Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build: switch to ESRP v5, which supports managed identities #17134

Merged
merged 2 commits into from May 1, 2024
Merged

build: switch to ESRP v5, which supports managed identities #17134

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5c6287d
build: switch to ESRP v5, which supports managed identities
DHowett Apr 25, 2024
a59ea39
spell AKV too
DHowett Apr 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
7 changes: 7 additions & 0 deletions build/pipelines/ob-nightly.yml
View file
Open in desktop
Expand Up @@ -30,6 +30,13 @@
buildTerminal: true
pgoBuildMode: Optimize
codeSign: true
signingIdentity:
serviceName: $(SigningServiceName)
appId: $(SigningAppId)
tenantId: $(SigningTenantId)
akvName: $(SigningAKVName)
Fixed Show fixed Hide fixed
Fixed Show fixed Hide fixed
authCertName: $(SigningAuthCertName)
signCertName: $(SigningSignCertName)
publishSymbolsToPublic: true
publishVpackToWindows: false
symbolExpiryTime: 15
Expand Down
7 changes: 7 additions & 0 deletions build/pipelines/ob-release.yml
View file
Open in desktop
Expand Up @@ -78,6 +78,13 @@
buildConfigurations: ${{ parameters.buildConfigurations }}
buildPlatforms: ${{ parameters.buildPlatforms }}
codeSign: true
signingIdentity:
serviceName: $(SigningServiceName)
appId: $(SigningAppId)
tenantId: $(SigningTenantId)
akvName: $(SigningAKVName)
Fixed Show fixed Hide fixed
Fixed Show fixed Hide fixed
authCertName: $(SigningAuthCertName)
signCertName: $(SigningSignCertName)
terminalInternalPackageVersion: ${{ parameters.terminalInternalPackageVersion }}
publishSymbolsToPublic: ${{ parameters.publishSymbolsToPublic }}
publishVpackToWindows: ${{ parameters.publishVpackToWindows }}
Expand Down
12 changes: 10 additions & 2 deletions build/pipelines/templates-v2/job-build-package-wpf.yml
View file
Open in desktop
Expand Up @@ -27,6 +27,9 @@
- name: publishArtifacts
type: boolean
default: true
- name: signingIdentity
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

heck at this rate, we should almost have a do-codesign.yml template that takes one of these signingIdentity objects we're passing around

type: object
default: {}

jobs:
- job: ${{ parameters.jobName }}
Expand Down Expand Up @@ -97,10 +100,15 @@
flattenFolders: true

- ${{ if eq(parameters.codeSign, true) }}:
- task: EsrpCodeSigning@3
- task: EsrpCodeSigning@5
displayName: Submit *.nupkg to ESRP for code signing
inputs:
ConnectedServiceName: 9d6d2960-0793-4d59-943e-78dcb434840a
ConnectedServiceName: ${{ parameters.signingIdentity.serviceName }}
AppRegistrationClientId: ${{ parameters.signingIdentity.appId }}
AppRegistrationTenantId: ${{ parameters.signingIdentity.tenantId }}
AuthAKVName: ${{ parameters.signingIdentity.akvName }}
Fixed Show fixed Hide fixed
Fixed Show fixed Hide fixed
AuthCertName: ${{ parameters.signingIdentity.authCertName }}
AuthSignCertName: ${{ parameters.signingIdentity.signCertName }}
FolderPath: $(Build.ArtifactStagingDirectory)/nupkg
Pattern: '*.nupkg'
UseMinimatch: true
Expand Down
12 changes: 10 additions & 2 deletions build/pipelines/templates-v2/job-build-project.yml
View file
Open in desktop
Expand Up @@ -65,6 +65,9 @@
- name: removeAllNonSignedFiles
type: boolean
default: false
- name: signingIdentity
type: object
default: {}

jobs:
- job: ${{ parameters.jobName }}
Expand Down Expand Up @@ -235,10 +238,15 @@

# Code-sign everything we just put together.
# We run the signing in Terminal.BinDir, because all of the signing batches are relative to the final architecture/configuration output folder.
- task: EsrpCodeSigning@3
- task: EsrpCodeSigning@5
displayName: Submit Signing Request
inputs:
ConnectedServiceName: 9d6d2960-0793-4d59-943e-78dcb434840a
ConnectedServiceName: ${{ parameters.signingIdentity.serviceName }}
AppRegistrationClientId: ${{ parameters.signingIdentity.appId }}
AppRegistrationTenantId: ${{ parameters.signingIdentity.tenantId }}
AuthAKVName: ${{ parameters.signingIdentity.akvName }}
Fixed Show fixed Hide fixed
Fixed Show fixed Hide fixed
AuthCertName: ${{ parameters.signingIdentity.authCertName }}
AuthSignCertName: ${{ parameters.signingIdentity.signCertName }}
FolderPath: '$(Terminal.BinDir)'
signType: batchSigning
batchSignPolicyFile: '$(Build.SourcesDirectory)/ESRPSigningConfig.json'
Expand Down
12 changes: 10 additions & 2 deletions build/pipelines/templates-v2/job-merge-msix-into-bundle.yml
View file
Open in desktop
Expand Up @@ -32,6 +32,9 @@
- name: afterBuildSteps
type: stepList
default: []
- name: signingIdentity
type: object
default: {}

jobs:
- job: ${{ parameters.jobName }}
Expand Down Expand Up @@ -94,10 +97,15 @@
displayName: Create msixbundle

- ${{ if eq(parameters.codeSign, true) }}:
- task: EsrpCodeSigning@3
- task: EsrpCodeSigning@5
displayName: Submit *.msixbundle to ESRP for code signing
inputs:
ConnectedServiceName: 9d6d2960-0793-4d59-943e-78dcb434840a
ConnectedServiceName: ${{ parameters.signingIdentity.serviceName }}
AppRegistrationClientId: ${{ parameters.signingIdentity.appId }}
AppRegistrationTenantId: ${{ parameters.signingIdentity.tenantId }}
AuthAKVName: ${{ parameters.signingIdentity.akvName }}
Fixed Show fixed Hide fixed
Fixed Show fixed Hide fixed
AuthCertName: ${{ parameters.signingIdentity.authCertName }}
AuthSignCertName: ${{ parameters.signingIdentity.signCertName }}
FolderPath: $(System.ArtifactsDirectory)\bundle
Pattern: $(BundleStemName)*.msixbundle
UseMinimatch: true
Expand Down
12 changes: 10 additions & 2 deletions build/pipelines/templates-v2/job-package-conpty.yml
View file
Open in desktop
Expand Up @@ -27,6 +27,9 @@ parameters:
- name: publishArtifacts
type: boolean
default: true
- name: signingIdentity
type: object
default: {}

jobs:
- job: ${{ parameters.jobName }}
Expand Down Expand Up @@ -82,10 +85,15 @@ jobs:
versionEnvVar: XES_PACKAGEVERSIONNUMBER

- ${{ if eq(parameters.codeSign, true) }}:
- task: EsrpCodeSigning@3
- task: EsrpCodeSigning@5
displayName: Submit *.nupkg to ESRP for code signing
inputs:
ConnectedServiceName: 9d6d2960-0793-4d59-943e-78dcb434840a
ConnectedServiceName: ${{ parameters.signingIdentity.serviceName }}
AppRegistrationClientId: ${{ parameters.signingIdentity.appId }}
AppRegistrationTenantId: ${{ parameters.signingIdentity.tenantId }}
AuthAKVName: ${{ parameters.signingIdentity.akvName }}
AuthCertName: ${{ parameters.signingIdentity.authCertName }}
AuthSignCertName: ${{ parameters.signingIdentity.signCertName }}
Comment on lines +91 to +96
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After googling a bit, I wonder if you can do

inputs:
  ${{ each var in parameters.signingIdentity }}:
    ${{var.name}}: ${{ var.value }}
  FolderPath: $(Build.ArtifactStagingDirectory)/nupkg

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably, yeah. I'm going to reach for something more like Mike's recommendation though - and maybe do both of these at the same time.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wait that sounds like a way to leak secrets. Like, if we add params, forget that we did this, and now we're passing all sorts of stuff to esrp that it wasn't expecting

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did this in powertoys because they have 300 copies of the signing step...

image

image

FolderPath: $(Build.ArtifactStagingDirectory)/nupkg
Pattern: '*.nupkg'
UseMinimatch: true
Expand Down
2 changes: 1 addition & 1 deletion build/pipelines/templates-v2/pipeline-full-release-build.yml
View file
Open in desktop
Expand Up @@ -33,7 +33,7 @@ parameters:
- arm64
- name: codeSign
type: boolean
default: true
default: false
- name: generateSbom
type: boolean
default: true
Expand Down
8 changes: 8 additions & 0 deletions build/pipelines/templates-v2/pipeline-onebranch-full-release-build.yml
View file
Open in desktop
Expand Up @@ -60,6 +60,9 @@ parameters:
- name: extraPublishJobs
type: object
default: []
- name: signingIdentity
type: object
default: {}

resources:
repositories:
Expand Down Expand Up @@ -125,6 +128,7 @@ extends:
generateSbom: false # this is handled by onebranch
removeAllNonSignedFiles: true # appease the overlords
codeSign: ${{ parameters.codeSign }}
signingIdentity: ${{ parameters.signingIdentity }}
beforeBuildSteps: # Right before we build, lay down the universal package and localizations
- task: PkgESSetupBuild@12
displayName: Package ES - Setup Build
Expand Down Expand Up @@ -161,6 +165,7 @@ extends:
generateSbom: false # this is handled by onebranch
removeAllNonSignedFiles: true # appease the overlords
codeSign: ${{ parameters.codeSign }}
signingIdentity: ${{ parameters.signingIdentity }}
beforeBuildSteps:
- task: PkgESSetupBuild@12
displayName: Package ES - Setup Build
Expand Down Expand Up @@ -214,6 +219,7 @@ extends:
buildPlatforms: ${{ parameters.buildPlatforms }}
generateSbom: false # Handled by onebranch
codeSign: ${{ parameters.codeSign }}
signingIdentity: ${{ parameters.signingIdentity }}
afterBuildSteps:
# This directory has to exist, even if we aren't using createvpack, because the Guardian rules demand it.
- pwsh: |-
Expand Down Expand Up @@ -241,6 +247,7 @@ extends:
buildPlatforms: ${{ parameters.buildPlatforms }}
generateSbom: false # this is handled by onebranch
codeSign: ${{ parameters.codeSign }}
signingIdentity: ${{ parameters.signingIdentity }}

- ${{ if eq(parameters.buildWPF, true) }}:
- template: ./build/pipelines/templates-v2/job-build-package-wpf.yml@self
Expand All @@ -258,6 +265,7 @@ extends:
buildPlatforms: ${{ parameters.buildPlatforms }}
generateSbom: false # this is handled by onebranch
codeSign: ${{ parameters.codeSign }}
signingIdentity: ${{ parameters.signingIdentity }}

- stage: Publish
displayName: Publish
Expand Down