildPrefixName: 'PowerShell Linux x64 Framework Dependent'
|
||||
|
||||
- template: signBuildFiles.yml
|
||||
parameters:
|
||||
binLocation: pwshLinuxBuildAlpine
|
||||
buildPrefixName: 'PowerShell Linux Alpine x64'
|
||||
|
||||
- template: signBuildFiles.yml
|
||||
parameters:
|
||||
binLocation: pwshLinuxBuildFxdependent
|
||||
buildPrefixName: 'PowerShell Linux Framework Dependent'
|
||||
|
||||
#- template: Sbom.yml@ComplianceRepo
|
||||
# parameters:
|
||||
# BuildDropPath: '$(System.ArtifactsDirectory)/$(BIN_LOCATION)'
|
||||
# Build_Repository_Uri: $(Github_Build_Repository_Uri)
|
||||
# displayName: ${{ parameters.buildName }} SBOM
|
||||
# PackageName: $(PACKAGE_NAME)
|
||||
# PackageVersion: $(Version)
|
||||
# sourceScanPath: '$(PowerShellRoot)/tools'
|
||||
@@ -0,0 +1,391 @@
|
||||
parameters:
|
||||
buildName: ''
|
||||
uploadDisplayName: 'Upload'
|
||||
parentJob: ''
|
||||
|
||||
jobs:
|
||||
- job: pkg_${{ parameters.buildName }}
|
||||
displayName: Package ${{ parameters.buildName }}
|
||||
condition: succeeded()
|
||||
pool:
|
||||
name: PowerShell1ES
|
||||
demands:
|
||||
- ImageOverride -equals PSMMSUbuntu20.04-Secure
|
||||
dependsOn: sign_linux_builds
|
||||
variables:
|
||||
- name: runCodesignValidationInjection
|
||||
value: false
|
||||
- name: build
|
||||
value: ${{ parameters.buildName }}
|
||||
- name: NugetSecurityAnalysisWarningLevel
|
||||
value: none
|
||||
- group: ESRP
|
||||
|
||||
steps:
|
||||
- ${{ if or(eq(variables.build,'deb'), eq(variables.build,'rpm')) }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuild-signed
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuild
|
||||
displayName: Download deb build
|
||||
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildMinSize-signed
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize
|
||||
displayName: Download min-size build
|
||||
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildArm32-signed
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32
|
||||
displayName: Download arm32 build
|
||||
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildArm64-signed
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64
|
||||
displayName: Download arm64 build
|
||||
|
||||
- ${{ if eq(variables.build,'rpm') }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshMarinerBuildAmd64-signed
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64
|
||||
displayName: Download mariner build
|
||||
|
||||
- ${{ if eq(variables.build,'alpine') }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildAlpine-signed
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuild
|
||||
displayName: Download alpine build
|
||||
|
||||
- ${{ if eq(variables.build,'fxdependent') }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildFxdependent-signed
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuild
|
||||
displayName: Download fxdependent build
|
||||
|
||||
- ${{ if or(eq(variables.build,'deb'), eq(variables.build,'rpm')) }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuild-meta
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuild-meta
|
||||
displayName: Download deb build meta
|
||||
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildMinSize-meta
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize-meta
|
||||
displayName: Download min-size build meta
|
||||
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildArm32-meta
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32-meta
|
||||
displayName: Download arm32 build meta
|
||||
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildArm64-meta
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64-meta
|
||||
displayName: Download arm64 build meta
|
||||
|
||||
- ${{ if eq(variables.build,'rpm') }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshMarinerBuildAmd64-meta
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64-meta
|
||||
displayName: Download mariner build meta
|
||||
|
||||
- ${{ if eq(variables.build,'alpine') }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildAlpine-meta
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuild-meta
|
||||
displayName: Download alpine build meta
|
||||
|
||||
- ${{ if eq(variables.build,'fxdependent') }} :
|
||||
- task: DownloadPipelineArtifact@2
|
||||
inputs:
|
||||
artifact: pwshLinuxBuildFxdependent-meta
|
||||
path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuild-meta
|
||||
displayName: Download fxdependent build meta
|
||||
|
||||
- pwsh: |
|
||||
Get-ChildItem '$(Build.ArtifactStagingDirectory)' | Select-Object -Property 'unixmode', 'size', 'name'
|
||||
displayName: Capture downloads
|
||||
|
||||
- checkout: self
|
||||
clean: true
|
||||
|
||||
- checkout: ComplianceRepo
|
||||
clean: true
|
||||
|
||||
- template: SetVersionVariables.yml
|
||||
parameters:
|
||||
ReleaseTagVar: $(ReleaseTagVar)
|
||||
|
||||
- pwsh: |
|
||||
# create folder
|
||||
sudo mkdir /PowerShell
|
||||
|
||||
# make the current user the owner
|
||||
sudo chown $env:USER /PowerShell
|
||||
displayName: 'Create /PowerShell'
|
||||
|
||||
- template: cloneToOfficialPath.yml
|
||||
|
||||
- template: insert-nuget-config-azfeed.yml
|
||||
parameters:
|
||||
repoRoot: $(PowerShellRoot)
|
||||
|
||||
- powershell: |
|
||||
import-module "$env:POWERSHELLROOT/build.psm1"
|
||||
Sync-PSTags -AddRemoteIfMissing
|
||||
displayName: SyncTags
|
||||
condition: and(succeeded(), ne(variables['SkipBuild'], 'true'))
|
||||
workingDirectory: $(PowerShellRoot)
|
||||
|
||||
- powershell: |
|
||||
Import-Module "$env:POWERSHELLROOT/build.psm1"
|
||||
|
||||
Start-PSBootstrap -Package
|
||||
displayName: 'Bootstrap'
|
||||
condition: and(succeeded(), ne(variables['SkipBuild'], 'true'))
|
||||
workingDirectory: $(PowerShellRoot)
|
||||
|
||||
- powershell: |
|
||||
try {
|
||||
Import-Module "$env:POWERSHELLROOT/build.psm1"
|
||||
Import-Module "$env:POWERSHELLROOT/tools/packaging"
|
||||
|
||||
$metadata = Get-Content "$env:POWERSHELLROOT/tools/metadata.json" -Raw | ConvertFrom-Json
|
||||
|
||||
# LTSRelease.Package indicates that the release should be packaged as an LTS
|
||||
$LTS = $metadata.LTSRelease.Package
|
||||
Write-Verbose -Verbose -Message "LTS is set to: $LTS"
|
||||
|
||||
Invoke-AzDevOpsLinuxPackageCreation -ReleaseTag '$(ReleaseTagVar)' -BuildType '$(build)'
|
||||
|
||||
if ($LTS) {
|
||||
Write-Verbose -Verbose "Packaging LTS"
|
||||
Invoke-AzDevOpsLinuxPackageCreation -LTS -ReleaseTag '$(ReleaseTagVar)' -BuildType '$(build)'
|
||||
}
|
||||
} catch {
|
||||
Get-Error
|
||||
throw
|
||||
}
|
||||
displayName: 'Package'
|
||||
condition: and(succeeded(), ne(variables['SkipBuild'], 'true'))
|
||||
workingDirectory: $(PowerShellRoot)
|
||||
|
||||
- powershell: |
|
||||
$linuxPackages = Get-ChildItem "$env:POWERSHELLROOT/powershell*" -Include *.deb,*.rpm,*.tar.gz
|
||||
|
||||
$bucket = 'release'
|
||||
foreach ($linuxPackage in $linuxPackages)
|
||||
{
|
||||
$filePath = $linuxPackage.FullName
|
||||
Write-Verbose "Publishing $filePath to $bucket" -Verbose
|
||||
Write-Host "##vso[artifact.upload containerfolder=$bucket;artifactname=$bucket]$filePath"
|
||||
}
|
||||
displayName: Publish artifacts
|
||||
condition: and(succeeded(), ne(variables['SkipBuild'], 'true'))
|
||||
workingDirectory: $(PowerShellRoot)
|
||||
|
||||
- template: /tools/releaseBuild/azureDevOps/templates/step/finalize.yml
|
||||
|
||||
- job: upload_${{ parameters.buildName }}
|
||||
displayName: ${{ parameters.uploadDisplayName }} ${{ parameters.buildName }}
|
||||
dependsOn: pkg_${{ parameters.buildName }}
|
||||
condition: succeeded()
|
||||
pool:
|
||||
name: PowerShell1ES
|
||||
demands:
|
||||
- ImageOverride -equals PSMMS2019-Secure
|
||||
variables:
|
||||
- name: buildName
|
||||
value: ${{ parameters.buildName }}
|
||||
- group: ESRP
|
||||
- name: runCodesignValidationInjection
|
||||
value: false
|
||||
- name: NugetSecurityAnalysisWarningLevel
|
||||
value: none
|
||||
- name: skipComponentGovernanceDetection
|
||||
value: true
|
||||
|
||||
steps:
|
||||
- checkout: self
|
||||
clean: true
|
||||
|
||||
- checkout: ComplianceRepo
|
||||
clean: true
|
||||
|
||||
- template: SetVersionVariables.yml
|
||||
parameters:
|
||||
ReleaseTagVar: $(ReleaseTagVar)
|
||||
- template: shouldSign.yml
|
||||
|
||||
- task: DownloadBuildArtifacts@0
|
||||
displayName: 'Download Deb Artifacts'
|
||||
inputs:
|
||||
downloadType: specific
|
||||
itemPattern: '**/*.deb'
|
||||
downloadPath: '$(System.ArtifactsDirectory)\finished'
|
||||
condition: and(eq(variables['buildName'], 'DEB'), succeeded())
|
||||
|
||||
- task: DownloadBuildArtifacts@0
|
||||
displayName: 'Download tar.gz Artifacts copy'
|
||||
inputs:
|
||||
downloadType: specific
|
||||
itemPattern: '**/*.tar.gz'
|
||||
downloadPath: '$(System.ArtifactsDirectory)\finished'
|
||||
|
||||
- powershell: |
|
||||
Write-Host 'We handle the min-size package only when uploading for deb build.'
|
||||
Write-Host '- For deb build, the min-size package is moved to a separate folder "finished\minSize",'
|
||||
Write-Host ' so that the min-size package can be uploaded to a different Az Blob container.'
|
||||
Write-Host '- For other builds, the min-size package is removed after being downloaded, so that it'
|
||||
Write-Host ' does not get accidentally uploaded to the wrong Az Blob container.'
|
||||
|
||||
$minSizePkg = '$(System.ArtifactsDirectory)\finished\release\*-gc.tar.gz'
|
||||
if (Test-Path -Path $minSizePkg)
|
||||
{
|
||||
if ('$(buildName)' -eq 'DEB')
|
||||
{
|
||||
$minSizeDir = '$(System.ArtifactsDirectory)\finished\minSize'
|
||||
New-Item -Path $minSizeDir -Type Directory -Force > $null
|
||||
Move-Item -Path $minSizePkg -Destination $minSizeDir
|
||||
|
||||
Write-Host "`nCapture the min-size package moved to the target folder."
|
||||
Get-ChildItem -Path $minSizeDir
|
||||
}
|
||||
else
|
||||
{
|
||||
Write-Host '$(buildName): Remove the min-size package.'
|
||||
Remove-Item -Path $minSizePkg -Force
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
Write-Host 'min-size package not found, so skip this step.'
|
||||
}
|
||||
displayName: 'Move minSize package to separate folder'
|
||||
|
||||
- task: DownloadBuildArtifacts@0
|
||||
displayName: 'Download rpm Artifacts copy'
|
||||
inputs:
|
||||
downloadType: specific
|
||||
itemPattern: '**/*.rpm'
|
||||
downloadPath: '$(System.ArtifactsDirectory)\rpm'
|
||||
condition: and(eq(variables['buildName'], 'RPM'), succeeded())
|
||||
|
||||
- template: EsrpScan.yml@ComplianceRepo
|
||||
parameters:
|
||||
scanPath: $(System.ArtifactsDirectory)
|
||||
pattern: |
|
||||
**\*.rpm
|
||||
**\*.deb
|
||||
**\*.tar.gz
|
||||
|
||||
- ${{ if eq(variables['buildName'], 'RPM') }}:
|
||||
- template: EsrpSign.yml@ComplianceRepo
|
||||
parameters:
|
||||
buildOutputPath: $(System.ArtifactsDirectory)\rpm
|
||||
signOutputPath: $(Build.StagingDirectory)\signedPackages
|
||||
certificateId: "CP-450779-Pgp"
|
||||
pattern: |
|
||||
**\*.rh.*.rpm
|
||||
useMinimatch: true
|
||||
shouldSign: $(SHOULD_SIGN)
|
||||
displayName: Sign RedHat RPM
|
||||
OutputMode: AlwaysCopy
|
||||
|
||||
- ${{ if eq(variables['buildName'], 'RPM') }}:
|
||||
- template: EsrpSign.yml@ComplianceRepo
|
||||
parameters:
|
||||
# Sign in-place, previous task copied the files to this folder
|
||||
buildOutputPath: $(Build.StagingDirectory)\signedPackages
|
||||
signOutputPath: $(Build.StagingDirectory)\signedPackages
|
||||
certificateId: "CP-459159-Pgp"
|
||||
pattern: |
|
||||
**\*.cm.*.rpm
|
||||
**\*.cm?.*.rpm
|
||||
useMinimatch: true
|
||||
shouldSign: $(SHOULD_SIGN)
|
||||
displayName: Sign Mariner RPM
|
||||
OutputMode: NeverCopy
|
||||
|
||||
# requires windows
|
||||
- ${{ if ne(variables['buildName'], 'RPM') }}:
|
||||
- task: AzureFileCopy@4
|
||||
displayName: 'Upload to Azure - DEB and tar.gz'
|
||||
inputs:
|
||||
SourcePath: '$(System.ArtifactsDirectory)\finished\release\*'
|
||||
azureSubscription: '$(AzureFileCopySubscription)'
|
||||
Destination: AzureBlob
|
||||
storage: '$(StorageAccount)'
|
||||
ContainerName: '$(AzureVersion)'
|
||||
|
||||
- template: upload-final-results.yml
|
||||
parameters:
|
||||
artifactPath: $(System.ArtifactsDirectory)\finished\release
|
||||
|
||||
# requires windows
|
||||
- task: AzureFileCopy@4
|
||||
displayName: 'Upload to Azure - min-size package for Guest Config'
|
||||
inputs:
|
||||
SourcePath: '$(System.ArtifactsDirectory)\finished\minSize\*'
|
||||
azureSubscription: '$(AzureFileCopySubscription)'
|
||||
Destination: AzureBlob
|
||||
storage: '$(StorageAccount)'
|
||||
ContainerName: '$(AzureVersion)-gc'
|
||||
condition: and(eq(variables['buildName'], 'DEB'), succeeded())
|
||||
|
||||
- template: upload-final-results.yml
|
||||
parameters:
|
||||
artifactPath: $(System.ArtifactsDirectory)\finished\minSize
|
||||
condition: and(eq(variables['buildName'], 'DEB'), succeeded())
|
||||
|
||||
# requires windows
|
||||
- task: AzureFileCopy@4
|
||||
displayName: 'Upload to Azure - RPM - Unsigned'
|
||||
inputs:
|
||||
SourcePath: '$(System.ArtifactsDirectory)\rpm\release\*'
|
||||
azureSubscription: '$(AzureFileCopySubscription)'
|
||||
Destination: AzureBlob
|
||||
storage: '$(StorageAccount)'
|
||||
ContainerName: '$(AzureVersion)'
|
||||
condition: and(and(succeeded(), ne(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM'))
|
||||
|
||||
# requires windows
|
||||
- task: AzureFileCopy@4
|
||||
displayName: 'Upload to Azure - RPM - Signed'
|
||||
inputs:
|
||||
SourcePath: '$(Build.StagingDirectory)\signedPackages\release\*'
|
||||
azureSubscription: '$(AzureFileCopySubscription)'
|
||||
Destination: AzureBlob
|
||||
storage: '$(StorageAccount)'
|
||||
ContainerName: '$(AzureVersion)'
|
||||
condition: and(and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM'))
|
||||
|
||||
- template: upload-final-results.yml
|
||||
parameters:
|
||||
artifactPath: $(System.ArtifactsDirectory)\rpm\release
|
||||
condition: and(and(succeeded(), ne(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM'))
|
||||
|
||||
- template: upload-final-results.yml
|
||||
parameters:
|
||||
artifactPath: '$(Build.StagingDirectory)\signedPackages\release'
|
||||
condition: and(and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM'))
|
||||
|
||||
- template: /tools/releaseBuild/azureDevOps/templates/step/finalize.yml
|
||||
@@ -124,229 +124,86 @@ jobs:
|
||||
PackageVersion: $(Version)
|
||||
sourceScanPath: '$(PowerShellRoot)/tools'
|
||||
|
||||
- powershell: |
|
||||
try {
|
||||
Import-Module "$env:POWERSHELLROOT/build.psm1"
|
||||
Import-Module "$env:POWERSHELLROOT/tools/packaging"
|
||||
|
||||
$metadata = Get-Content "$env:POWERSHELLROOT/tools/metadata.json" -Raw | ConvertFrom-Json
|
||||
|
||||
# LTSRelease.Package indicates that the release should be packaged as an LTS
|
||||
$LTS = $metadata.LTSRelease.Package
|
||||
Write-Verbose -Verbose -Message "LTS is set to: $LTS"
|
||||
|
||||
Invoke-AzDevOpsLinuxPackageCreation -ReleaseTag '$(ReleaseTagVar)' -BuildType '$(build)'
|
||||
|
||||
if ($LTS) {
|
||||
Write-Verbose -Verbose "Packaging LTS"
|
||||
Invoke-AzDevOpsLinuxPackageCreation -LTS -ReleaseTag '$(ReleaseTagVar)' -BuildType '$(build)'
|
||||
}
|
||||
} catch {
|
||||
Get-Error
|
||||
throw
|
||||
}
|
||||
displayName: 'Package'
|
||||
condition: and(succeeded(), ne(variables['SkipBuild'], 'true'))
|
||||
workingDirectory: $(PowerShellRoot)
|
||||
|
||||
- powershell: |
|
||||
$linuxPackages = Get-ChildItem "$env:POWERSHELLROOT/powershell*" -Include *.deb,*.rpm,*.tar.gz
|
||||
|
||||
$bucket = 'release'
|
||||
foreach ($linuxPackage in $linuxPackages)
|
||||
{
|
||||
$filePath = $linuxPackage.FullName
|
||||
Write-Verbose "Publishing $filePath to $bucket" -Verbose
|
||||
Write-Host "##vso[artifact.upload containerfolder=$bucket;artifactname=$bucket]$filePath"
|
||||
}
|
||||
displayName: Publish artifacts
|
||||
condition: and(succeeded(), ne(variables['SkipBuild'], 'true'))
|
||||
workingDirectory: $(PowerShellRoot)
|
||||
|
||||
- template: /tools/releaseBuild/azureDevOps/templates/step/finalize.yml
|
||||
|
||||
- job: upload_${{ parameters.buildName }}
|
||||
displayName: ${{ parameters.uploadDisplayName }} ${{ parameters.buildName }}
|
||||
dependsOn: build_${{ parameters.buildName }}
|
||||
condition: succeeded()
|
||||
pool:
|
||||
name: PowerShell1ES
|
||||
demands:
|
||||
- ImageOverride -equals PSMMS2019-Secure
|
||||
variables:
|
||||
- name: buildName
|
||||
value: ${{ parameters.buildName }}
|
||||
- group: ESRP
|
||||
- name: runCodesignValidationInjection
|
||||
value: false
|
||||
- name: NugetSecurityAnalysisWarningLevel
|
||||
value: none
|
||||
- name: skipComponentGovernanceDetection
|
||||
value: true
|
||||
|
||||
steps:
|
||||
- checkout: self
|
||||
clean: true
|
||||
|
||||
- checkout: ComplianceRepo
|
||||
clean: true
|
||||
|
||||
- template: SetVersionVariables.yml
|
||||
parameters:
|
||||
ReleaseTagVar: $(ReleaseTagVar)
|
||||
- template: shouldSign.yml
|
||||
|
||||
- task: DownloadBuildArtifacts@0
|
||||
displayName: 'Download Deb Artifacts'
|
||||
inputs:
|
||||
downloadType: specific
|
||||
itemPattern: '**/*.deb'
|
||||
downloadPath: '$(System.ArtifactsDirectory)\finished'
|
||||
condition: and(eq(variables['buildName'], 'DEB'), succeeded())
|
||||
|
||||
- task: DownloadBuildArtifacts@0
|
||||
displayName: 'Download tar.gz Artifacts copy'
|
||||
inputs:
|
||||
downloadType: specific
|
||||
itemPattern: '**/*.tar.gz'
|
||||
downloadPath: '$(System.ArtifactsDirectory)\finished'
|
||||
|
||||
- powershell: |
|
||||
Write-Host 'We handle the min-size package only when uploading for deb build.'
|
||||
Write-Host '- For deb build, the min-size package is moved to a separate folder "finished\minSize",'
|
||||
Write-Host ' so that the min-size package can be uploaded to a different Az Blob container.'
|
||||
Write-Host '- For other builds, the min-size package is removed after being downloaded, so that it'
|
||||
Write-Host ' does not get accidentally uploaded to the wrong Az Blob container.'
|
||||
|
||||
$minSizePkg = '$(System.ArtifactsDirectory)\finished\release\*-gc.tar.gz'
|
||||
if (Test-Path -Path $minSizePkg)
|
||||
{
|
||||
if ('$(buildName)' -eq 'DEB')
|
||||
{
|
||||
$minSizeDir = '$(System.ArtifactsDirectory)\finished\minSize'
|
||||
New-Item -Path $minSizeDir -Type Directory -Force > $null
|
||||
Move-Item -Path $minSizePkg -Destination $minSizeDir
|
||||
|
||||
Write-Host "`nCapture the min-size package moved to the target folder."
|
||||
Get-ChildItem -Path $minSizeDir
|
||||
}
|
||||
else
|
||||
{
|
||||
Write-Host '$(buildName): Remove the min-size package.'
|
||||
Remove-Item -Path $minSizePkg -Force
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
Write-Host 'min-size package not found, so skip this step.'
|
||||
}
|
||||
displayName: 'Move minSize package to separate folder'
|
||||
|
||||
- task: DownloadBuildArtifacts@0
|
||||
displayName: 'Download rpm Artifacts copy'
|
||||
inputs:
|
||||
downloadType: specific
|
||||
itemPattern: '**/*.rpm'
|
||||
downloadPath: '$(System.ArtifactsDirectory)\rpm'
|
||||
condition: and(eq(variables['buildName'], 'RPM'), succeeded())
|
||||
|
||||
- template: EsrpScan.yml@ComplianceRepo
|
||||
parameters:
|
||||
scanPath: $(System.ArtifactsDirectory)
|
||||
pattern: |
|
||||
**\*.rpm
|
||||
**\*.deb
|
||||
**\*.tar.gz
|
||||
|
||||
- ${{ if eq(variables['buildName'], 'RPM') }}:
|
||||
- template: EsrpSign.yml@ComplianceRepo
|
||||
parameters:
|
||||
buildOutputPath: $(System.ArtifactsDirectory)\rpm
|
||||
signOutputPath: $(Build.StagingDirectory)\signedPackages
|
||||
certificateId: "CP-450779-Pgp"
|
||||
pattern: |
|
||||
**\*.rh.*.rpm
|
||||
useMinimatch: true
|
||||
shouldSign: $(SHOULD_SIGN)
|
||||
displayName: Sign RedHat RPM
|
||||
OutputMode: AlwaysCopy
|
||||
|
||||
- ${{ if eq(variables['buildName'], 'RPM') }}:
|
||||
- template: EsrpSign.yml@ComplianceRepo
|
||||
parameters:
|
||||
# Sign in-place, previous task copied the files to this folder
|
||||
buildOutputPath: $(Build.StagingDirectory)\signedPackages
|
||||
signOutputPath: $(Build.StagingDirectory)\signedPackages
|
||||
certificateId: "CP-459159-Pgp"
|
||||
pattern: |
|
||||
**\*.cm.*.rpm
|
||||
**\*.cm?.*.rpm
|
||||
useMinimatch: true
|
||||
shouldSign: $(SHOULD_SIGN)
|
||||
displayName: Sign Mariner RPM
|
||||
OutputMode: NeverCopy
|
||||
|
||||
# requires windows
|
||||
- ${{ if ne(variables['buildName'], 'RPM') }}:
|
||||
- task: AzureFileCopy@4
|
||||
displayName: 'Upload to Azure - DEB and tar.gz'
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
SourcePath: '$(System.ArtifactsDirectory)\finished\release\*'
|
||||
azureSubscription: '$(AzureFileCopySubscription)'
|
||||
Destination: AzureBlob
|
||||
storage: '$(StorageAccount)'
|
||||
ContainerName: '$(AzureVersion)'
|
||||
path: '$(System.ArtifactsDirectory)/pwshLinuxBuild'
|
||||
artifactName: pwshLinuxBuild
|
||||
|
||||
- template: upload-final-results.yml
|
||||
parameters:
|
||||
artifactPath: $(System.ArtifactsDirectory)\finished\release
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
path: '$(System.ArtifactsDirectory)/pwshLinuxBuild-meta'
|
||||
artifactName: pwshLinuxBuild-meta
|
||||
|
||||
# requires windows
|
||||
- task: AzureFileCopy@4
|
||||
displayName: 'Upload to Azure - min-size package for Guest Config'
|
||||
inputs:
|
||||
SourcePath: '$(System.ArtifactsDirectory)\finished\minSize\*'
|
||||
azureSubscription: '$(AzureFileCopySubscription)'
|
||||
Destination: AzureBlob
|
||||
storage: '$(StorageAccount)'
|
||||
ContainerName: '$(AzureVersion)-gc'
|
||||
condition: and(eq(variables['buildName'], 'DEB'), succeeded())
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
path: '$(System.ArtifactsDirectory)/pwshLinuxBuildMinSize'
|
||||
artifactName: pwshLinuxBuildMinSize
|
||||
|
||||
- template: upload-final-results.yml
|
||||
parameters:
|
||||
artifactPath: $(System.ArtifactsDirectory)\finished\minSize
|
||||
condition: and(eq(variables['buildName'], 'DEB'), succeeded())
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
path: '$(System.ArtifactsDirectory)/pwshLinuxBuildMinSize-meta'
|
||||
artifactName: pwshLinuxBuildMinSize-meta
|
||||
|
||||
# requires windows
|
||||
- task: AzureFileCopy@4
|
||||
displayName: 'Upload to Azure - RPM - Unsigned'
|
||||
inputs:
|
||||
SourcePath: '$(System.ArtifactsDirectory)\rpm\release\*'
|
||||
azureSubscription: '$(AzureFileCopySubscription)'
|
||||
Destination: AzureBlob
|
||||
storage: '$(StorageAccount)'
|
||||
ContainerName: '$(AzureVersion)'
|
||||
condition: and(and(succeeded(), ne(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM'))
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
path: '$(System.ArtifactsDirectory)/pwshLinuxBuildArm32'
|
||||
artifactName: pwshLinuxBuildArm32
|
||||
|
||||
# requires windows
|
||||
- task: AzureFileCopy@4
|
||||
displayName: 'Upload to Azure - RPM - Signed'
|
||||
inputs:
|
||||
SourcePath: '$(Build.StagingDirectory)\signedPackages\release\*'
|
||||
azureSubscription: '$(AzureFileCopySubscription)'
|
||||
Destination: AzureBlob
|
||||
storage: '$(StorageAccount)'
|
||||
ContainerName: '$(AzureVersion)'
|
||||
condition: and(and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM'))
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
path: '$(System.ArtifactsDirectory)/pwshLinuxBuildArm32-meta'
|
||||
artifactName: pwshLinuxBuildArm32-meta
|
||||
|
||||
- template: upload-final-results.yml
|
||||
parameters:
|
||||
artifactPath: $(System.ArtifactsDirectory)\rpm\release
|
||||
condition: and(and(succeeded(), ne(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM'))
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
path: '$(System.ArtifactsDirectory)/pwshLinuxBuildArm64'
|
||||
artifactName: pwshLinuxBuildArm64
|
||||
|
||||
- template: upload-final-results.yml
|
||||
parameters:
|
||||
artifactPath: '$(Build.StagingDirectory)\signedPackages\release'
|
||||
condition: and(and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM'))
|
||||
- ${{ if eq(variables.build,'deb') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
path: '$(System.ArtifactsDirectory)/pwshLinuxBuildArm64-meta'
|
||||
artifactName: pwshLinuxBuildArm64-meta
|
||||
|
||||
- template: /tools/releaseBuild/azureDevOps/templates/step/finalize.yml
|
||||
- ${{ if eq(variables.build,'rpm') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
path: '$(System.ArtifactsDirectory)/pwshMarinerBuildAmd64'
|
||||
artifactName: pwshMarinerBuildAmd64
|
||||
|
||||
- ${{ if eq(variables.build,'rpm') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
path: '$(System.ArtifactsDirectory)/pwshMarinerBuildAmd64-meta'
|
||||
artifactName: pwshMarinerBuildAmd64-meta
|
||||
|
||||
- ${{ if eq(variables.build,'alpine') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
path: '$(System.ArtifactsDirectory)/pwshLinuxBuild'
|
||||
artifactName: pwshLinuxBuildAlpine
|
||||
|
||||
- ${{ if eq(variables.build,'alpine') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
path: '$(System.ArtifactsDirectory)/pwshLinuxBuild-meta'
|
||||
artifactName: pwshLinuxBuildAlpine-meta
|
||||
|
||||
- ${{ if eq(variables.build,'fxdependent') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
path: '$(System.ArtifactsDirectory)/pwshLinuxBuild'
|
||||
artifactName: pwshLinuxBuildFxdependent
|
||||
|
||||
- ${{ if eq(variables.build,'fxdependent') }} :
|
||||
- task: PublishPipelineArtifact@1
|
||||
inputs:
|
||||
path: '$(System.ArtifactsDirectory)/pwshLinuxBuild-meta'
|
||||
artifactName: pwshLinuxBuildFxdependent-meta
|
||||
|
||||
@@ -0,0 +1,171 @@
|
||||
parameters:
|
||||
binLocation: ''
|
||||
buildPrefixName: ''
|
||||
addWindowsModules: 'false'
|
||||
|
||||
steps:
|
||||
- pwsh: |
|
||||
$fullSymbolsFolder = Join-Path $(System.ArtifactsDirectory) "${{ parameters.binLocation }}"
|
||||
|
||||
Write-Verbose -Verbose "fullSymbolsFolder == $fullSymbolsFolder"
|
||||
|
||||
Get-ChildItem -Recurse $fullSymbolsFolder | out-string | Write-Verbose -Verbose
|
||||
|
||||
$filesToSignDirectory = "$(System.ArtifactsDirectory)\toBeSigned"
|
||||
|
||||
if ((Test-Path -Path $filesToSignDirectory)) {
|
||||
Remove-Item -Path $filesToSignDirectory -Recurse -Force
|
||||
}
|
||||
|
||||
$null = New-Item -ItemType Directory -Path $filesToSignDirectory -Force
|
||||
|
||||
$signedFilesDirectory = "$(System.ArtifactsDirectory)\signed"
|
||||
|
||||
if ((Test-Path -Path $signedFilesDirectory)) {
|
||||
Remove-Item -Path $signedFilesDirectory -Recurse -Force
|
||||
}
|
||||
|
||||
$null = New-Item -ItemType Directory -Path $signedFilesDirectory -Force
|
||||
|
||||
$itemsToCopyWithRecurse = @(
|
||||
"$($fullSymbolsFolder)\*.ps1"
|
||||
"$($fullSymbolsFolder)\Microsoft.PowerShell*.dll"
|
||||
)
|
||||
|
||||
$itemsToCopy = @{
|
||||
"$($fullSymbolsFolder)\*.ps1" = ""
|
||||
"$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Host\Microsoft.PowerShell.Host.psd1" = "Modules\Microsoft.PowerShell.Host"
|
||||
"$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1" = "Modules\Microsoft.PowerShell.Management"
|
||||
"$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1" = "Modules\Microsoft.PowerShell.Security"
|
||||
"$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1" = "Modules\Microsoft.PowerShell.Utility"
|
||||
"$($fullSymbolsFolder)\pwsh.dll" = ""
|
||||
"$($fullSymbolsFolder)\System.Management.Automation.dll" = ""
|
||||
}
|
||||
|
||||
## Windows only modules
|
||||
|
||||
if('${{ parameters.addWindowsModules }}' -ne 'false') {
|
||||
$itemsToCopy += @{
|
||||
"$($fullSymbolsFolder)\pwsh.exe" = ""
|
||||
"$($fullSymbolsFolder)\Microsoft.Management.Infrastructure.CimCmdlets.dll" = ""
|
||||
"$($fullSymbolsFolder)\Microsoft.WSMan.*.dll" = ""
|
||||
"$($fullSymbolsFolder)\Modules\CimCmdlets\CimCmdlets.psd1" = "Modules\CimCmdlets"
|
||||
"$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\Diagnostics.format.ps1xml" = "Modules\Microsoft.PowerShell.Diagnostics"
|
||||
"$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\Event.format.ps1xml" = "Modules\Microsoft.PowerShell.Diagnostics"
|
||||
"$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\GetEvent.types.ps1xml" = "Modules\Microsoft.PowerShell.Diagnostics"
|
||||
"$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Security\Security.types.ps1xml" = "Modules\Microsoft.PowerShell.Security"
|
||||
"$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\Microsoft.PowerShell.Diagnostics.psd1" = "Modules\Microsoft.PowerShell.Diagnostics"
|
||||
"$($fullSymbolsFolder)\Modules\Microsoft.WSMan.Management\Microsoft.WSMan.Management.psd1" = "Modules\Microsoft.WSMan.Management"
|
||||
"$($fullSymbolsFolder)\Modules\Microsoft.WSMan.Management\WSMan.format.ps1xml" = "Modules\Microsoft.WSMan.Management"
|
||||
"$($fullSymbolsFolder)\Modules\PSDiagnostics\PSDiagnostics.ps?1" = "Modules\PSDiagnostics"
|
||||
}
|
||||
}
|
||||
else {
|
||||
$itemsToCopy += @{
|
||||
"$($fullSymbolsFolder)\pwsh" = ""
|
||||
}
|
||||
}
|
||||
|
||||
$itemsToExclude = @(
|
||||
# This package is retrieved from https://www.github.com/powershell/MarkdownRender
|
||||
"$($fullSymbolsFolder)\Microsoft.PowerShell.MarkdownRender.dll"
|
||||
)
|
||||
|
||||
Write-Verbose -verbose "recusively copying $($itemsToCopyWithRecurse | out-string) to $filesToSignDirectory"
|
||||
Copy-Item -Path $itemsToCopyWithRecurse -Destination $filesToSignDirectory -Recurse -verbose -exclude $itemsToExclude
|
||||
|
||||
foreach($pattern in $itemsToCopy.Keys) {
|
||||
$destinationFolder = Join-Path $filesToSignDirectory -ChildPath $itemsToCopy.$pattern
|
||||
$null = New-Item -ItemType Directory -Path $destinationFolder -Force
|
||||
Write-Verbose -verbose "copying $pattern to $destinationFolder"
|
||||
Copy-Item -Path $pattern -Destination $destinationFolder -Recurse -verbose
|
||||
}
|
||||
displayName: '${{ parameters.buildPrefixName }} - Prepare files to be signed'
|
||||
|
||||
- template: EsrpSign.yml@ComplianceRepo
|
||||
parameters:
|
||||
buildOutputPath: $(System.ArtifactsDirectory)\toBeSigned
|
||||
signOutputPath: $(System.ArtifactsDirectory)\signed
|
||||
certificateId: "$(AUTHENTICODE_CERT)"
|
||||
pattern: |
|
||||
**\*.dll
|
||||
**\*.psd1
|
||||
**\*.psm1
|
||||
**\*.ps1xml
|
||||
**\*.ps1
|
||||
**\*.exe
|
||||
useMinimatch: true
|
||||
shouldSign: $(SHOULD_SIGN)
|
||||
displayName: ${{ parameters.buildPrefixName }} - Authenticode
|
||||
|
||||
- pwsh: |
|
||||
Import-Module $(PowerShellRoot)/build.psm1 -Force
|
||||
Import-Module $(PowerShellRoot)/tools/packaging -Force
|
||||
$signedFilesPath = '$(System.ArtifactsDirectory)\signed\'
|
||||
$BuildPath = Join-Path $(System.ArtifactsDirectory) '${{ parameters.binLocation }}'
|
||||
Write-Verbose -Verbose -Message "BuildPath: $BuildPath"
|
||||
|
||||
Update-PSSignedBuildFolder -BuildPath $BuildPath -SignedFilesPath $SignedFilesPath
|
||||
$dlls = Get-ChildItem $BuildPath\*.dll, $BuildPath\*.exe -Recurse
|
||||
$signatures = $dlls | Get-AuthenticodeSignature
|
||||
$missingSignatures = $signatures | Where-Object { $_.status -eq 'notsigned' -or $_.SignerCertificate.Issuer -notmatch '^CN=Microsoft.*'}| select-object -ExpandProperty Path
|
||||
|
||||
Write-Verbose -verbose "to be signed:`r`n $($missingSignatures | Out-String)"
|
||||
|
||||
$filesToSignDirectory = "$(System.ArtifactsDirectory)\thirdPartyToBeSigned"
|
||||
$null = New-Item -ItemType Directory -Path $filesToSignDirectory -Force -Verbose
|
||||
|
||||
$signedFilesDirectory = "$(System.ArtifactsDirectory)\thirdPartySigned"
|
||||
$null = New-Item -ItemType Directory -Path $signedFilesDirectory -Force -Verbose
|
||||
|
||||
$missingSignatures | ForEach-Object {
|
||||
$pathWithoutLeaf = Split-Path $_
|
||||
$relativePath = $pathWithoutLeaf.replace($BuildPath,'')
|
||||
Write-Verbose -Verbose -Message "relativePath: $relativePath"
|
||||
$targetDirectory = Join-Path -Path $filesToSignDirectory -ChildPath $relativePath
|
||||
Write-Verbose -Verbose -Message "targetDirectory: $targetDirectory"
|
||||
if(!(Test-Path $targetDirectory))
|
||||
{
|
||||
$null = New-Item -ItemType Directory -Path $targetDirectory -Force -Verbose
|
||||
}
|
||||
Copy-Item -Path $_ -Destination $targetDirectory
|
||||
}
|
||||
|
||||
displayName: ${{ parameters.buildPrefixName }} - Create ThirdParty Signing Folder
|
||||
condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true'))
|
||||
|
||||
- template: EsrpSign.yml@ComplianceRepo
|
||||
parameters:
|
||||
buildOutputPath: $(System.ArtifactsDirectory)\thirdPartyToBeSigned
|
||||
signOutputPath: $(System.ArtifactsDirectory)\thirdPartySigned
|
||||
certificateId: "CP-231522"
|
||||
pattern: |
|
||||
**\*.dll
|
||||
useMinimatch: true
|
||||
shouldSign: $(SHOULD_SIGN)
|
||||
displayName: Sign ThirdParty binaries
|
||||
|
||||
- pwsh: |
|
||||
Get-ChildItem '$(System.ArtifactsDirectory)\thirdPartySigned\*'
|
||||
displayName: ${{ parameters.buildPrefixName }} - Capture ThirdParty Signed files
|
||||
condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true'))
|
||||
|
||||
- pwsh: |
|
||||
Import-Module $(PowerShellRoot)/build.psm1 -Force
|
||||
Import-Module $(PowerShellRoot)/tools/packaging -Force
|
||||
$signedFilesPath = '$(System.ArtifactsDirectory)\thirdPartySigned'
|
||||
$BuildPath = Join-Path $(System.ArtifactsDirectory) '${{ parameters.binLocation }}'
|
||||
|
||||
Update-PSSignedBuildFolder -BuildPath $BuildPath -SignedFilesPath $SignedFilesPath
|
||||
if ($env:BuildConfiguration -eq 'minSize') {
|
||||
## Remove XML files when making a min-size package.
|
||||
Remove-Item "$BuildPath/*.xml" -Force
|
||||
}
|
||||
displayName: ${{ parameters.buildPrefixName }} - Merge ThirdParty signed files with Build
|
||||
condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true'))
|
||||
|
||||
- pwsh: |
|
||||
$uploadFolder = '$(System.ArtifactsDirectory)/${{ parameters.binLocation }}'
|
||||
$containerName = '${{ parameters.binLocation }}-signed'
|
||||
Write-Host "##vso[artifact.upload containerfolder=$containerName;artifactname=$containerName]$uploadFolder"
|
||||
displayName: ${{ parameters.buildPrefixName }} - Upload signed files to artifacts
|
||||
Reference in New Issue
Block a user