[release/v7.3.1] Apply expected file permissions to linux files after authenticode signing (#18647)

* Upload linux artifacts as tar.gz to preserve linux file permissions

* Fix conditions

* Fix yaml

* Fix paths for downloaded artifacts

* Rename while downloading

* Fix file names and paths

* Fix tar compress

* Add set-location before tar

* Create dirs before expanding

* Create dir before expanding

* Fix conditions

* Add logging

* Export file permission to json

* Fix for condition

* Apply file permissions before packaging

* Add logging

* Fix issues

* Add comments

Co-authored-by: Aditya Patwardhan <adityap@microsoft.com>

tools/packaging/packaging.psm1

@@ -669,7 +669,7 @@ function New-TarballPackage {
 
             try {
                 Push-Location -Path $Staging
-                tar $options $packagePath .
+                tar $options $packagePath *
             } finally {
                 Pop-Location
             }
@@ -4480,15 +4480,21 @@ function Invoke-AzDevOpsLinuxPackageCreation {
 
         switch ($BuildType) {
             'fxdependent' {
+                $filePermissionFile = "${env:SYSTEM_ARTIFACTSDIRECTORY}\${mainLinuxBuildFolder}-meta\linuxFilePermission.json"
+                Set-LinuxFilePermission -FilePath $filePermissionFile -RootPath "${env:SYSTEM_ARTIFACTSDIRECTORY}\${mainLinuxBuildFolder}"
                 Start-PSPackage -Type 'fxdependent' @releaseTagParam -LTS:$LTS
             }
             'alpine' {
+                $filePermissionFile = "${env:SYSTEM_ARTIFACTSDIRECTORY}\${mainLinuxBuildFolder}-meta\linuxFilePermission.json"
+                Set-LinuxFilePermission -FilePath $filePermissionFile -RootPath "${env:SYSTEM_ARTIFACTSDIRECTORY}\${mainLinuxBuildFolder}"
                 Start-PSPackage -Type 'tar-alpine' @releaseTagParam -LTS:$LTS
             }
             'rpm' {
                 Start-PSPackage -Type 'rpm' @releaseTagParam -LTS:$LTS
             }
             default {
+                $filePermissionFile = "${env:SYSTEM_ARTIFACTSDIRECTORY}\${mainLinuxBuildFolder}-meta\linuxFilePermission.json"
+                Set-LinuxFilePermission -FilePath $filePermissionFile -RootPath "${env:SYSTEM_ARTIFACTSDIRECTORY}\${mainLinuxBuildFolder}"
                 Start-PSPackage @releaseTagParam -LTS:$LTS -Type 'deb', 'tar'
             }
         }
@@ -4498,6 +4504,9 @@ function Invoke-AzDevOpsLinuxPackageCreation {
 
             Restore-PSOptions -PSOptionsPath "${env:SYSTEM_ARTIFACTSDIRECTORY}\${minSizeLinuxBuildFolder}-meta\psoptions.json"
 
+            $filePermissionFile = "${env:SYSTEM_ARTIFACTSDIRECTORY}\${minSizeLinuxBuildFolder}-meta\linuxFilePermission.json"
+            Set-LinuxFilePermission -FilePath $filePermissionFile -RootPath "${env:SYSTEM_ARTIFACTSDIRECTORY}\${minSizeLinuxBuildFolder}"
+
             Write-Verbose -Verbose "---- Min-Size ----"
             Write-Verbose -Verbose "options.Output: $($options.Output)"
             Write-Verbose -Verbose "options.Top $($options.Top)"
@@ -4507,14 +4516,20 @@ function Invoke-AzDevOpsLinuxPackageCreation {
             ## Create 'linux-arm' 'tar.gz' package.
             ## Note that 'linux-arm' can only be built on Ubuntu environment.
             Restore-PSOptions -PSOptionsPath "${env:SYSTEM_ARTIFACTSDIRECTORY}\${arm32LinuxBuildFolder}-meta\psoptions.json"
+            $filePermissionFile = "${env:SYSTEM_ARTIFACTSDIRECTORY}\${arm32LinuxBuildFolder}-meta\linuxFilePermission.json"
+            Set-LinuxFilePermission -FilePath $filePermissionFile -RootPath "${env:SYSTEM_ARTIFACTSDIRECTORY}\${arm32LinuxBuildFolder}"
             Start-PSPackage -Type tar-arm @releaseTagParam -LTS:$LTS
 
             ## Create 'linux-arm64' 'tar.gz' package.
             ## Note that 'linux-arm64' can only be built on Ubuntu environment.
             Restore-PSOptions -PSOptionsPath "${env:SYSTEM_ARTIFACTSDIRECTORY}\${arm64LinuxBuildFolder}-meta\psoptions.json"
+            $filePermissionFile = "${env:SYSTEM_ARTIFACTSDIRECTORY}\${arm64LinuxBuildFolder}-meta\linuxFilePermission.json"
+            Set-LinuxFilePermission -FilePath $filePermissionFile -RootPath "${env:SYSTEM_ARTIFACTSDIRECTORY}\${arm64LinuxBuildFolder}"
             Start-PSPackage -Type tar-arm64 @releaseTagParam -LTS:$LTS
         } elseif ($BuildType -eq 'rpm') {
             Restore-PSOptions -PSOptionsPath "${env:SYSTEM_ARTIFACTSDIRECTORY}\${amd64MarinerBuildFolder}-meta\psoptions.json"
+            $filePermissionFile = "${env:SYSTEM_ARTIFACTSDIRECTORY}\${amd64MarinerBuildFolder}-meta\linuxFilePermission.json"
+            Set-LinuxFilePermission -FilePath $filePermissionFile -RootPath "${env:SYSTEM_ARTIFACTSDIRECTORY}\${amd64MarinerBuildFolder}"
 
             Write-Verbose -Verbose "---- rpm-fxdependent ----"
             Write-Verbose -Verbose "options.Output: $($options.Output)"
@@ -4567,6 +4582,8 @@ function Invoke-AzDevOpsLinuxPackageBuild {
 
         $buildFolder = "${env:SYSTEM_ARTIFACTSDIRECTORY}/${mainLinuxBuildFolder}"
         Start-PSBuild @buildParams @releaseTagParam -Output $buildFolder -PSOptionsPath "${buildFolder}-meta/psoptions.json"
+        Get-ChildItem -Path $buildFolder -Recurse -File | Export-LinuxFilePermission -FilePath "${buildFolder}-meta/linuxFilePermission.json" -RootPath ${buildFolder} -Force
+
         # Remove symbol files.
         Remove-Item "${buildFolder}\*.pdb" -Force
 
@@ -4587,6 +4604,7 @@ function Invoke-AzDevOpsLinuxPackageBuild {
             Start-PSBuild -Clean @buildParams @releaseTagParam -Output $buildFolder -PSOptionsPath "${buildFolder}-meta/psoptions.json"
             # Remove symbol files, xml document files.
             Remove-Item "${buildFolder}\*.pdb", "${buildFolder}\*.xml" -Force
+            Get-ChildItem -Path $buildFolder -Recurse -File | Export-LinuxFilePermission -FilePath "${buildFolder}-meta/linuxFilePermission.json" -RootPath ${buildFolder} -Force
 
             ## Build 'linux-arm' and create 'tar.gz' package for it.
             ## Note that 'linux-arm' can only be built on Ubuntu environment.
@@ -4594,11 +4612,13 @@ function Invoke-AzDevOpsLinuxPackageBuild {
             Start-PSBuild -Configuration Release -Restore -Runtime linux-arm -PSModuleRestore @releaseTagParam -Output $buildFolder -PSOptionsPath "${buildFolder}-meta/psoptions.json"
             # Remove symbol files.
             Remove-Item "${buildFolder}\*.pdb" -Force
+            Get-ChildItem -Path $buildFolder -Recurse -File | Export-LinuxFilePermission -FilePath "${buildFolder}-meta/linuxFilePermission.json" -RootPath ${buildFolder} -Force
 
             $buildFolder = "${env:SYSTEM_ARTIFACTSDIRECTORY}/${arm64LinuxBuildFolder}"
             Start-PSBuild -Configuration Release -Restore -Runtime linux-arm64 -PSModuleRestore @releaseTagParam -Output $buildFolder -PSOptionsPath "${buildFolder}-meta/psoptions.json"
             # Remove symbol files.
             Remove-Item "${buildFolder}\*.pdb" -Force
+            Get-ChildItem -Path $buildFolder -Recurse -File | Export-LinuxFilePermission -FilePath "${buildFolder}-meta/linuxFilePermission.json" -RootPath ${buildFolder} -Force
         } elseif ($BuildType -eq 'rpm') {
             ## Build for Mariner
             $options = Get-PSOptions
@@ -4616,6 +4636,7 @@ function Invoke-AzDevOpsLinuxPackageBuild {
             Start-PSBuild -Clean @buildParams @releaseTagParam -Output $buildFolder -PSOptionsPath "${buildFolder}-meta/psoptions.json"
             # Remove symbol files, xml document files.
             Remove-Item "${buildFolder}\*.pdb", "${buildFolder}\*.xml" -Force
+            Get-ChildItem -Path $buildFolder -Recurse -File | Export-LinuxFilePermission -FilePath "${buildFolder}-meta/linuxFilePermission.json" -RootPath ${buildFolder} -Force
         }
     }
     catch {
@@ -4624,6 +4645,110 @@ function Invoke-AzDevOpsLinuxPackageBuild {
     }
 }
 
+<#
+    Apply the file permissions specified in the json file $FilePath to the files under $RootPath.
+    The format of the json file is like:
+
+    {
+        "System.Net.WebClient.dll": "744",
+        "Schemas/PSMaml/developer.xsd": "644",
+        "ref/System.Security.AccessControl.dll": "744",
+        "ref/System.IO.dll": "744",
+        "cs/Microsoft.CodeAnalysis.resources.dll": "744",
+        "Schemas/PSMaml/base.xsd": "644",
+        "Schemas/PSMaml/structureProcedure.xsd": "644",
+        "ref/System.Net.Security.dll": "744"
+    }
+#>
+function Set-LinuxFilePermission {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory)] [string] $FilePath,
+        [Parameter(Mandatory)] [string] $RootPath
+    )
+
+    if (-not (Test-Path $FilePath)) {
+        throw "File does not exist: $FilePath"
+    }
+
+    if (-not (Test-Path $RootPath)) {
+        throw "File does not exist: $RootPath"
+    }
+
+    try {
+        Push-Location $RootPath
+        $filePermission = Get-Content $FilePath -Raw | ConvertFrom-Json -AsHashtable
+
+        Write-Verbose -Verbose -Message "Got file permission: $($filePermission.Count) for $FilePath"
+
+        $filePermission.GetEnumerator() | ForEach-Object {
+            $file = $_.Name
+            $permission = $_.Value
+            $fileFullName = Join-Path -Path $RootPath -ChildPath $file
+            Write-Verbose "Set permission $permission to $fileFullName" -Verbose
+            chmod $permission $fileFullName
+        }
+    }
+    finally {
+        Pop-Location
+    }
+}
+
+<#
+    Store the linux file permissions for all the files under root path $RootPath to the json file $FilePath.
+    The json file stores them as relative paths to the root.
+
+    The format of the json file is like:
+
+    {
+        "System.Net.WebClient.dll": "744",
+        "Schemas/PSMaml/developer.xsd": "644",
+        "ref/System.Security.AccessControl.dll": "744",
+        "ref/System.IO.dll": "744",
+        "cs/Microsoft.CodeAnalysis.resources.dll": "744",
+        "Schemas/PSMaml/base.xsd": "644",
+        "Schemas/PSMaml/structureProcedure.xsd": "644",
+        "ref/System.Net.Security.dll": "744"
+    }
+
+#>
+function Export-LinuxFilePermission {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory)] [string] $FilePath,
+        [Parameter(Mandatory)] [string] $RootPath,
+        [Parameter(Mandatory, ValueFromPipeline = $true)] [System.IO.FileInfo[]] $InputObject,
+        [Parameter()] [switch] $Force
+    )
+
+    begin {
+        if (Test-Path $FilePath) {
+          if (-not $Force) {
+            throw "File '$FilePath' already exists."
+          }
+          else {
+            Remove-Item $FilePath -Force
+          }
+        }
+
+        $fileData = @{}
+    }
+
+    process {
+        foreach ($object in $InputObject) {
+            Write-Verbose "Processing $($object.FullName)"
+            # This gets the unix stat information for the file in the format that chmod expects, like '644'.
+            $filePerms = [convert]::ToString($object.unixstat.mode, 8).substring(3)
+            $relativePath = [System.IO.Path]::GetRelativePath($RootPath, $_.FullName)
+            $fileData.Add($relativePath, $filePerms)
+        }
+    }
+
+    end {
+        $fileData | ConvertTo-Json -Depth 10 | Out-File -FilePath $FilePath
+    }
+}
+
 enum PackageManifestResultStatus {
     Mismatch
     Match

tools/releaseBuild/azureDevOps/templates/linux-authenticode-sign.yml

@@ -20,46 +20,82 @@ jobs:
 
   - task: DownloadPipelineArtifact@2
     inputs:
-      artifact: pwshLinuxBuild
-      path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuild
+      artifact: pwshLinuxBuild.tar.gz
+      path: $(Build.ArtifactStagingDirectory)/linuxTars
     displayName: Download deb build
 
   - task: DownloadPipelineArtifact@2
     inputs:
-      artifact: pwshLinuxBuildMinSize
-      path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize
+      artifact: pwshLinuxBuildMinSize.tar.gz
+      path: $(Build.ArtifactStagingDirectory)/linuxTars
     displayName: Download min-size build
 
   - task: DownloadPipelineArtifact@2
     inputs:
-      artifact: pwshLinuxBuildArm32
-      path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32
+      artifact: pwshLinuxBuildArm32.tar.gz
+      path: $(Build.ArtifactStagingDirectory)/linuxTars
     displayName: Download arm32 build
 
   - task: DownloadPipelineArtifact@2
     inputs:
-      artifact: pwshLinuxBuildArm64
-      path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64
+      artifact: pwshLinuxBuildArm64.tar.gz
+      path: $(Build.ArtifactStagingDirectory)/linuxTars
     displayName: Download arm64 build
 
   - task: DownloadPipelineArtifact@2
     inputs:
-      artifact: pwshMarinerBuildAmd64
-      path: $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64
+      artifact: pwshMarinerBuildAmd64.tar.gz
+      path: $(Build.ArtifactStagingDirectory)/linuxTars
     displayName: Download mariner build
 
   - task: DownloadPipelineArtifact@2
     inputs:
-      artifact: pwshLinuxBuildAlpine
-      path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildAlpine
+      artifact: pwshLinuxBuildAlpine.tar.gz
+      path: $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuildAlpine.tar.gz
     displayName: Download alpine build
 
   - task: DownloadPipelineArtifact@2
     inputs:
-      artifact: pwshLinuxBuildFxdependent
-      path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildFxdependent
+      artifact: pwshLinuxBuildFxdependent.tar.gz
+      path: $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuildFxdependent.tar.gz
     displayName: Download fxdependent build
 
+  - pwsh: |
+      Get-ChildItem -Path $(Build.ArtifactStagingDirectory)/linuxTars
+    displayName: Capture downloaded tars
+
+  - pwsh: |
+      Write-Verbose -Verbose -Message "Expanding $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuild.tar.gz to $(Build.ArtifactStagingDirectory)/pwshLinuxBuild"
+      New-Item -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuild -ItemType Directory
+      tar -xf $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuild.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshLinuxBuild
+      Write-Verbose -Verbose "File permisions after expanding"
+      Get-ChildItem -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuild/pwsh | Select-Object -Property 'unixmode', 'size', 'name'
+
+      Write-Verbose -Verbose -Message "Expanding $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuildMinSize.tar.gz to $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize"
+      New-Item -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize -ItemType Directory
+      tar -xf $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuildMinSize.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize
+
+      Write-Verbose -Verbose -Message "Expanding $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuildArm32.tar.gz to $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32"
+      New-Item -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32 -ItemType Directory
+      tar -xf $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuildArm32.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32
+
+      Write-Verbose -Verbose -Message "Expanding $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuildArm64.tar.gz to $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64"
+      New-Item -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64 -ItemType Directory
+      tar -xf $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuildArm64.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64
+
+      Write-Verbose -Verbose -Message "Expanding $(Build.ArtifactStagingDirectory)/linuxTars/pwshMarinerBuildAmd64.tar.gz to $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64"
+      New-Item -Path $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64 -ItemType Directory
+      tar -xf $(Build.ArtifactStagingDirectory)/linuxTars/pwshMarinerBuildAmd64.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64
+
+      Write-Verbose -Verbose -Message "Expanding $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuildAlpine.tar.gz/pwshLinuxBuild.tar.gz to $(Build.ArtifactStagingDirectory)/pwshLinuxBuildAlpine"
+      New-Item -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuildAlpine -ItemType Directory
+      tar -xf $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuildAlpine.tar.gz/pwshLinuxBuild.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshLinuxBuildAlpine
+
+      Write-Verbose -Verbose -Message "Expanding $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuildFxdependent.tar.gz/pwshLinuxBuild.tar.gz to $(Build.ArtifactStagingDirectory)/pwshLinuxBuildFxdependent"
+      New-Item -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuildFxdependent -ItemType Directory
+      tar -xf $(Build.ArtifactStagingDirectory)/linuxTars/pwshLinuxBuildFxdependent.tar.gz/pwshLinuxBuild.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshLinuxBuildFxdependent
+    displayName: Expand builds
+
   - template: SetVersionVariables.yml
     parameters:
       ReleaseTagVar: $(ReleaseTagVar)
@@ -116,12 +152,3 @@ jobs:
     parameters:
       binLocation: pwshLinuxBuildFxdependent
       buildPrefixName: 'PowerShell Linux Framework Dependent'
-
-  #- template: Sbom.yml@ComplianceRepo
-  #  parameters:
-  #    BuildDropPath: '$(System.ArtifactsDirectory)/$(BIN_LOCATION)'
-  #    Build_Repository_Uri: $(Github_Build_Repository_Uri)
-  #    displayName: ${{ parameters.buildName }} SBOM
-  #    PackageName: $(PACKAGE_NAME)
-  #    PackageVersion: $(Version)
-  #    sourceScanPath: '$(PowerShellRoot)/tools'

tools/releaseBuild/azureDevOps/templates/linux-packaging.yml

@@ -26,50 +26,57 @@ jobs:
   - ${{ if or(eq(variables.build,'deb'), eq(variables.build,'rpm')) }} :
     - task: DownloadPipelineArtifact@2
       inputs:
-        artifact: pwshLinuxBuild-signed
-        path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuild
+        artifact: authenticode-signed
+        path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuild-signed
+        pattern: '**/pwshLinuxBuild.tar.gz'
       displayName: Download deb build
 
   - ${{ if eq(variables.build,'deb') }} :
     - task: DownloadPipelineArtifact@2
       inputs:
-        artifact: pwshLinuxBuildMinSize-signed
-        path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize
+        artifact: authenticode-signed
+        path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize-signed
+        pattern: '**/pwshLinuxBuildMinSize.tar.gz'
       displayName: Download min-size build
 
   - ${{ if eq(variables.build,'deb') }} :
     - task: DownloadPipelineArtifact@2
       inputs:
-        artifact: pwshLinuxBuildArm32-signed
-        path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32
+        artifact: authenticode-signed
+        path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32-signed
+        pattern: '**/pwshLinuxBuildArm32.tar.gz'
       displayName: Download arm32 build
 
   - ${{ if eq(variables.build,'deb') }} :
     - task: DownloadPipelineArtifact@2
       inputs:
-        artifact: pwshLinuxBuildArm64-signed
-        path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64
+        artifact: authenticode-signed
+        path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64-signed
+        pattern: '**/pwshLinuxBuildArm64.tar.gz'
       displayName: Download arm64 build
 
   - ${{ if eq(variables.build,'rpm') }} :
     - task: DownloadPipelineArtifact@2
       inputs:
-        artifact: pwshMarinerBuildAmd64-signed
-        path: $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64
+        artifact: authenticode-signed
+        path: $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64-signed
+        pattern: '**/pwshMarinerBuildAmd64.tar.gz'
       displayName: Download mariner build
 
   - ${{ if eq(variables.build,'alpine') }} :
     - task: DownloadPipelineArtifact@2
       inputs:
-        artifact: pwshLinuxBuildAlpine-signed
-        path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuild
+        artifact: authenticode-signed
+        path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildAlpine-signed
+        pattern: '**/pwshLinuxBuildAlpine.tar.gz'
       displayName: Download alpine build
 
   - ${{ if eq(variables.build,'fxdependent') }} :
     - task: DownloadPipelineArtifact@2
       inputs:
-        artifact: pwshLinuxBuildFxdependent-signed
-        path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuild
+        artifact: authenticode-signed
+        path: $(Build.ArtifactStagingDirectory)/pwshLinuxBuildFxdependent-signed
+        pattern: '**/pwshLinuxBuildFxdependent.tar.gz'
       displayName: Download fxdependent build
 
   - ${{ if or(eq(variables.build,'deb'), eq(variables.build,'rpm')) }} :
@@ -125,6 +132,50 @@ jobs:
       Get-ChildItem '$(Build.ArtifactStagingDirectory)' | Select-Object -Property 'unixmode', 'size', 'name'
     displayName: Capture downloads
 
+  - pwsh: |
+      if ('$(build)' -eq 'deb' -or '$(build)' -eq 'rpm') {
+        Write-Verbose -Verbose "Expanding $(Build.ArtifactStagingDirectory)/pwshLinuxBuild-signed/pwshLinuxBuild.tar.gz to $(Build.ArtifactStagingDirectory)/pwshLinuxBuild"
+        New-Item -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuild -ItemType Directory
+        tar -xf $(Build.ArtifactStagingDirectory)/pwshLinuxBuild-signed/pwshLinuxBuild.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshLinuxBuild
+      }
+
+      if ('$(build)' -eq 'deb') {
+        Write-Verbose -Verbose "Expanding $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize-signed/pwshLinuxBuildMinSize.tar.gz to $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize"
+        New-Item -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize -ItemType Directory
+        tar -xf $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize-signed/pwshLinuxBuildMinSize.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshLinuxBuildMinSize
+
+        Write-Verbose -Verbose "Expanding $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32-signed/pwshLinuxBuildArm32.tar.gz to $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32"
+        New-Item -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32 -ItemType Directory
+        tar -xf  $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32-signed/pwshLinuxBuildArm32.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm32
+
+        Write-Verbose -Verbose "Expanding $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64-signed/pwshLinuxBuildArm64.tar.gz to $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64"
+        New-Item -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64 -ItemType Directory
+        tar -xf  $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64-signed/pwshLinuxBuildArm64.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshLinuxBuildArm64
+      }
+
+      if ('$(build)' -eq 'rpm') {
+        Write-Verbose -Verbose "Expanding $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64-signed/pwshMarinerBuildAmd64.tar.gz to $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64"
+        New-Item -Path $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64 -ItemType Directory
+        tar -xf $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64-signed/pwshMarinerBuildAmd64.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshMarinerBuildAmd64
+      }
+
+      if ('$(build)' -eq 'alpine') {
+        Write-Verbose -Verbose "Expanding $(Build.ArtifactStagingDirectory)/pwshLinuxBuildAlpine-signed/pwshLinuxBuildAlpine.tar.gz to $(Build.ArtifactStagingDirectory)/pwshLinuxBuild"
+        New-Item -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuild -ItemType Directory
+        tar -xf $(Build.ArtifactStagingDirectory)/pwshLinuxBuildAlpine-signed/pwshLinuxBuildAlpine.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshLinuxBuild
+      }
+
+      if ('$(build)' -eq 'fxdependent') {
+        Write-Verbose -Verbose "Expanding $(Build.ArtifactStagingDirectory)/pwshLinuxBuildFxdependent-signed/pwshLinuxBuildFxdependent.tar.gz to $(Build.ArtifactStagingDirectory)/pwshLinuxBuild"
+        New-Item -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuild -ItemType Directory
+        tar -xf $(Build.ArtifactStagingDirectory)/pwshLinuxBuildFxdependent-signed/pwshLinuxBuildFxdependent.tar.gz -C $(Build.ArtifactStagingDirectory)/pwshLinuxBuild
+      }
+    displayName: Expand all signed tar.gz
+
+  - pwsh: |
+      Get-ChildItem '$(Build.ArtifactStagingDirectory)' | Select-Object -Property 'unixmode', 'size', 'name'
+    displayName: Capture expanded
+
   - checkout: self
     clean: true
 

tools/releaseBuild/azureDevOps/templates/linux.yml

@@ -71,6 +71,10 @@ jobs:
         Import-Module "$env:POWERSHELLROOT/tools/packaging"
 
         Invoke-AzDevOpsLinuxPackageBuild -ReleaseTag '$(ReleaseTagVar)' -BuildType '$(build)'
+
+        Write-Verbose -Verbose "File permisions after building"
+        Get-ChildItem -Path $(System.ArtifactsDirectory)/pwshLinuxBuild/pwsh | Select-Object -Property 'unixmode', 'size', 'name'
+
       } catch {
         Get-Error
         throw
@@ -128,11 +132,34 @@ jobs:
         PackageVersion: $(Version)
         sourceScanPath: '$(PowerShellRoot)/tools'
 
+  - pwsh: |
+      Set-Location '$(System.ArtifactsDirectory)/pwshLinuxBuild'
+      Write-Verbose -Verbose "File permisions before compressing"
+      Get-ChildItem -Path $(Build.ArtifactStagingDirectory)/pwshLinuxBuild/pwsh | Select-Object -Property 'unixmode', 'size', 'name'
+      tar -czvf $(System.ArtifactsDirectory)/pwshLinuxBuild.tar.gz *
+    displayName: Compress pwshLinuxBuild
+
+  - ${{ if eq(variables.build,'deb') }} :
+    - pwsh: |
+        Set-Location '$(System.ArtifactsDirectory)/pwshLinuxBuildMinSize'
+        tar -czvf $(System.ArtifactsDirectory)/pwshLinuxBuildMinSize.tar.gz *
+        Set-Location '$(System.ArtifactsDirectory)/pwshLinuxBuildArm32'
+        tar -czvf $(System.ArtifactsDirectory)/pwshLinuxBuildArm32.tar.gz *
+        Set-Location '$(System.ArtifactsDirectory)/pwshLinuxBuildArm64'
+        tar -czvf $(System.ArtifactsDirectory)/pwshLinuxBuildArm64.tar.gz *
+      displayName: Compress deb
+
+  - ${{ if eq(variables.build,'rpm') }} :
+    - pwsh: |
+        Set-Location '$(System.ArtifactsDirectory)/pwshMarinerBuildAmd64'
+        tar -czvf $(System.ArtifactsDirectory)/pwshMarinerBuildAmd64.tar.gz *
+      displayName: Compress pwshMarinerBuildAmd64
+
   - ${{ if eq(variables.build,'deb') }} :
     - task: PublishPipelineArtifact@1
       inputs:
-        path: '$(System.ArtifactsDirectory)/pwshLinuxBuild'
-        artifactName: pwshLinuxBuild
+        path: '$(System.ArtifactsDirectory)/pwshLinuxBuild.tar.gz'
+        artifactName: pwshLinuxBuild.tar.gz
 
   - ${{ if eq(variables.build,'deb') }} :
     - task: PublishPipelineArtifact@1
@@ -143,8 +170,8 @@ jobs:
   - ${{ if eq(variables.build,'deb') }} :
     - task: PublishPipelineArtifact@1
       inputs:
-        path: '$(System.ArtifactsDirectory)/pwshLinuxBuildMinSize'
-        artifactName: pwshLinuxBuildMinSize
+        path: '$(System.ArtifactsDirectory)/pwshLinuxBuildMinSize.tar.gz'
+        artifactName: pwshLinuxBuildMinSize.tar.gz
 
   - ${{ if eq(variables.build,'deb') }} :
     - task: PublishPipelineArtifact@1
@@ -155,8 +182,8 @@ jobs:
   - ${{ if eq(variables.build,'deb') }} :
     - task: PublishPipelineArtifact@1
       inputs:
-        path: '$(System.ArtifactsDirectory)/pwshLinuxBuildArm32'
-        artifactName: pwshLinuxBuildArm32
+        path: '$(System.ArtifactsDirectory)/pwshLinuxBuildArm32.tar.gz'
+        artifactName: pwshLinuxBuildArm32.tar.gz
 
   - ${{ if eq(variables.build,'deb') }} :
     - task: PublishPipelineArtifact@1
@@ -167,8 +194,8 @@ jobs:
   - ${{ if eq(variables.build,'deb') }} :
     - task: PublishPipelineArtifact@1
       inputs:
-        path: '$(System.ArtifactsDirectory)/pwshLinuxBuildArm64'
-        artifactName: pwshLinuxBuildArm64
+        path: '$(System.ArtifactsDirectory)/pwshLinuxBuildArm64.tar.gz'
+        artifactName: pwshLinuxBuildArm64.tar.gz
 
   - ${{ if eq(variables.build,'deb') }} :
     - task: PublishPipelineArtifact@1
@@ -179,8 +206,8 @@ jobs:
   - ${{ if eq(variables.build,'rpm') }} :
     - task: PublishPipelineArtifact@1
       inputs:
-        path: '$(System.ArtifactsDirectory)/pwshMarinerBuildAmd64'
-        artifactName: pwshMarinerBuildAmd64
+        path: '$(System.ArtifactsDirectory)/pwshMarinerBuildAmd64.tar.gz'
+        artifactName: pwshMarinerBuildAmd64.tar.gz
 
   - ${{ if eq(variables.build,'rpm') }} :
     - task: PublishPipelineArtifact@1
@@ -191,8 +218,8 @@ jobs:
   - ${{ if eq(variables.build,'alpine') }} :
     - task: PublishPipelineArtifact@1
       inputs:
-        path: '$(System.ArtifactsDirectory)/pwshLinuxBuild'
-        artifactName: pwshLinuxBuildAlpine
+        path: '$(System.ArtifactsDirectory)/pwshLinuxBuild.tar.gz'
+        artifactName: pwshLinuxBuildAlpine.tar.gz
 
   - ${{ if eq(variables.build,'alpine') }} :
     - task: PublishPipelineArtifact@1
@@ -203,8 +230,8 @@ jobs:
   - ${{ if eq(variables.build,'fxdependent') }} :
     - task: PublishPipelineArtifact@1
       inputs:
-        path: '$(System.ArtifactsDirectory)/pwshLinuxBuild'
-        artifactName: pwshLinuxBuildFxdependent
+        path: '$(System.ArtifactsDirectory)/pwshLinuxBuild.tar.gz'
+        artifactName: pwshLinuxBuildFxdependent.tar.gz
 
   - ${{ if eq(variables.build,'fxdependent') }} :
     - task: PublishPipelineArtifact@1

tools/releaseBuild/azureDevOps/templates/signBuildFiles.yml

@@ -174,6 +174,14 @@ steps:
 
 - pwsh: |
       $uploadFolder = '$(System.ArtifactsDirectory)/${{ parameters.binLocation }}'
-      $containerName = '${{ parameters.binLocation }}-signed'
-      Write-Host "##vso[artifact.upload containerfolder=$containerName;artifactname=$containerName]$uploadFolder"
+      $containerName = 'authenticode-signed'
+
+      Write-Verbose -Verbose "File permissions after signing"
+      Get-ChildItem $uploadFolder\pwsh | Select-Object -Property 'unixmode', 'size', 'name'
+
+      $uploadTarFilePath = '$(System.ArtifactsDirectory)/${{ parameters.binLocation }}.tar.gz'
+      Write-Verbose -Verbose -Message "Creating tar.gz - $uploadTarFilePath"
+      tar -czvf $uploadTarFilePath -C $uploadFolder *
+
+      Write-Host "##vso[artifact.upload containerfolder=$containerName;artifactname=$containerName]$uploadTarFilePath"
   displayName: ${{ parameters.buildPrefixName }} - Upload signed files to artifacts