Add Windows build to universal release build YAML (#8695)

tools/releaseBuild/Images/GenericLinuxFiles/PowerShellPackage.ps1

@@ -40,10 +40,14 @@ try {
     $buildParams = @{ Configuration = 'Release'; PSModuleRestore = $true}
 
     if($FxDependent.IsPresent) {
+        $projectAssetsZipName = 'linuxFxDependantProjectAssetssymbols.zip'
         $buildParams.Add("Runtime", "fxdependent")
     } elseif ($Alpine.IsPresent) {
+        $projectAssetsZipName = 'linuxAlpineProjectAssetssymbols.zip'
         $buildParams.Add("Runtime", 'alpine-x64')
     } else {
+        # make the artifact name unique
+        $projectAssetsZipName = "linuxProjectAssets-$((get-date).Ticks)-symbols.zip"
         $buildParams.Add("Crossgen", $true)
     }
 
@@ -90,9 +94,11 @@ Write-Verbose "Exporting project.assets files ..." -verbose
 
 $projectAssetsCounter = 1
 $projectAssetsFolder = Join-Path -Path $destination -ChildPath 'projectAssets'
-$projectAssetsZip = Join-Path -Path $destination -ChildPath 'projectAssetssymbols.zip'
+$projectAssetsZip = Join-Path -Path $destination -ChildPath $projectAssetsZipName
 Get-ChildItem $location\project.assets.json -Recurse | ForEach-Object {
-    $itemDestination = Join-Path -Path $projectAssetsFolder -ChildPath $projectAssetsCounter
+    $subfolder = $_.FullName.Replace($location,'')
+    $subfolder.Replace('project.assets.json','')
+    $itemDestination = Join-Path -Path $projectAssetsFolder -ChildPath $subfolder
     New-Item -Path $itemDestination -ItemType Directory -Force
     $file = $_.FullName
     Write-Verbose "Copying $file to $itemDestination" -verbose

tools/releaseBuild/Images/microsoft_powershell_windowsservercore/PowerShellPackage.ps1

@@ -156,10 +156,12 @@ try{
 
         $projectAssetsCounter = 1
         $projectAssetsFolder = Join-Path -Path $destination -ChildPath 'projectAssets'
-        $projectAssetsZip = Join-Path -Path $destination -ChildPath 'projectAssetssymbols.zip'
+        $projectAssetsZip = Join-Path -Path $destination -ChildPath 'windowsProjectAssetssymbols.zip'
         Get-ChildItem $location\project.assets.json -Recurse | ForEach-Object {
-            $itemDestination = Join-Path -Path $projectAssetsFolder -ChildPath $projectAssetsCounter
-            New-Item -Path $itemDestination -ItemType Directory -Force
+            $subfolder = $_.FullName.Replace($location,'')
+            $subfolder.Replace('project.assets.json','')
+            $itemDestination = Join-Path -Path $projectAssetsFolder -ChildPath $subfolder
+                    New-Item -Path $itemDestination -ItemType Directory -Force
             $file = $_.FullName
             Write-Verbose "Copying $file to $itemDestination" -verbose
             Copy-Item -Path $file -Destination "$itemDestination\" -Force

tools/releaseBuild/azureDevOps/releaseBuild.yml

@@ -37,3 +37,37 @@ jobs:
     buildName: alpine
 
 - template: templates/mac.yml
+
+- template: templates/windows-build.yml
+  parameters:
+    Architecture: x64
+
+- template: templates/windows-build.yml
+  parameters:
+    Architecture: x86
+
+- template: templates/windows-build.yml
+  parameters:
+    Architecture: arm
+
+- template: templates/windows-build.yml
+  parameters:
+    Architecture: arm64
+
+- template: templates/windows-build.yml
+  parameters:
+    Architecture: fxdependent
+
+- template: templates/windows-component-governance.yml
+
+- template: templates/windows-package-signing.yml
+  parameters:
+    parentJobs:
+      - build_windows_x64
+      - build_windows_x86
+      - build_windows_arm
+      - build_windows_arm64
+      - build_windows_fxdependent
+
+- template: templates/mac-package-signing.yml
+

tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml

@@ -0,0 +1,101 @@
+jobs:
+- job: MacPackageSigningJob
+  displayName: macOS Package signing
+  dependsOn: build_macOS
+  condition: succeeded()
+  pool:
+    name: Package ES CodeHub Lab E
+  variables:
+    BuildConfiguration: release
+    BuildPlatform: any cpu
+
+  steps:
+
+  - powershell: |
+      tools/releaseBuild/setReleaseTag.ps1 -ReleaseTag $(ReleaseTagVar) -Variable "ReleaseTagVar"
+    displayName: 'Set ReleaseTag Variable'
+
+  - powershell: |
+       $version = '$(ReleaseTagVar)'.Substring(1)
+       $vstsCommandString = "vso[task.setvariable variable=Version]$version"
+       Write-Host "sending " + $vstsCommandString
+       Write-Host "##$vstsCommandString"
+
+       $azureVersion = '$(ReleaseTagVar)'.ToLowerInvariant() -replace '\.', '-'
+       $vstsCommandString = "vso[task.setvariable variable=AzureVersion]$azureVersion"
+       Write-Host "sending " + $vstsCommandString
+       Write-Host "##$vstsCommandString"
+
+    displayName: 'Set Version Variable'
+
+  - task: DownloadBuildArtifacts@0
+    displayName: 'Download artifacts'
+    inputs:
+      downloadType: specific
+      itemPattern: |
+        **/*.tar.gz
+        **/*.pkg
+
+  - powershell: |
+      dir "$(System.ArtifactsDirectory)\*" -Recurse
+    displayName: 'Capture Downloaded Artifacts'
+    # Diagnostics is not critical it passes every time it runs
+    continueOnError: true
+
+  - powershell: |
+      $null = new-item -type directory -path "$(Build.StagingDirectory)\macos"
+      $zipFile = "$(Build.StagingDirectory)\macos\powershell-$(Version)-osx-x64.zip"
+      Compress-Archive -Path "$(System.ArtifactsDirectory)\results\powershell-$(Version)-osx-x64.pkg" -Destination $zipFile
+      Write-Host $zipFile
+    displayName: 'Compress macOS Package'
+
+  - powershell: |
+      tools/releaseBuild/generatePackgeSigning.ps1 -MacDeveloperFiles "$(Build.StagingDirectory)\macos\powershell-$(Version)-osx-x64.zip" -path "$(System.ArtifactsDirectory)\package.xml"
+    displayName: 'Generate macOS Package Signing Xml'
+
+  - powershell: |
+      Get-Content "$(System.ArtifactsDirectory)\package.xml"
+    displayName: 'Capture macOS signing xml'
+    # Diagnostics is not critical it passes every time it runs
+    continueOnError: true
+
+  - task: PkgESCodeSign@10
+    displayName: 'CodeSign $(System.ArtifactsDirectory)\package.xml'
+    inputs:
+      signConfigXml: '$(System.ArtifactsDirectory)\package.xml'
+      outPathRoot: '$(Build.StagingDirectory)\signedMacOSPackages'
+
+  - powershell: |
+      dir "$(System.ArtifactsDirectory)\*.tar.gz" -Recurse | foreach-object {
+         $fullname = $_.fullname
+         Write-Host "##vso[artifact.upload containerfolder=signed;artifactname=signed]$fullname"
+      }
+    displayName: 'Upload tar.gz'
+
+  - powershell: |
+      dir "$(Build.StagingDirectory)\signedMacOSPackages\powershell-*.zip" -Recurse | foreach-object {
+          $fullname = $_.fullname
+          Write-Host "##vso[artifact.upload containerfolder=signed;artifactname=signed]$fullname"
+      }
+    displayName: 'Upload macOS signed package'
+
+  - powershell: |
+      $destination = "$(System.ArtifactsDirectory)\azureMacOs"
+      New-Item -Path $destination -Type Directory
+      $zipPath = dir "$(Build.StagingDirectory)\signedMacOSPackages\powershell-*.zip" -Recurse | select-object -expandproperty fullname
+      Expand-Archive -Path $zipPath -DestinationPath $destination
+      $targzPath = dir "$(System.ArtifactsDirectory)\*.tar.gz" -Recurse | select-object -expandproperty fullname
+      Copy-Item -Path $targzPath -Destination $destination
+    displayName: 'Extract and copy macOS artifacts for upload to azure'
+
+  - task: AzureFileCopy@1
+    displayName: 'AzureBlob File Copy'
+    inputs:
+      SourcePath: '$(System.ArtifactsDirectory)\azureMacOs'
+      azureSubscription: '$(AzureFileCopySubscription)'
+      Destination: AzureBlob
+      storage: '$(StorageAccount)'
+      ContainerName: '$(AzureVersion)'
+
+  - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3
+    displayName: 'Run MpCmdRun.exe'

tools/releaseBuild/azureDevOps/templates/windows-build.yml

@@ -0,0 +1,157 @@
+parameters:
+  BuildConfiguration: release
+  BuildPlatform: any cpu
+  Architecture: x64
+
+jobs:
+- job: build_windows_${{ parameters.Architecture }}
+  displayName: Build Windows - ${{ parameters.Architecture }}
+  condition: succeeded()
+  pool:
+    name: PowerShell
+  variables:
+    BuildConfiguration: ${{ parameters.BuildConfiguration }}
+    BuildPlatform: ${{ parameters.BuildPlatform }}
+    Architecture: ${{ parameters.Architecture }}
+
+  steps:
+
+  - checkout: self
+    clean: true
+    persistCredentials: true
+
+  - task: PkgESSetupBuild@10
+    displayName: 'Initialize build'
+    env:
+      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+    inputs:
+      useDfs: false
+      productName: PowerShellCore
+      branchVersion: true
+      disableWorkspace: true
+      disableBuildTools: true
+      disableNugetPack: true
+    condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual'))
+
+  - powershell: |
+      tools/releaseBuild/setReleaseTag.ps1 -ReleaseTag $(ReleaseTagVar) -Variable "ReleaseTagVar"
+    displayName: 'Set ReleaseTag Variable'
+
+  - powershell: |
+       Write-Verbose -Verbose "$(Architecture)"
+
+       if ('$(Architecture)' -eq 'fxdependent' -and '$(ReleaseTagVar)' -match '6.0.*')
+       {
+           $vstsCommandString = "vso[task.setvariable variable=SkipFxDependent]true"
+       }
+       else
+       {
+           $vstsCommandString = "vso[task.setvariable variable=SkipFxDependent]false"
+       }
+
+       Write-Verbose -Message "$vstsCommandString " -Verbose
+       Write-Host -Object "##$vstsCommandString"
+    displayName: 'Skip FxDependent for PS v6.0.*'
+
+  - powershell: |
+       Import-Module $(Build.SourcesDirectory)/build.psm1 -Force
+       New-NugetConfigFile -NugetFeedUrl $(AzDevOpsFeed) -UserName $(AzDevOpsFeedUserName) -ClearTextPAT $(AzDevOpsFeedPAT) -FeedName AzDevOpsFeed -Destination $(Build.SourcesDirectory)/src/Modules
+
+       if(-not (Test-Path "$(Build.SourcesDirectory)/src/Modules/nuget.config"))
+       {
+           throw "nuget.config is not created"
+       }
+    displayName: 'Add nuget.config for AzDevOps feed for PSGallery modules '
+    condition: ne(Variables['SkipFxDependent'], 'true')
+
+  - powershell: |
+       $version = '$(ReleaseTagVar)'.Substring(1)
+       $vstsCommandString = "vso[task.setvariable variable=Version]$version"
+       Write-Host "sending " + $vstsCommandString
+       Write-Host "##$vstsCommandString"
+    displayName: 'Set Version Varibale'
+    condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true'))
+
+  - powershell: |
+       docker container prune --force
+       docker container ls --all --format '{{ json .ID }}' | ConvertFrom-Json | ForEach-Object {docker container rm --force --volumes $_}
+    displayName: 'Remove all containers  [Port to PSRelease]'
+    # Cleanup is not critical it passes every time it runs
+    continueOnError: true
+    condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true'))
+
+  - powershell: |
+       docker image ls --format '{{ json .}}'|ConvertFrom-Json| ForEach-Object {
+           if($_.tag -eq '<none>')
+           {
+               $formatString = 'yyyy-MM-dd HH:mm:ss zz00'
+               $createdAtString = $_.CreatedAt.substring(0,$_.CreatedAt.Length -4)
+               $createdAt = [DateTime]::ParseExact($createdAtString, $formatString,[System.Globalization.CultureInfo]::InvariantCulture)
+               if($createdAt -lt (Get-Date).adddays(-1))
+               {
+                    docker image rm $_.ID
+               }
+           }
+       }
+       exit 0
+    displayName: 'Remove old images [Port to PSRelease]'
+    # Cleanup is not critical it passes every time it runs
+    continueOnError: true
+    condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true'))
+
+  - powershell: |
+       Write-verbose "--docker info---" -verbose
+       docker info
+       Write-verbose "--docker image ls---" -verbose
+       docker image ls
+       Write-verbose "--docker container ls --all---" -verbose
+       docker container ls --all
+       exit 0
+    displayName: 'Capture docker info'
+    # Diagnostics is not critical it passes every time it runs
+    continueOnError: true
+    condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true'))
+
+  - powershell: |
+      tools/releaseBuild/vstsbuild.ps1 -ReleaseTag $(ReleaseTagVar) -Name win-$(Architecture)-symbols
+    displayName: 'Build Windows Universal - $(Architecture) Symbols zip'
+    condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true'))
+
+  - powershell: |
+       if ("$env:Architecture" -eq 'fxdependent')
+       {
+           $(Build.SourcesDirectory)\tools\releaseBuild\updateSigning.ps1 -SkipPwshExe
+       }
+       else
+       {
+           $(Build.SourcesDirectory)\tools\releaseBuild\updateSigning.ps1
+       }
+    displayName: 'Update Signing Xml'
+    condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true'))
+
+  - powershell: |
+       $vstsCommandString = "vso[task.setvariable variable=Symbols]${env:Symbols_$(Architecture)}"
+       Write-Host "sending " + $vstsCommandString
+       Write-Host "##$vstsCommandString"
+    displayName: 'Get Symbols path [Update build.json]'
+    condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true'))
+
+  - task: PkgESCodeSign@10
+    displayName: 'CodeSign $(Architecture)'
+    env:
+      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+    inputs:
+       signConfigXml: '$(Build.SourcesDirectory)\tools\releaseBuild\signing.xml'
+       inPathRoot: '$(Symbols)'
+       outPathRoot: '$(Symbols)\signed'
+    condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual'), ne(variables['SkipFxDependent'], 'true'))
+
+  - powershell: |
+       New-Item -ItemType Directory -Path $(Symbols)\signed -Force
+    displayName: 'Create empty signed folder'
+    condition: and(succeeded(), ne(variables['Build.Reason'], 'Manual'), ne(variables['SkipFxDependent'], 'true'))
+
+  - powershell: |
+       tools/releaseBuild/vstsbuild.ps1 -ReleaseTag $(ReleaseTagVar) -Name win-$(Architecture)-package -BuildPath $(Symbols) -SignedFilesPath $(Symbols)\signed
+    displayName: 'Build Windows Universal - $(Architecture) Package'
+    condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true'))

tools/releaseBuild/azureDevOps/templates/windows-component-governance.yml

@@ -0,0 +1,67 @@
+
+jobs:
+- job: ComponentRegistrationJob
+  displayName: Component Registration
+  condition: succeeded()
+
+  pool:
+    name: PowerShell
+
+  steps:
+
+  - powershell: |
+      tools/releaseBuild/setReleaseTag.ps1 -ReleaseTag $(ReleaseTagVar) -Variable "ReleaseTagVar"
+    displayName: 'Set ReleaseTag Variable'
+
+  - powershell: |
+       $version = '$(ReleaseTagVar)'.Substring(1)
+       $vstsCommandString = "vso[task.setvariable variable=Version]$version"
+       Write-Host "sending " + $vstsCommandString
+       Write-Host "##$vstsCommandString"
+    displayName: 'Set Version Variable'
+
+  - powershell: |
+       docker container prune --force
+       docker container ls --all --format '{{ json .ID }}' | ConvertFrom-Json | ForEach-Object {docker container rm --force --volumes $_}
+    displayName: 'Remove all containers'
+    # Cleanup is not critical it passes every time it runs
+    continueOnError: true
+
+  - powershell: |
+       docker image ls --format '{{ json .}}'|ConvertFrom-Json| ForEach-Object {
+           if($_.tag -eq '<none>')
+           {
+               $formatString = 'yyyy-MM-dd HH:mm:ss zz00'
+               $createdAtString = $_.CreatedAt.substring(0,$_.CreatedAt.Length -4)
+               $createdAt = [DateTime]::ParseExact($createdAtString, $formatString,[System.Globalization.CultureInfo]::InvariantCulture)
+               if($createdAt -lt (Get-Date).adddays(-1))
+               {
+                    docker image rm $_.ID
+               }
+           }
+       }
+       exit 0
+    displayName: 'Remove old images'
+    # Cleanup is not critical it passes every time it runs
+    continueOnError: true
+
+  - powershell: |
+       Write-verbose "--docker info---" -verbose
+       docker info
+       Write-verbose "--docker image ls---" -verbose
+       docker image ls
+       Write-verbose "--docker container ls --all---" -verbose
+       docker container ls --all
+    displayName: 'Capture Docker Info'
+    # Diagnostics is not critical it passes every time it runs
+    continueOnError: true
+
+  - powershell: |
+       ./tools/releaseBuild/vstsbuild.ps1 -ReleaseTag $(ReleaseTagVar) -Name win-x64-component-registration
+    displayName: 'Build Windows Universal - Component Registration'
+
+  - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
+    displayName: 'Component Detection'
+    inputs:
+      sourceScanPath: '$(componentregistration)'
+      snapshotForceEnabled: true

tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml

@@ -0,0 +1,206 @@
+parameters:
+  parentJobs: []
+
+jobs:
+- job: WinPackageSigningJob
+  displayName: Windows Package signing
+  dependsOn:
+    ${{ parameters.parentJobs }}
+  condition: succeeded()
+  pool:
+    name: Package ES CodeHub Lab E
+  variables:
+    BuildConfiguration: release
+    BuildPlatform: any cpu
+
+  steps:
+
+  - powershell: |
+      tools/releaseBuild/setReleaseTag.ps1 -ReleaseTag $(ReleaseTagVar) -Variable "ReleaseTagVar"
+    displayName: 'Set ReleaseTag Variable'
+
+  - powershell: |
+       $version = '$(ReleaseTagVar)'.Substring(1)
+       $vstsCommandString = "vso[task.setvariable variable=Version]$version"
+       Write-Host "sending " + $vstsCommandString
+       Write-Host "##$vstsCommandString"
+
+       $azureVersion = '$(ReleaseTagVar)'.ToLowerInvariant() -replace '\.', '-'
+       $vstsCommandString = "vso[task.setvariable variable=AzureVersion]$azureVersion"
+       Write-Host "sending " + $vstsCommandString
+       Write-Host "##$vstsCommandString"
+
+    displayName: 'Set Version Variable'
+
+  - task: DownloadBuildArtifacts@0
+    displayName: 'Download artifacts'
+    inputs:
+      downloadType: specific
+      itemPattern: |
+        **/*.zip
+        **/*.msi
+
+  - powershell: |
+      dir "$(System.ArtifactsDirectory)\*" -Recurse
+    displayName: 'Capture Downloaded Artifacts'
+    # Diagnostics is not critical it passes every time it runs
+    continueOnError: true
+
+  - powershell: |
+      Expand-Archive -Path "$(System.ArtifactsDirectory)\results\PowerShell-$(Version)-symbols-win-x86.zip" -Destination "$(Build.StagingDirectory)\symbols\x86"
+    displayName: 'Expand symbols zip - x86'
+
+  - powershell: |
+      Expand-Archive -Path "$(System.ArtifactsDirectory)\results\PowerShell-$(Version)-symbols-win-x64.zip" -Destination "$(Build.StagingDirectory)\symbols\x64"
+    displayName: 'Expand symbols zip - x64'
+
+  - powershell: |
+      Expand-Archive -Path "$(System.ArtifactsDirectory)\results\PowerShell-$(Version)-symbols-win-fxdependent.zip" -Destination "$(Build.StagingDirectory)\symbols\fxdependent"
+    displayName: 'Expand symbols zip - fxdependent'
+
+  - powershell: |
+      tools/releaseBuild/generatePackgeSigning.ps1 -AuthenticodeFiles "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x64.msi","$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x86.msi" -path "$(System.ArtifactsDirectory)\package.xml"
+    displayName: 'Generate Package Signing Xml'
+
+  - powershell: |
+      Get-Content "$(System.ArtifactsDirectory)\package.xml"
+    displayName: 'Capture signing xml'
+
+  - task: PkgESCodeSign@10
+    displayName: 'CodeSign $(System.ArtifactsDirectory)\package.xml'
+    env:
+      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+    inputs:
+      signConfigXml: '$(System.ArtifactsDirectory)\package.xml'
+      outPathRoot: '$(Build.StagingDirectory)\signedPackages'
+    condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual'))
+
+  - powershell: |
+       $packagePath = "$(Build.StagingDirectory)\signedPackages\PowerShell-$(Version)-win-x64.msi"
+       if(Test-Path -Path $packagePath)
+       {
+           Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath"
+       }
+    displayName: '[Create script] upload signed msi - x64'
+    condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual'))
+
+  - task: AzureFileCopy@1
+    displayName: 'upload signed msi to Azure - x64'
+    inputs:
+      SourcePath: '$(Build.StagingDirectory)\signedPackages\PowerShell-$(Version)-win-x64.msi'
+      azureSubscription: '$(AzureFileCopySubscription)'
+      Destination: AzureBlob
+      storage: '$(StorageAccount)'
+      ContainerName: '$(AzureVersion)'
+    condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual'))
+
+  - powershell: |
+       $packagePath = "$(Build.StagingDirectory)\signedPackages\PowerShell-$(Version)-win-x86.msi"
+       if(Test-Path -Path $packagePath)
+       {
+           Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath"
+       }
+    displayName: '[create script] upload signed msi - x86'
+
+  - task: AzureFileCopy@1
+    displayName: 'upload signed msi to Azure - x86'
+    inputs:
+      SourcePath: '$(Build.StagingDirectory)\signedPackages\PowerShell-$(Version)-win-x86.msi'
+      azureSubscription: '$(AzureFileCopySubscription)'
+      Destination: AzureBlob
+      storage: '$(StorageAccount)'
+      ContainerName: '$(AzureVersion)'
+    condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual'))
+
+  - powershell: |
+       $packagePath = "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x64.zip"
+       if(Test-Path -Path $packagePath)
+       {
+           Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath"
+       }
+    displayName: '[Create script] upload signed zip - x64'
+
+  - task: AzureFileCopy@1
+    displayName: 'upload signed zip to Azure - x64'
+    inputs:
+      SourcePath: '$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x64.zip'
+      azureSubscription: '$(AzureFileCopySubscription)'
+      Destination: AzureBlob
+      storage: '$(StorageAccount)'
+      ContainerName: '$(AzureVersion)'
+    condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual'))
+
+  - powershell: |
+       $packagePath = "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x86.zip"
+       if(Test-Path -Path $packagePath)
+       {
+           Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath"
+       }
+    displayName: '[create script] upload signed zip - x86'
+
+  - task: AzureFileCopy@1
+    displayName: 'upload signed zip to Azure - x86'
+    inputs:
+      SourcePath: '$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x86.zip'
+      azureSubscription: '$(AzureFileCopySubscription)'
+      Destination: AzureBlob
+      storage: '$(StorageAccount)'
+      ContainerName: '$(AzureVersion)'
+    condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual'))
+
+  - powershell: |
+       $packagePath = "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm32.zip"
+       if(Test-Path -Path $packagePath)
+       {
+           Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath"
+       }
+    displayName: '[create script] upload signed zip - arm'
+
+  - task: AzureFileCopy@1
+    displayName: 'upload signed zip to Azure - arm'
+    inputs:
+      SourcePath: '$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm32.zip'
+      azureSubscription: '$(AzureFileCopySubscription)'
+      Destination: AzureBlob
+      storage: '$(StorageAccount)'
+      ContainerName: '$(AzureVersion)'
+    condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual'))
+
+  - powershell: |
+       $packagePath = "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm64.zip"
+       if(Test-Path -Path $packagePath)
+       {
+           Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath"
+       }
+    displayName: '[create script] upload signed zip - arm64'
+
+  - task: AzureFileCopy@1
+    displayName: 'upload signed zip to Azure - arm64'
+    inputs:
+      SourcePath: '$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm64.zip'
+      azureSubscription: '$(AzureFileCopySubscription)'
+      Destination: AzureBlob
+      storage: '$(StorageAccount)'
+      ContainerName: '$(AzureVersion)'
+    condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual'))
+
+  - powershell: |
+       $packagePath = "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-fxdependent.zip"
+       if(Test-Path -Path $packagePath)
+       {
+           Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath"
+       }
+    displayName: '[create script] upload signed zip - fxdependent'
+
+  - task: AzureFileCopy@1
+    displayName: 'upload signed zip to Azure - fxdependent'
+    inputs:
+      SourcePath: '$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-fxdependent.zip'
+      azureSubscription: '$(AzureFileCopySubscription)'
+      Destination: AzureBlob
+      storage: '$(StorageAccount)'
+      ContainerName: '$(AzureVersion)'
+    condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual'))
+
+  - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3
+    displayName: 'Run MpCmdRun.exe'

tools/releaseBuild/generatePackgeSigning.ps1

@@ -5,10 +5,14 @@ param(
     [string] $Path,
     [string[]] $AuthenticodeDualFiles,
     [string[]] $AuthenticodeFiles,
-    [string[]] $NuPkgFiles
+    [string[]] $NuPkgFiles,
+    [string[]] $MacDeveloperFiles
 )
 
-if ((!$AuthenticodeDualFiles -or $AuthenticodeDualFiles.Count -eq 0) -and (!$AuthenticodeFiles -or $AuthenticodeFiles.Count -eq 0) -and (!$NuPkgFiles -or $NuPkgFiles.Count -eq 0))
+if ((!$AuthenticodeDualFiles -or $AuthenticodeDualFiles.Count -eq 0) -and
+    (!$AuthenticodeFiles -or $AuthenticodeFiles.Count -eq 0) -and
+    (!$NuPkgFiles -or $NuPkgFiles.Count -eq 0) -and
+    (!$MacDeveloperFiles -or $MacDeveloperFiles.Count -eq 0))
 {
     throw "At least one file must be specified"
 }
@@ -67,7 +71,7 @@ foreach($file in $AuthenticodeDualFiles)
 
 foreach($file in $AuthenticodeFiles)
 {
-    New-FileElement -File $file -SignType 'Authenticode' -XmlDoc $signingXml -Job $job
+    New-FileElement -File $file -SignType 'AuthenticodeFormer' -XmlDoc $signingXml -Job $job
 }
 
 foreach($file in $NuPkgFiles)
@@ -75,6 +79,10 @@ foreach($file in $NuPkgFiles)
     New-FileElement -File $file -SignType 'NuGet' -XmlDoc $signingXml -Job $job
 }
 
+foreach ($file in $MacDeveloperFiles) {
+    New-FileElement -File $file -SignType 'MacDeveloper' -XmlDoc $signingXml -Job $job
+}
+
 $signingXml.Save($path)
 $updateScriptPath = Join-Path -Path $PSScriptRoot -ChildPath 'updateSigning.ps1'
 & $updateScriptPath -SigningXmlPath $path