From abb408dbf297ce135d8c2a1eeca35eea3e506f6c Mon Sep 17 00:00:00 2001 From: Aditya Patwardhan Date: Sun, 26 Jul 2020 11:53:56 -0700 Subject: [PATCH 01/27] Add default help content to the assets folder (#13257) * Add default help content to the assets folder * Reformatted and removed TechNet reference --- assets/default.help.txt | 108 ++++++++++++++++++ nuget.config | 1 - src/powershell-unix/powershell-unix.csproj | 9 +- .../powershell-win-core.csproj | 9 +- tools/packaging/packaging.psm1 | 3 + 5 files changed, 121 insertions(+), 9 deletions(-) create mode 100644 assets/default.help.txt diff --git a/assets/default.help.txt b/assets/default.help.txt new file mode 100644 index 00000000000..a5b5cefc9cd --- /dev/null +++ b/assets/default.help.txt @@ -0,0 +1,108 @@ + +TOPIC + PowerShell Help System + +SHORT DESCRIPTION + Displays help about PowerShell cmdlets and concepts. + +LONG DESCRIPTION + PowerShell Help describes PowerShell cmdlets, functions, scripts, and + modules, and explains concepts, including the elements of the PowerShell + language. + + PowerShell does not include help files, but you can read the help topics + online, or use the Update-Help cmdlet to download help files to your + computer and then use the Get-Help cmdlet to display the help topics at + the command line. + + You can also use the Update-Help cmdlet to download updated help files + as they are released so that your local help content is never obsolete. + + Without help files, Get-Help displays auto-generated help for cmdlets, + functions, and scripts. + + + ONLINE HELP + You can find help for PowerShell online at + https://go.microsoft.com/fwlink/?LinkID=108518. + + To open online help for any cmdlet or function, type: + + Get-Help -Online + + UPDATE-HELP + To download and install help files on your computer: + + 1. Start PowerShell with the "Run as administrator" option. + 2. Type: + + Update-Help + + After the help files are installed, you can use the Get-Help cmdlet to + display the help topics. You can also use the Update-Help cmdlet to + download updated help files so that your local help files are always + up-to-date. + + For more information about the Update-Help cmdlet, type: + + Get-Help Update-Help -Online + + or go to: https://go.microsoft.com/fwlink/?LinkID=210614 + + + GET-HELP + The Get-Help cmdlet displays help at the command line from content in + help files on your computer. Without help files, Get-Help displays basic + help about cmdlets and functions. You can also use Get-Help to display + online help for cmdlets and functions. + + To get help for a cmdlet, type: + + Get-Help + + To get online help, type: + + Get-Help -Online + + The titles of conceptual topics begin with "About_". To get help for a + concept or language element, type: + + Get-Help About_ + + To search for a word or phrase in all help files, type: + + Get-Help + + For more information about the Get-Help cmdlet, type: + + Get-Help Get-Help -Online + + or go to: https://go.microsoft.com/fwlink/?LinkID=113316 + + + EXAMPLES: + Save-Help : Download help files from the internet and save + them on a file share. + + Update-Help : Downloads and installs help files from the + internet or a file share. + + Get-Help Get-Process : Displays help about the Get-Process cmdlet. + + Get-Help Get-Process -Online + : Opens online help for the Get-Process cmdlet. + + Help Get-Process : Displays help about Get-Process one page at a + time. + Get-Process -? : Displays help about the Get-Process cmdlet. + + Get-Help About_Modules : Displays help about PowerShell modules. + + Get-Help remoting : Searches the help topics for the word "remoting." + + SEE ALSO: + about_Updatable_Help + Get-Help + Save-Help + Update-Help + diff --git a/nuget.config b/nuget.config index 5ec994d9118..00290082689 100644 --- a/nuget.config +++ b/nuget.config @@ -5,7 +5,6 @@ - diff --git a/src/powershell-unix/powershell-unix.csproj b/src/powershell-unix/powershell-unix.csproj index b815c87dfaf..55f1f86aafb 100644 --- a/src/powershell-unix/powershell-unix.csproj +++ b/src/powershell-unix/powershell-unix.csproj @@ -32,14 +32,15 @@ PreserveNewest PreserveNewest + + en-US\default.help.txt + PreserveNewest + PreserveNewest + - - - - diff --git a/src/powershell-win-core/powershell-win-core.csproj b/src/powershell-win-core/powershell-win-core.csproj index 429d658b1b8..d1cf69b95ef 100644 --- a/src/powershell-win-core/powershell-win-core.csproj +++ b/src/powershell-win-core/powershell-win-core.csproj @@ -49,6 +49,11 @@ preview\pwsh-preview.cmd PreserveNewest + + en-US\default.help.txt + PreserveNewest + PreserveNewest + @@ -59,8 +64,4 @@ - - - - diff --git a/tools/packaging/packaging.psm1 b/tools/packaging/packaging.psm1 index e428b541c6d..7b02384d65a 100644 --- a/tools/packaging/packaging.psm1 +++ b/tools/packaging/packaging.psm1 @@ -205,6 +205,9 @@ function Start-PSPackage { # Copy the ThirdPartyNotices.txt so it's part of the package Copy-Item "$RepoRoot/ThirdPartyNotices.txt" -Destination $Source -Force + # Copy the default.help.txt so it's part of the package + Copy-Item "$RepoRoot/assets/default.help.txt" -Destination "$Source/en-US" -Force + # If building a symbols package, we add a zip of the parent to publish if ($IncludeSymbols.IsPresent) { From 5a8b3d9a795e01bc8c7908e618015dfa10ec1907 Mon Sep 17 00:00:00 2001 From: Andrew Date: Thu, 5 Mar 2020 10:59:51 -0800 Subject: [PATCH 02/27] Fix MSIX packaging to determine if a Preview release by inspecting the semantic version string (#11991) --- tools/packaging/packaging.psm1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/packaging/packaging.psm1 b/tools/packaging/packaging.psm1 index 7b02384d65a..fa19238be4c 100644 --- a/tools/packaging/packaging.psm1 +++ b/tools/packaging/packaging.psm1 @@ -3080,7 +3080,7 @@ function New-MSIXPackage $displayName = $productName - if ($packageName.Contains('-')) { + if ($ProductSemanticVersion.Contains('-')) { $ProductName += 'Preview' $displayName += ' Preview' } From 9fffb6d7bcaccd680203a4e68b25454a2fec257e Mon Sep 17 00:00:00 2001 From: Dongbo Wang Date: Thu, 23 Jul 2020 10:24:42 -0700 Subject: [PATCH 03/27] Use temp personal path at Runspace startup when env 'HOME' not defined (#13239) --- src/System.Management.Automation/CoreCLR/CorePsPlatform.cs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/System.Management.Automation/CoreCLR/CorePsPlatform.cs b/src/System.Management.Automation/CoreCLR/CorePsPlatform.cs index 30e9c2b1f38..ea06fd1f2e5 100644 --- a/src/System.Management.Automation/CoreCLR/CorePsPlatform.cs +++ b/src/System.Management.Automation/CoreCLR/CorePsPlatform.cs @@ -239,6 +239,8 @@ public enum XDG_Type DEFAULT } + private static string s_tempHomeDir = null; + /// /// Function for choosing directory location of PowerShell for profile loading. /// @@ -252,7 +254,8 @@ public static string SelectProductNameForDirectory(Platform.XDG_Type dirpath) string envHome = System.Environment.GetEnvironmentVariable(CommonEnvVariableNames.Home); if (envHome == null) { - envHome = GetTemporaryDirectory(); + s_tempHomeDir ??= GetTemporaryDirectory(); + envHome = s_tempHomeDir; } string xdgConfigHomeDefault = Path.Combine(envHome, ".config", "powershell"); From 41622a614769ddbcf13508a944e7134f054514a1 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Fri, 29 May 2020 10:26:30 -0700 Subject: [PATCH 04/27] Sign the `MSIX` files for the store (#12582) Co-authored-by: Aditya Patwardhan # Conflicts: # tools/releaseBuild/setReleaseTag.ps1 --- .vsts-ci/linux.yml | 4 ++-- .vsts-ci/mac.yml | 3 ++- .vsts-ci/windows.yml | 2 ++ assets/AppxManifest.xml | 2 +- tools/packaging/packaging.psm1 | 16 ++++++++++------ .../templates/windows-package-signing.yml | 6 +++++- tools/releaseBuild/generatePackgeSigning.ps1 | 14 +++++++++++++- tools/releaseBuild/setReleaseTag.ps1 | 9 ++++++++- 8 files changed, 43 insertions(+), 13 deletions(-) diff --git a/.vsts-ci/linux.yml b/.vsts-ci/linux.yml index 6c7a94e0216..031316eef26 100644 --- a/.vsts-ci/linux.yml +++ b/.vsts-ci/linux.yml @@ -11,7 +11,6 @@ trigger: include: - '*' exclude: - - /tools/releaseBuild/**/* - /.vsts-ci/misc-analysis.yml - /.github/ISSUE_TEMPLATE/* - /.dependabot/config.yml @@ -25,7 +24,8 @@ pr: include: - '*' exclude: - - /tools/releaseBuild/**/* + - tools/releaseBuild/* + - tools/releaseBuild/azureDevOps/templates/* - /.vsts-ci/misc-analysis.yml - /.github/ISSUE_TEMPLATE/* - /.dependabot/config.yml diff --git a/.vsts-ci/mac.yml b/.vsts-ci/mac.yml index ca4a66fc7e6..96121e80f77 100644 --- a/.vsts-ci/mac.yml +++ b/.vsts-ci/mac.yml @@ -25,10 +25,11 @@ pr: include: - '*' exclude: - - /tools/releaseBuild/**/* - /.vsts-ci/misc-analysis.yml - /.github/ISSUE_TEMPLATE/* - /.dependabot/config.yml + - tools/releaseBuild/* + - tools/releaseBuild/azureDevOps/templates/* variables: DOTNET_CLI_TELEMETRY_OPTOUT: 1 diff --git a/.vsts-ci/windows.yml b/.vsts-ci/windows.yml index 81e74dcbc77..11bccbbbfa6 100644 --- a/.vsts-ci/windows.yml +++ b/.vsts-ci/windows.yml @@ -27,6 +27,8 @@ pr: - /.vsts-ci/misc-analysis.yml - /.github/ISSUE_TEMPLATE/* - /.dependabot/config.yml + - tools/releaseBuild/* + - tools/releaseBuild/azureDevOps/templates/* variables: GIT_CONFIG_PARAMETERS: "'core.autocrlf=false'" diff --git a/assets/AppxManifest.xml b/assets/AppxManifest.xml index 29a7fe78e26..8d417c1d1a4 100644 --- a/assets/AppxManifest.xml +++ b/assets/AppxManifest.xml @@ -9,7 +9,7 @@ xmlns:desktop6="http://schemas.microsoft.com/appx/manifest/desktop/windows10/6" xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"> - + $DISPLAYNAME$ diff --git a/tools/packaging/packaging.psm1 b/tools/packaging/packaging.psm1 index fa19238be4c..18c4fc57fa4 100644 --- a/tools/packaging/packaging.psm1 +++ b/tools/packaging/packaging.psm1 @@ -3110,9 +3110,18 @@ function New-MSIXPackage Write-Verbose "Version: $productversion" -Verbose + $isPreview = Test-IsPreview -Version $ProductSemanticVersion + if ($isPreview) { + Write-Verbose "Using Preview assets" -Verbose + } + # Appx manifest needs to be in root of source path, but the embedded version needs to be updated + # cp-459155 is 'CN=Microsoft Windows Store Publisher (Store EKU), O=Microsoft Corporation, L=Redmond, S=Washington, C=US' + # authenticodeFormer is 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US' + $releasePublisher = 'CN=Microsoft Windows Store Publisher (Store EKU), O=Microsoft Corporation, L=Redmond, S=Washington, C=US' + $appxManifest = Get-Content "$RepoRoot\assets\AppxManifest.xml" -Raw - $appxManifest = $appxManifest.Replace('$VERSION$', $ProductVersion).Replace('$ARCH$', $Architecture).Replace('$PRODUCTNAME$', $productName).Replace('$DISPLAYNAME$', $displayName) + $appxManifest = $appxManifest.Replace('$VERSION$', $ProductVersion).Replace('$ARCH$', $Architecture).Replace('$PRODUCTNAME$', $productName).Replace('$DISPLAYNAME$', $displayName).Replace('$PUBLISHER$', $releasePublisher) Set-Content -Path "$ProductSourcePath\AppxManifest.xml" -Value $appxManifest -Force # Necessary image assets need to be in source assets folder $assets = @( @@ -3127,11 +3136,6 @@ function New-MSIXPackage $null = New-Item -ItemType Directory -Path "$ProductSourcePath\assets" } - $isPreview = Test-IsPreview -Version $ProductSemanticVersion - if ($isPreview) { - Write-Verbose "Using Preview assets" -Verbose - } - $assets | ForEach-Object { if ($isPreview) { Copy-Item -Path "$RepoRoot\assets\$_-Preview.png" -Destination "$ProductSourcePath\assets\$_.png" diff --git a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml index 966173ddba6..b4cdea15ccd 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml @@ -38,12 +38,16 @@ jobs: $authenticodefiles = @( "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x64.msi" "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x86.msi" + ) + + $msixFiles = @( "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x86.msix" "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x64.msix" "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm32.msix" "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm64.msix" ) - tools/releaseBuild/generatePackgeSigning.ps1 -AuthenticodeFiles $authenticodeFiles -path "$(System.ArtifactsDirectory)\package.xml" + + tools/releaseBuild/generatePackgeSigning.ps1 -AuthenticodeFiles $authenticodeFiles -path "$(System.ArtifactsDirectory)\package.xml" -MsixCertType $env:MSIX_TYPE -MsixFiles $msixFiles displayName: 'Generate Package Signing Xml' - powershell: | diff --git a/tools/releaseBuild/generatePackgeSigning.ps1 b/tools/releaseBuild/generatePackgeSigning.ps1 index 083bb6b7ad5..30252de76a2 100644 --- a/tools/releaseBuild/generatePackgeSigning.ps1 +++ b/tools/releaseBuild/generatePackgeSigning.ps1 @@ -8,7 +8,10 @@ param( [string[]] $NuPkgFiles, [string[]] $MacDeveloperFiles, [string[]] $LinuxFiles, - [string[]] $ThirdPartyFiles + [string[]] $ThirdPartyFiles, + [string[]] $MsixFiles, + [ValidateSet('release','preview')] + [string] $MsixCertType = 'preview' ) if ((!$AuthenticodeDualFiles -or $AuthenticodeDualFiles.Count -eq 0) -and @@ -16,6 +19,7 @@ if ((!$AuthenticodeDualFiles -or $AuthenticodeDualFiles.Count -eq 0) -and (!$NuPkgFiles -or $NuPkgFiles.Count -eq 0) -and (!$MacDeveloperFiles -or $MacDeveloperFiles.Count -eq 0) -and (!$LinuxFiles -or $LinuxFiles.Count -eq 0) -and + (!$MsixFiles -or $MsixFiles.Count -eq 0) -and (!$ThirdPartyFiles -or $ThirdPartyFiles.Count -eq 0)) { throw "At least one file must be specified" @@ -95,6 +99,14 @@ foreach ($file in $ThirdPartyFiles) { New-FileElement -File $file -SignType 'ThirdParty' -XmlDoc $signingXml -Job $job } +foreach ($file in $MsixFiles) { + # 'CP-459155' signs for the store only + # AuthenticodeFormer works only for sideloading + # ---------------------------------------------- + # update releasePublisher in packaging.psm1 when this is changed + New-FileElement -File $file -SignType 'CP-459155' -XmlDoc $signingXml -Job $job +} + $signingXml.Save($path) $updateScriptPath = Join-Path -Path $PSScriptRoot -ChildPath 'updateSigning.ps1' & $updateScriptPath -SigningXmlPath $path diff --git a/tools/releaseBuild/setReleaseTag.ps1 b/tools/releaseBuild/setReleaseTag.ps1 index 97ea8ddb86c..f84f7a65e9b 100644 --- a/tools/releaseBuild/setReleaseTag.ps1 +++ b/tools/releaseBuild/setReleaseTag.ps1 @@ -58,6 +58,8 @@ function New-BuildInfoJson { $branchOnly = $Branch -replace '^refs/heads/'; $branchOnly = $branchOnly -replace '[_\-]' +$msixType = 'preview' + $isDaily = $false if($ReleaseTag -eq 'fromBranch' -or !$ReleaseTag) @@ -65,7 +67,8 @@ if($ReleaseTag -eq 'fromBranch' -or !$ReleaseTag) # Branch is named release- if($Branch -match '^.*(release[-/])') { - Write-verbose "release branch:" -verbose + $msixType = 'release' + Write-Verbose "release branch:" -Verbose $releaseTag = $Branch -replace '^.*(release[-/])' $vstsCommandString = "vso[task.setvariable variable=$Variable]$releaseTag" Write-Verbose -Message "setting $Variable to $releaseTag" -Verbose @@ -127,4 +130,8 @@ $vstsCommandString = "vso[task.setvariable variable=IS_DAILY]$($isDaily.ToString Write-Verbose -Message "$vstsCommandString" -Verbose Write-Host -Object "##$vstsCommandString" +$vstsCommandString = "vso[task.setvariable variable=MSIX_TYPE]$msixType" +Write-Verbose -Message "$vstsCommandString" -Verbose +Write-Host -Object "##$vstsCommandString" + Write-Output $releaseTag From 4ecaf1f82e8ff351c9be4a5b97b03520ee5b24db Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Mon, 3 Aug 2020 19:23:22 -0700 Subject: [PATCH 05/27] Use authenticode cert for msix signing (#13330) --- tools/packaging/packaging.psm1 | 2 +- tools/releaseBuild/generatePackgeSigning.ps1 | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/packaging/packaging.psm1 b/tools/packaging/packaging.psm1 index 18c4fc57fa4..670271182b7 100644 --- a/tools/packaging/packaging.psm1 +++ b/tools/packaging/packaging.psm1 @@ -3118,7 +3118,7 @@ function New-MSIXPackage # Appx manifest needs to be in root of source path, but the embedded version needs to be updated # cp-459155 is 'CN=Microsoft Windows Store Publisher (Store EKU), O=Microsoft Corporation, L=Redmond, S=Washington, C=US' # authenticodeFormer is 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US' - $releasePublisher = 'CN=Microsoft Windows Store Publisher (Store EKU), O=Microsoft Corporation, L=Redmond, S=Washington, C=US' + $releasePublisher = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US' $appxManifest = Get-Content "$RepoRoot\assets\AppxManifest.xml" -Raw $appxManifest = $appxManifest.Replace('$VERSION$', $ProductVersion).Replace('$ARCH$', $Architecture).Replace('$PRODUCTNAME$', $productName).Replace('$DISPLAYNAME$', $displayName).Replace('$PUBLISHER$', $releasePublisher) diff --git a/tools/releaseBuild/generatePackgeSigning.ps1 b/tools/releaseBuild/generatePackgeSigning.ps1 index 30252de76a2..e77788cfa97 100644 --- a/tools/releaseBuild/generatePackgeSigning.ps1 +++ b/tools/releaseBuild/generatePackgeSigning.ps1 @@ -100,11 +100,11 @@ foreach ($file in $ThirdPartyFiles) { } foreach ($file in $MsixFiles) { - # 'CP-459155' signs for the store only - # AuthenticodeFormer works only for sideloading + # 'CP-459155' is supposed to work for the store + # AuthenticodeFormer works for sideloading and via a workaround, through the store # ---------------------------------------------- # update releasePublisher in packaging.psm1 when this is changed - New-FileElement -File $file -SignType 'CP-459155' -XmlDoc $signingXml -Job $job + New-FileElement -File $file -SignType 'AuthenticodeFormer' -XmlDoc $signingXml -Job $job } $signingXml.Save($path) From e257c7e3a728d10f95e5ced9b829689f2bb77ff1 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Tue, 11 Aug 2020 14:01:47 -0700 Subject: [PATCH 06/27] Sign individual files in pkg (#13392) Co-authored-by: Aditya Patwardhan # Conflicts: # tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 --- tools/packaging/packaging.psm1 | 24 +- .../releaseBuild/azureDevOps/releaseBuild.yml | 287 +++++++++--------- .../templates/mac-file-signing.yml | 108 +++++++ .../templates/mac-package-build.yml | 110 +++++++ .../templates/mac-package-signing.yml | 31 +- .../azureDevOps/templates/mac.yml | 16 +- .../templates/upload-final-results.yml | 5 +- .../macOS/PowerShellPackageVsts.ps1 | 62 +++- 8 files changed, 450 insertions(+), 193 deletions(-) create mode 100644 tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml create mode 100644 tools/releaseBuild/azureDevOps/templates/mac-package-build.yml diff --git a/tools/packaging/packaging.psm1 b/tools/packaging/packaging.psm1 index 670271182b7..6806d83c74c 100644 --- a/tools/packaging/packaging.psm1 +++ b/tools/packaging/packaging.psm1 @@ -664,13 +664,14 @@ function Expand-PSSignedBuild # That zip file is used for compliance scan. Remove-Item -Path (Join-Path -Path $buildPath -ChildPath '*.zip') -Recurse - if ($SkipPwshExeCheck) - { - $windowsExecutablePath = (Join-Path $buildPath -ChildPath 'pwsh.dll') - } - else - { - $windowsExecutablePath = (Join-Path $buildPath -ChildPath 'pwsh.exe') + if ($SkipPwshExeCheck) { + $executablePath = (Join-Path $buildPath -ChildPath 'pwsh.dll') + } else { + if ($IsMacOS -or $IsLinux) { + $executablePath = (Join-Path $buildPath -ChildPath 'pwsh') + } else { + $executablePath = (Join-Path $buildPath -ChildPath 'pwsh.exe') + } } Restore-PSModuleToBuild -PublishPath $buildPath @@ -682,12 +683,9 @@ function Expand-PSSignedBuild $options.PSModuleRestore = $true - if (Test-Path -Path $windowsExecutablePath) - { - $options.Output = $windowsExecutablePath - } - else - { + if (Test-Path -Path $executablePath) { + $options.Output = $executablePath + } else { throw 'Could not find pwsh' } diff --git a/tools/releaseBuild/azureDevOps/releaseBuild.yml b/tools/releaseBuild/azureDevOps/releaseBuild.yml index 803dd01c90f..2f38adc5367 100644 --- a/tools/releaseBuild/azureDevOps/releaseBuild.yml +++ b/tools/releaseBuild/azureDevOps/releaseBuild.yml @@ -19,147 +19,146 @@ resources: - repo: self clean: true -jobs: -- template: templates/checkAzureContainer.yml - -- template: templates/linux.yml - parameters: - buildName: deb - parentJob: DeleteBlob - -- template: templates/linux.yml - parameters: - buildName: rpm - uploadDisplayName: Upload and Sign - parentJob: DeleteBlob - -- template: templates/linux.yml - parameters: - buildName: fxdependent - parentJob: DeleteBlob - -- template: templates/linux.yml - parameters: - buildName: alpine - parentJob: DeleteBlob - -- template: templates/mac.yml - parameters: - parentJob: DeleteBlob - -- template: templates/windows-hosted-build.yml - parameters: - Architecture: x64 - parentJob: DeleteBlob - -- template: templates/windows-hosted-build.yml - parameters: - Architecture: x86 - parentJob: DeleteBlob - -- template: templates/windows-hosted-build.yml - parameters: - Architecture: arm - parentJob: DeleteBlob - -- template: templates/windows-hosted-build.yml - parameters: - Architecture: arm64 - parentJob: DeleteBlob - -- template: templates/windows-hosted-build.yml - parameters: - Architecture: fxdependent - parentJob: DeleteBlob - -- template: templates/windows-hosted-build.yml - parameters: - Architecture: fxdependentWinDesktop - parentJob: DeleteBlob - -- template: templates/windows-packaging.yml - parameters: - Architecture: x64 - parentJob: build_windows_x64 - -- template: templates/windows-packaging.yml - parameters: - Architecture: x86 - parentJob: build_windows_x86 - -- template: templates/windows-packaging.yml - parameters: - Architecture: arm - parentJob: build_windows_arm - -- template: templates/windows-packaging.yml - parameters: - Architecture: arm64 - parentJob: build_windows_arm64 - -- template: templates/windows-packaging.yml - parameters: - Architecture: fxdependent - parentJob: build_windows_fxdependent - -- template: templates/windows-packaging.yml - parameters: - Architecture: fxdependentWinDesktop - parentJob: build_windows_fxdependentWinDesktop - -- template: templates/windows-package-signing.yml - parameters: - parentJobs: - - sign_windows_x64 - - sign_windows_x86 - - sign_windows_arm - - sign_windows_arm64 - - sign_windows_fxdependent - - sign_windows_fxdependentWinDesktop - -- template: templates/mac-package-signing.yml - -- template: templates/compliance.yml - parameters: - parentJobs: - - build_windows_x64 - - build_windows_x86 - - build_windows_fxdependent - - build_windows_fxdependentWinDesktop - -- template: templates/nuget.yml - parameters: - parentJobs: - - WinPackageSigningJob - - upload_deb - - upload_rpm - - upload_alpine - - build_macOS - -- template: templates/json.yml - parameters: - parentJobs: - - WinPackageSigningJob - - upload_deb - - upload_rpm - - upload_alpine - - MacPackageSigningJob - -- template: templates/testartifacts.yml - -- job: release_json - displayName: Create and Upload release.json - pool: - vmImage: 'windows-latest' - steps: - - template: templates/SetVersionVariables.yml - parameters: - ReleaseTagVar: $(ReleaseTagVar) - - - powershell: | - $metadata = Get-Content '$(Build.SourcesDirectory)/tools/metadata.json' -Raw | ConvertFrom-Json - $LTS = $metadata.LTSRelease - @{ ReleaseVersion = "$(Version)"; LTSRelease = $LTS } | ConvertTo-Json | Out-File "$(Build.StagingDirectory)\release.json" - Get-Content "$(Build.StagingDirectory)\release.json" - Write-Host "##vso[artifact.upload containerfolder=metadata;artifactname=metadata]$(Build.StagingDirectory)\release.json" - displayName: Create and upload release.json file to build artifact +stages: + - stage: prep + jobs: + - template: templates/checkAzureContainer.yml + + - stage: macos + dependsOn: ['prep'] + jobs: + - template: templates/mac.yml + + - template: templates/mac-file-signing.yml + parameters: + parentJob: build_macOS + + - template: templates/mac-package-build.yml + parameters: + parentJob: MacFileSigningJob + + - template: templates/mac-package-signing.yml + parameters: + parentJob: package_macOS + + - stage: linux + dependsOn: ['prep'] + jobs: + - template: templates/linux.yml + parameters: + buildName: deb + + - template: templates/linux.yml + parameters: + buildName: rpm + uploadDisplayName: Upload and Sign + + - template: templates/linux.yml + parameters: + buildName: fxdependent + parentJob: build_deb + + - template: templates/linux.yml + parameters: + buildName: alpine + + - stage: windows + dependsOn: ['prep'] + jobs: + - template: templates/windows-hosted-build.yml + parameters: + Architecture: x64 + + - template: templates/windows-hosted-build.yml + parameters: + Architecture: x86 + + - template: templates/windows-hosted-build.yml + parameters: + Architecture: arm + + - template: templates/windows-hosted-build.yml + parameters: + Architecture: arm64 + + - template: templates/windows-hosted-build.yml + parameters: + Architecture: fxdependent + + - template: templates/windows-hosted-build.yml + parameters: + Architecture: fxdependentWinDesktop + + - template: templates/windows-packaging.yml + parameters: + Architecture: x64 + parentJob: build_windows_x64 + + - template: templates/windows-packaging.yml + parameters: + Architecture: x86 + parentJob: build_windows_x86 + + - template: templates/windows-packaging.yml + parameters: + Architecture: arm + parentJob: build_windows_arm + + - template: templates/windows-packaging.yml + parameters: + Architecture: arm64 + parentJob: build_windows_arm64 + + - template: templates/windows-packaging.yml + parameters: + Architecture: fxdependent + parentJob: build_windows_fxdependent + + - template: templates/windows-packaging.yml + parameters: + Architecture: fxdependentWinDesktop + parentJob: build_windows_fxdependentWinDesktop + + - template: templates/windows-package-signing.yml + parameters: + parentJobs: + - sign_windows_x64 + - sign_windows_x86 + - sign_windows_arm + - sign_windows_arm64 + - sign_windows_fxdependent + - sign_windows_fxdependentWinDesktop + + - stage: compliance + dependsOn: ['windows'] + jobs: + - template: templates/compliance.yml + + - stage: nuget_and_json + dependsOn: ['windows','linux','macOS'] + jobs: + - template: templates/nuget.yml + + - template: templates/json.yml + + - stage: test_and_release_artifacts + dependsOn: ['prep'] + jobs: + - template: templates/testartifacts.yml + + - job: release_json + displayName: Create and Upload release.json + pool: + vmImage: 'windows-latest' + steps: + - template: templates/SetVersionVariables.yml + parameters: + ReleaseTagVar: $(ReleaseTagVar) + + - powershell: | + $metadata = Get-Content '$(Build.SourcesDirectory)/tools/metadata.json' -Raw | ConvertFrom-Json + $LTS = $metadata.LTSRelease + @{ ReleaseVersion = "$(Version)"; LTSRelease = $LTS } | ConvertTo-Json | Out-File "$(Build.StagingDirectory)\release.json" + Get-Content "$(Build.StagingDirectory)\release.json" + Write-Host "##vso[artifact.upload containerfolder=metadata;artifactname=metadata]$(Build.StagingDirectory)\release.json" + displayName: Create and upload release.json file to build artifact diff --git a/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml new file mode 100644 index 00000000000..0d188be03b9 --- /dev/null +++ b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml @@ -0,0 +1,108 @@ +parameters: + parentJob: '' + +jobs: + - job: MacFileSigningJob + displayName: macOS File signing + dependsOn: ${{ parameters.parentJob }} + condition: succeeded() + pool: + name: Package ES Standard Build + variables: + BuildConfiguration: release + BuildPlatform: any cpu + + steps: + + - template: shouldSign.yml + + - template: SetVersionVariables.yml + parameters: + ReleaseTagVar: $(ReleaseTagVar) + + - task: DownloadBuildArtifacts@0 + inputs: + artifactName: 'macosBinResults' + itemPattern: '**/*.zip' + downloadPath: '$(System.ArtifactsDirectory)\Symbols' + + - pwsh: | + Get-ChildItem "$(System.ArtifactsDirectory)\*" -Recurse + displayName: 'Capture Downloaded Artifacts' + # Diagnostics is not critical it passes every time it runs + continueOnError: true + + - pwsh: | + $zipPath = Get-Item '$(System.ArtifactsDirectory)\Symbols\macosBinResults\*symbol*.zip' + Write-Verbose -Verbose "Zip Path: $zipPath" + + $expandedFolder = $zipPath.BaseName + Write-Host "sending.. vso[task.setvariable variable=SymbolsFolder]$expandedFolder" + Write-Host "##vso[task.setvariable variable=SymbolsFolder]$expandedFolder" + + Expand-Archive -Path $zipPath -Destination "$(System.ArtifactsDirectory)\$expandedFolder" -Force + displayName: Expand symbols zip + + - pwsh: | + Get-ChildItem "$(System.ArtifactsDirectory)\*" -Recurse + displayName: 'Capture artifacts dir Binaries' + + - pwsh: | + Get-ChildItem "$(System.ArtifactsDirectory)\$(SymbolsFolder)" -Recurse -Include pwsh, *.dylib + displayName: 'Capture Expanded Binaries' + # Diagnostics is not critical it passes every time it runs + continueOnError: true + + - pwsh: | + $null = new-item -type directory -path "$(Build.StagingDirectory)\macos" + $zipFile = "$(Build.StagingDirectory)\macos\powershell-files-$(Version)-osx-x64.zip" + Get-ChildItem "$(System.ArtifactsDirectory)\$(SymbolsFolder)" -Recurse -Include pwsh, *.dylib | + Compress-Archive -Destination $zipFile + Write-Host $zipFile + displayName: 'Compress macOS binary files' + + - pwsh: | + $pkgFiles = "$(Build.StagingDirectory)\macos\powershell-files-$(Version)-osx-x64.zip", "$(Build.StagingDirectory)\macos\powershell-lts-$(Version)-osx-x64.zip" + tools/releaseBuild/generatePackgeSigning.ps1 -MacDeveloperFiles $pkgFiles -path "$(System.ArtifactsDirectory)\package.xml" + displayName: 'Generate macOS binary Signing Xml' + + - pwsh: | + Get-Content "$(System.ArtifactsDirectory)\package.xml" + displayName: 'Capture macOS signing xml' + # Diagnostics is not critical it passes every time it runs + continueOnError: true + + - task: PkgESCodeSign@10 + displayName: 'CodeSign $(System.ArtifactsDirectory)\package.xml' + env: + SYSTEM_ACCESSTOKEN: $(System.AccessToken) + inputs: + signConfigXml: '$(System.ArtifactsDirectory)\package.xml' + outPathRoot: '$(Build.StagingDirectory)\signedMacOSPackages' + binVersion: $(SigingVersion) + binVersionOverride: $(SigningVersionOverride) + condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + + - pwsh: | + $destination = "$(System.ArtifactsDirectory)\azureMacOs" + New-Item -Path $destination -Type Directory + $zipPath = Get-ChildItem "$(Build.StagingDirectory)\signedMacOSPackages\powershell-*.zip" -Recurse | select-object -expandproperty fullname + foreach ($z in $zipPath) { Expand-Archive -Path $z -DestinationPath $destination } + displayName: 'Extract and copy macOS artifacts for upload' + condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + + - template: upload-final-results.yml + parameters: + artifactPath: $(System.ArtifactsDirectory)\azureMacOs + artifactFilter: "*" + artifactName: signedMacOsBins + condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + + - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3 + displayName: 'Run Defender Scan' + + - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 + displayName: 'Component Detection' + inputs: + sourceScanPath: '$(Build.SourcesDirectory)' + snapshotForceEnabled: true diff --git a/tools/releaseBuild/azureDevOps/templates/mac-package-build.yml b/tools/releaseBuild/azureDevOps/templates/mac-package-build.yml new file mode 100644 index 00000000000..91ab400d8c3 --- /dev/null +++ b/tools/releaseBuild/azureDevOps/templates/mac-package-build.yml @@ -0,0 +1,110 @@ +parameters: + parentJob: '' + jobName: 'package_macOS' + +jobs: +- job: ${{ parameters.jobName }} + displayName: Package macOS + dependsOn: ${{ parameters.parentJob }} + condition: succeeded() + pool: Hosted Mac Internal + variables: + # Turn off Homebrew analytics + HOMEBREW_NO_ANALYTICS: 1 + runCodesignValidationInjection: false + steps: + - pwsh: | + # create folder + sudo mkdir /PowerShell + + # make the current user the owner + sudo chown $env:USER /PowerShell + displayName: 'Create /PowerShell' + + - pwsh: | + Write-Host "##vso[task.setvariable variable=PowerShellRoot]/PowerShell" + git clone $env:BUILD_REPOSITORY_LOCALPATH /PowerShell + displayName: Clone PowerShell Repo to /PowerShell + + - template: shouldSign.yml + + #- task: @ + # inputs: + # + # displayName: '' + - template: SetVersionVariables.yml + parameters: + ReleaseTagVar: $(ReleaseTagVar) + + + - task: DownloadBuildArtifacts@0 + inputs: + artifactName: 'macosBinResults' + itemPattern: '**/*.zip' + downloadPath: '$(System.ArtifactsDirectory)/Symbols' + + - task: DownloadBuildArtifacts@0 + inputs: + artifactName: 'signedMacOsBins' + itemPattern: '**/*' + downloadPath: '$(System.ArtifactsDirectory)/macOsBins' + + - pwsh: | + Get-ChildItem "$(System.ArtifactsDirectory)\*" -Recurse + displayName: 'Capture Downloaded Artifacts' + # Diagnostics is not critical it passes every time it runs + continueOnError: true + + - pwsh: | + $zipPath = Get-Item '$(System.ArtifactsDirectory)\Symbols\macosBinResults\*symbol*.zip' + Write-Verbose -Verbose "Zip Path: $zipPath" + + $expandedFolder = $zipPath.BaseName + Write-Host "sending.. vso[task.setvariable variable=SymbolsFolder]$expandedFolder" + Write-Host "##vso[task.setvariable variable=SymbolsFolder]$expandedFolder" + + Expand-Archive -Path $zipPath -Destination "$(System.ArtifactsDirectory)\$expandedFolder" -Force + displayName: Expand symbols zip + + - pwsh: | + Import-Module $(PowerShellRoot)/build.psm1 -Force + Import-Module $(PowerShellRoot)/tools/packaging -Force + $signedFilesPath = '$(System.ArtifactsDirectory)/macOsBins/signedMacOsBins/' + $BuildPath = '$(System.ArtifactsDirectory)\$(SymbolsFolder)' + + Update-PSSignedBuildFolder -BuildPath $BuildPath -SignedFilesPath $SignedFilesPath + displayName: Merge signed files with Build + condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + + - pwsh: | + Import-Module $(PowerShellRoot)/build.psm1 -Force + Import-Module $(PowerShellRoot)/tools/packaging -Force + + $destFolder = '$(System.ArtifactsDirectory)\signedZip' + $BuildPath = '$(System.ArtifactsDirectory)\$(SymbolsFolder)' + + $null = New-Item -ItemType Directory -Path $destFolder -Force + + $BuildPackagePath = New-PSBuildZip -BuildPath $BuildPath -DestinationFolder $destFolder + + Write-Verbose -Verbose "New-PSSignedBuildZip returned `$BuildPackagePath as: $BuildPackagePath" + Write-Host "##vso[artifact.upload containerfolder=results;artifactname=results]$BuildPackagePath" + + $vstsCommandString = "vso[task.setvariable variable=BuildPackagePath]$BuildPackagePath" + Write-Host ("sending " + $vstsCommandString) + Write-Host "##$vstsCommandString" + displayName: Compress signed files + + - pwsh: | + tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 -location $(PowerShellRoot) -BootStrap + displayName: 'Bootstrap VM' + + - pwsh: | + $(Build.SourcesDirectory)/tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 -ReleaseTag $(ReleaseTagVar) -Destination $(System.ArtifactsDirectory) -location $(PowerShellRoot) -ArtifactName macosPkgResults -BuildZip $(BuildPackagePath) -ExtraPackage "tar" + displayName: 'Package' + + - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 + displayName: 'Component Detection' + inputs: + sourceScanPath: '$(Build.SourcesDirectory)' + snapshotForceEnabled: true diff --git a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml index c693c78efa8..38189617a33 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml @@ -1,7 +1,10 @@ +parameters: + parentJob: '' + jobs: - job: MacPackageSigningJob displayName: macOS Package signing - dependsOn: build_macOS + dependsOn: ${{ parameters.parentJob }} condition: succeeded() pool: name: Package ES Standard Build @@ -18,26 +21,24 @@ jobs: ReleaseTagVar: $(ReleaseTagVar) - task: DownloadBuildArtifacts@0 - displayName: 'Download artifacts' inputs: - downloadType: specific - itemPattern: | - **/*.tar.gz - **/*.pkg + artifactName: 'macosPkgResults' + itemPattern: '**/*' + downloadPath: '$(System.ArtifactsDirectory)' - - powershell: | + - pwsh: | dir "$(System.ArtifactsDirectory)\*" -Recurse displayName: 'Capture Downloaded Artifacts' # Diagnostics is not critical it passes every time it runs continueOnError: true - - powershell: | + - pwsh: | $null = new-item -type directory -path "$(Build.StagingDirectory)\macos" $zipFile = "$(Build.StagingDirectory)\macos\powershell-$(Version)-osx-x64.zip" - Compress-Archive -Path "$(System.ArtifactsDirectory)\results\powershell-$(Version)-osx-x64.pkg" -Destination $zipFile + Compress-Archive -Path "$(System.ArtifactsDirectory)\macosPkgResults\powershell-$(Version)-osx-x64.pkg" -Destination $zipFile Write-Host $zipFile - $ltsPkgPath = "$(System.ArtifactsDirectory)\results\powershell-lts-$(Version)-osx-x64.pkg" + $ltsPkgPath = "$(System.ArtifactsDirectory)\macosPkgResults\powershell-lts-$(Version)-osx-x64.pkg" if(Test-Path $ltsPkgPath) { @@ -47,12 +48,12 @@ jobs: } displayName: 'Compress macOS Package' - - powershell: | + - pwsh: | $pkgFiles = "$(Build.StagingDirectory)\macos\powershell-$(Version)-osx-x64.zip", "$(Build.StagingDirectory)\macos\powershell-lts-$(Version)-osx-x64.zip" tools/releaseBuild/generatePackgeSigning.ps1 -MacDeveloperFiles $pkgFiles -path "$(System.ArtifactsDirectory)\package.xml" displayName: 'Generate macOS Package Signing Xml' - - powershell: | + - pwsh: | Get-Content "$(System.ArtifactsDirectory)\package.xml" displayName: 'Capture macOS signing xml' # Diagnostics is not critical it passes every time it runs @@ -71,10 +72,10 @@ jobs: - template: upload-final-results.yml parameters: - artifactPath: $(System.ArtifactsDirectory)\results + artifactPath: $(System.ArtifactsDirectory)\macosPkgResults artifactFilter: "*.tar.gz" - - powershell: | + - pwsh: | $destination = "$(System.ArtifactsDirectory)\azureMacOs" New-Item -Path $destination -Type Directory $zipPath = dir "$(Build.StagingDirectory)\signedMacOSPackages\powershell-*.zip" -Recurse | select-object -expandproperty fullname @@ -90,7 +91,7 @@ jobs: artifactFilter: "*.pkg" condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - powershell: | + - pwsh: | $null = new-item -type directory -path "$(Build.StagingDirectory)\macos-unsigned" Copy-Item -Path "$(System.ArtifactsDirectory)\results\powershell-$(Version)-osx-x64.pkg" -Destination "$(Build.StagingDirectory)\macos-unsigned" Copy-Item -Path "$(System.ArtifactsDirectory)\results\powershell-$(Version)-osx-x64.tar.gz" -Destination "$(Build.StagingDirectory)\macos-unsigned" diff --git a/tools/releaseBuild/azureDevOps/templates/mac.yml b/tools/releaseBuild/azureDevOps/templates/mac.yml index e586ab2829a..96cf9636d67 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac.yml @@ -1,13 +1,11 @@ parameters: jobName: 'build_macOS' - parentJob: '' jobs: - job: ${{ parameters.jobName }} displayName: Build macOS condition: succeeded() pool: Hosted Mac Internal - dependsOn: ${{ parameters.parentJob }} variables: # Turn off Homebrew analytics HOMEBREW_NO_ANALYTICS: 1 @@ -20,7 +18,7 @@ jobs: parameters: ReleaseTagVar: $(ReleaseTagVar) - - powershell: | + - pwsh: | # create folder sudo mkdir /PowerShell @@ -28,16 +26,16 @@ jobs: sudo chown $env:USER /PowerShell displayName: 'Create /PowerShell' - - powershell: | + - pwsh: | Write-Host "##vso[task.setvariable variable=PowerShellRoot]/PowerShell" git clone $env:BUILD_REPOSITORY_LOCALPATH /PowerShell displayName: Clone PowerShell Repo to /PowerShell - - powershell: | + - pwsh: | tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 -location $(PowerShellRoot) -BootStrap displayName: 'Bootstrap VM' - - powershell: | + - pwsh: | Import-Module $(Build.SourcesDirectory)/build.psm1 -Force New-NugetConfigFile -NugetFeedUrl $(AzDevOpsFeed) -UserName $(AzDevOpsFeedUserName) -ClearTextPAT $(AzDevOpsFeedPAT) -FeedName AzDevOpsFeed -Destination "$(PowerShellRoot)/src/Modules" @@ -47,11 +45,11 @@ jobs: } displayName: 'Add nuget.config for AzDevOps feed for PSGallery modules ' - - powershell: | + - pwsh: | $env:AZDEVOPSFEEDPAT = '$(AzDevOpsFeedPAT)' - $(Build.SourcesDirectory)/tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 -ReleaseTag $(ReleaseTagVar) -Destination $(System.ArtifactsDirectory) -ExtraPackage "tar" -location $(PowerShellRoot) -Build + $(Build.SourcesDirectory)/tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 -ReleaseTag $(ReleaseTagVar) -Destination $(System.ArtifactsDirectory) -Symbols -location $(PowerShellRoot) -Build -ArtifactName macosBinResults $env:AZDEVOPSFEEDPAT = $null - displayName: 'Build and Package' + displayName: 'Build' - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 displayName: 'Component Detection' diff --git a/tools/releaseBuild/azureDevOps/templates/upload-final-results.yml b/tools/releaseBuild/azureDevOps/templates/upload-final-results.yml index 287ca50ba5f..341a44d02b9 100644 --- a/tools/releaseBuild/azureDevOps/templates/upload-final-results.yml +++ b/tools/releaseBuild/azureDevOps/templates/upload-final-results.yml @@ -2,13 +2,14 @@ parameters: artifactPath: artifactFilter: '*' condition: succeeded() + artifactName: finalResults steps: - powershell: | Get-ChildItem -Path '${{ parameters.artifactPath }}' -File -filter '${{ parameters.artifactFilter }}' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName | ForEach-Object { - Write-Host "##vso[artifact.upload containerfolder=finalResults;artifactname=finalResults]$_" + Write-Host "##vso[artifact.upload containerfolder=${{ parameters.artifactName }};artifactname=${{ parameters.artifactName }}]$_" } - displayName: Upload Final Artifacts ${{ parameters.artifactFilter }} from ${{ parameters.artifactPath }} + displayName: Upload ${{ parameters.artifactName }} Artifacts ${{ parameters.artifactFilter }} from ${{ parameters.artifactPath }} condition: ${{ parameters.condition }} diff --git a/tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 b/tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 index be9ade24519..e2d6735bd4d 100644 --- a/tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 +++ b/tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 @@ -1,4 +1,4 @@ -# Copyright (c) Microsoft Corporation. All rights reserved. +# Copyright (c) Microsoft Corporation. # Licensed under the MIT License. # PowerShell Script to build and package PowerShell from specified form and branch @@ -10,14 +10,20 @@ param ( [string] $location = $env:BUILD_REPOSITORY_LOCALPATH, # Destination location of the package on docker host + [Parameter(Mandatory, ParameterSetName = 'packageSigned')] + [Parameter(Mandatory, ParameterSetName = 'IncludeSymbols')] [Parameter(Mandatory, ParameterSetName = 'Build')] [string] $destination = '/mnt', + [Parameter(Mandatory, ParameterSetName = 'packageSigned')] + [Parameter(Mandatory, ParameterSetName = 'IncludeSymbols')] [Parameter(Mandatory, ParameterSetName = 'Build')] [ValidatePattern("^v\d+\.\d+\.\d+(-\w+(\.\d+)?)?$")] [ValidateNotNullOrEmpty()] [string]$ReleaseTag, + [Parameter(ParameterSetName = 'packageSigned')] + [Parameter(ParameterSetName = 'IncludeSymbols')] [Parameter(ParameterSetName = 'Build')] [ValidateSet("zip", "tar")] [string[]]$ExtraPackage, @@ -25,13 +31,23 @@ param ( [Parameter(Mandatory, ParameterSetName = 'Bootstrap')] [switch] $BootStrap, + [Parameter(Mandatory, ParameterSetName = 'IncludeSymbols')] [Parameter(Mandatory, ParameterSetName = 'Build')] - [switch] $Build + [switch] $Build, + + [Parameter(Mandatory, ParameterSetName = 'IncludeSymbols')] + [switch] $Symbols, + + [Parameter(Mandatory, ParameterSetName = 'packageSigned')] + [ValidatePattern("-signed.zip$")] + [string]$BuildZip, + + [string]$ArtifactName = 'result' ) $repoRoot = $location -if ($Build.IsPresent) { +if ($Build.IsPresent -or $PSCmdlet.ParameterSetName -eq 'packageSigned') { $releaseTagParam = @{ } if ($ReleaseTag) { $releaseTagParam = @{ 'ReleaseTag' = $ReleaseTag } @@ -59,8 +75,11 @@ try { Start-PSBootstrap -Package } - if ($Build.IsPresent) { - Start-PSBuild -Configuration 'Release' -Crossgen -PSModuleRestore @releaseTagParam + if ($PSCmdlet.ParameterSetName -eq 'packageSigned') { + Write-Verbose "Expanding signed build $BuildZip ..." -Verbose + Expand-PSSignedBuild -BuildZip $BuildZip + + Remove-Item -Path $BuildZip Start-PSPackage @releaseTagParam switch ($ExtraPackage) { @@ -74,19 +93,42 @@ try { } } } + + if ($Build.IsPresent) { + if ($Symbols.IsPresent) { + Start-PSBuild -Configuration 'Release' -Crossgen -NoPSModuleRestore @releaseTagParam + $pspackageParams = @{} + $pspackageParams['Type']='zip' + $pspackageParams['IncludeSymbols']=$Symbols.IsPresent + Write-Verbose "Starting powershell packaging(zip)..." -Verbose + Start-PSPackage @pspackageParams @releaseTagParam + } else { + Start-PSBuild -Configuration 'Release' -Crossgen -PSModuleRestore @releaseTagParam + Start-PSPackage @releaseTagParam + switch ($ExtraPackage) { + "tar" { Start-PSPackage -Type tar @releaseTagParam } + } + + if ($LTS) { + Start-PSPackage @releaseTagParam -LTS + switch ($ExtraPackage) { + "tar" { Start-PSPackage -Type tar @releaseTagParam -LTS } + } + } + } + } } finally { Pop-Location } -if ($Build.IsPresent) { - $macPackages = Get-ChildItem "$repoRoot/powershell*" -Include *.pkg, *.tar.gz +if ($Build.IsPresent -or $PSCmdlet.ParameterSetName -eq 'packageSigned') { + $macPackages = Get-ChildItem "$repoRoot/powershell*" -Include *.pkg, *.tar.gz, *.zip foreach ($macPackage in $macPackages) { $filePath = $macPackage.FullName - $name = split-path -Leaf -Path $filePath $extension = (Split-Path -Extension -Path $filePath).Replace('.', '') Write-Verbose "Copying $filePath to $destination" -Verbose - Write-Host "##vso[artifact.upload containerfolder=results;artifactname=results]$filePath" + Write-Host "##vso[artifact.upload containerfolder=$ArtifactName;artifactname=$ArtifactName]$filePath" Write-Host "##vso[task.setvariable variable=Package-$extension]$filePath" - Copy-Item -Path $filePath -Destination $destination -force + Copy-Item -Path $filePath -Destination $destination -Force } } From 44e9b35e8d39329583daee786f1d7e0a7284864c Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Wed, 12 Aug 2020 15:08:54 -0700 Subject: [PATCH 07/27] Fix breaks in packages daily build due to macOS signing changes (#13421) # Conflicts: # tools/releaseBuild/azureDevOps/templates/windows-packaging.yml --- .../releaseBuild/azureDevOps/templates/mac-package-build.yml | 3 +++ .../azureDevOps/templates/mac-package-signing.yml | 4 ++-- .../releaseBuild/azureDevOps/templates/windows-packaging.yml | 4 ++-- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/mac-package-build.yml b/tools/releaseBuild/azureDevOps/templates/mac-package-build.yml index 91ab400d8c3..57208f26ce9 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-package-build.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-package-build.yml @@ -38,16 +38,19 @@ jobs: - task: DownloadBuildArtifacts@0 + displayName: Download macosBinResults inputs: artifactName: 'macosBinResults' itemPattern: '**/*.zip' downloadPath: '$(System.ArtifactsDirectory)/Symbols' - task: DownloadBuildArtifacts@0 + displayName: Download signedMacOsBins inputs: artifactName: 'signedMacOsBins' itemPattern: '**/*' downloadPath: '$(System.ArtifactsDirectory)/macOsBins' + condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - pwsh: | Get-ChildItem "$(System.ArtifactsDirectory)\*" -Recurse diff --git a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml index 38189617a33..db3a8ba3dbc 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml @@ -93,8 +93,8 @@ jobs: - pwsh: | $null = new-item -type directory -path "$(Build.StagingDirectory)\macos-unsigned" - Copy-Item -Path "$(System.ArtifactsDirectory)\results\powershell-$(Version)-osx-x64.pkg" -Destination "$(Build.StagingDirectory)\macos-unsigned" - Copy-Item -Path "$(System.ArtifactsDirectory)\results\powershell-$(Version)-osx-x64.tar.gz" -Destination "$(Build.StagingDirectory)\macos-unsigned" + Copy-Item -Path "$(System.ArtifactsDirectory)\macosPkgResults\powershell-$(Version)-osx-x64.pkg" -Destination "$(Build.StagingDirectory)\macos-unsigned" + Copy-Item -Path "$(System.ArtifactsDirectory)\macosPkgResults\powershell-$(Version)-osx-x64.tar.gz" -Destination "$(Build.StagingDirectory)\macos-unsigned" displayName: 'Create unsigned folder to upload' condition: and(succeeded(), ne(variables['SHOULD_SIGN'], 'true')) diff --git a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml index 457c26e6881..7c1a6adadd2 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml @@ -126,8 +126,8 @@ jobs: outPathRoot: '$(System.ArtifactsDirectory)\signed' condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - powershell: | - New-Item -ItemType Directory -Path $(System.ArtifactsDirectory)\signedZip -Force + - pwsh: | + New-Item -ItemType Directory -Path $(System.ArtifactsDirectory)\signed -Force displayName: 'Create empty signed folder' condition: and(succeeded(), ne(variables['SHOULD_SIGN'], 'true')) From d8a673125f95de5d55b6f3553792d90d3bb9fe77 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Wed, 16 Dec 2020 13:01:21 -0800 Subject: [PATCH 08/27] Move to ESRP signing for Windows files (#13988) Co-authored-by: Aditya Patwardhan # Conflicts: # tools/releaseBuild/azureDevOps/WindowsBuild.yml # tools/releaseBuild/azureDevOps/templates/windows-build.yml # Conflicts: # tools/releaseBuild/azureDevOps/WindowsBuild.yml # tools/releaseBuild/azureDevOps/templates/checkAzureContainer.yml # tools/releaseBuild/azureDevOps/templates/compliance.yml # tools/releaseBuild/azureDevOps/templates/json.yml # tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml # tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml # tools/releaseBuild/azureDevOps/templates/release-GlobalToolTest.yml # tools/releaseBuild/azureDevOps/templates/release-SDKTests.yml # tools/releaseBuild/azureDevOps/templates/release-UpdateDepsJson.yml # tools/releaseBuild/azureDevOps/templates/vpackReleaseJob.yml # tools/releaseBuild/azureDevOps/templates/windows-build.yml # tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml # tools/releaseBuild/azureDevOps/vpackRelease.yml --- .../releaseBuild/azureDevOps/WindowsBuild.yml | 464 ------------------ .../releaseBuild/azureDevOps/releaseBuild.yml | 22 +- .../templates/SetVersionVariables.yml | 22 +- .../templates/checkAzureContainer.yml | 5 + .../templates/cloneToOfficialPath.yml | 16 + .../azureDevOps/templates/compliance.yml | 5 + .../azureDevOps/templates/json.yml | 6 + .../templates/mac-file-signing.yml | 3 + .../templates/mac-package-build.yml | 6 +- .../templates/mac-package-signing.yml | 3 + .../azureDevOps/templates/mac.yml | 5 +- .../azureDevOps/templates/vpackReleaseJob.yml | 3 + .../azureDevOps/templates/windows-build.yml | 126 ----- .../templates/windows-hosted-build.yml | 19 +- .../templates/windows-package-signing.yml | 3 + .../templates/windows-packaging.yml | 125 +++-- .../releaseBuild/azureDevOps/vpackRelease.yml | 8 +- tools/releaseBuild/macOS/vsts.yml | 47 -- 18 files changed, 173 insertions(+), 715 deletions(-) delete mode 100644 tools/releaseBuild/azureDevOps/WindowsBuild.yml create mode 100644 tools/releaseBuild/azureDevOps/templates/cloneToOfficialPath.yml delete mode 100644 tools/releaseBuild/azureDevOps/templates/windows-build.yml delete mode 100644 tools/releaseBuild/macOS/vsts.yml diff --git a/tools/releaseBuild/azureDevOps/WindowsBuild.yml b/tools/releaseBuild/azureDevOps/WindowsBuild.yml deleted file mode 100644 index 61e3041e338..00000000000 --- a/tools/releaseBuild/azureDevOps/WindowsBuild.yml +++ /dev/null @@ -1,464 +0,0 @@ -jobs: - -- job: BuildJob - displayName: Build - condition: succeeded() - pool: - name: Package ES Standard Build - strategy: - matrix: - Build (x64,release): - BuildConfiguration: release - BuildPlatform: any cpu - Architecture: x64 - Build (x86,release): - BuildConfiguration: release - BuildPlatform: any cpu - Architecture: x86 - Build (arm,release): - BuildConfiguration: release - BuildPlatform: any cpu - Architecture: arm - Build (arm64,release): - BuildConfiguration: release - BuildPlatform: any cpu - Architecture: arm64 - Build (fxdependent,release): - BuildConfiguration: release - BuildPlatform: any cpu - Architecture: fxdependent - - steps: - - - checkout: self - clean: true - persistCredentials: true - - - task: PkgESSetupBuild@10 - displayName: 'Initialize build' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - useDfs: false - productName: PowerShellCore - branchVersion: true - disableWorkspace: true - disableBuildTools: true - disableNugetPack: true - condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual')) - - - powershell: | - tools/releaseBuild/setReleaseTag.ps1 -ReleaseTag $(ReleaseTag) - displayName: 'Set ReleaseTag Variable' - - - powershell: | - Write-Verbose -Verbose "$(Architecture)" - - if ('$(Architecture)' -eq 'fxdependent' -and '$(ReleaseTag)' -match '6.0.*') - { - $vstsCommandString = "vso[task.setvariable variable=SkipFxDependent]true" - } - else - { - $vstsCommandString = "vso[task.setvariable variable=SkipFxDependent]false" - } - - Write-Verbose -Message "$vstsCommandString " -Verbose - Write-Host -Object "##$vstsCommandString" - displayName: 'Skip FxDependent for PS v6.0.*' - - - powershell: | - Import-Module $(Build.SourcesDirectory)/build.psm1 -Force - New-NugetConfigFile -NugetFeedUrl $(AzDevOpsFeed) -UserName $(AzDevOpsFeedUserName) -ClearTextPAT $(AzDevOpsFeedPAT) -FeedName AzDevOpsFeed -Destination $(Build.SourcesDirectory)/src/Modules - - if(-not (Test-Path "$(Build.SourcesDirectory)/src/Modules/nuget.config")) - { - throw "nuget.config is not created" - } - displayName: 'Add nuget.config for AzDevOps feed for PSGallery modules ' - condition: ne(Variables['SkipFxDependent'], 'true') - - - powershell: | - $version = $env:ReleaseTag.Substring(1) - $vstsCommandString = "vso[task.setvariable variable=Version]$version" - Write-Host "sending " + $vstsCommandString - Write-Host "##$vstsCommandString" - displayName: 'Set Version Varibale' - condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true')) - - - powershell: | - docker container prune --force - docker container ls --all --format '{{ json .ID }}' | ConvertFrom-Json | ForEach-Object {docker container rm --force --volumes $_} - displayName: 'remove all containers [Port to PSRelease]' - continueOnError: true - condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true')) - - - powershell: | - docker image ls --format '{{ json .}}'|ConvertFrom-Json| ForEach-Object { - if($_.tag -eq '') - { - $formatString = 'yyyy-MM-dd HH:mm:ss zz00' - $createdAtString = $_.CreatedAt.substring(0,$_.CreatedAt.Length -4) - $createdAt = [DateTime]::ParseExact($createdAtString, $formatString,[System.Globalization.CultureInfo]::InvariantCulture) - if($createdAt -lt (Get-Date).adddays(-1)) - { - docker image rm $_.ID - } - } - } - exit 0 - displayName: 'remove old images [Port to PSRelease]' - continueOnError: true - condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true')) - - - powershell: | - Write-verbose "--docker info---" -verbose - docker info - Write-verbose "--docker image ls---" -verbose - docker image ls - Write-verbose "--docker container ls --all---" -verbose - docker container ls --all - Write-verbose "--git branch ---" -verbose - git branch - exit 0 - displayName: 'Get Environment' - condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true')) - - - powershell: | - tools/releaseBuild/vstsbuild.ps1 -ReleaseTag $(ReleaseTag) -Name win-$(Architecture)-symbols - displayName: 'Build Windows Universal - $(Architecture) Symbols zip' - continueOnError: true - condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true')) - - - powershell: | - if ("$env:Architecture" -eq 'fxdependent') - { - $(Build.SourcesDirectory)\tools\releaseBuild\updateSigning.ps1 -SkipPwshExe - } - else - { - $(Build.SourcesDirectory)\tools\releaseBuild\updateSigning.ps1 - } - displayName: 'Update Signing Xml' - condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true')) - - - powershell: | - $vstsCommandString = "vso[task.setvariable variable=Symbols]${env:Symbols_$(Architecture)}" - Write-Host "sending " + $vstsCommandString - Write-Host "##$vstsCommandString" - displayName: 'Get Symbols path [Update build.json]' - condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true')) - - - task: PkgESCodeSign@10 - displayName: 'CodeSign $(Architecture)' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(Build.SourcesDirectory)\tools\releaseBuild\signing.xml' - inPathRoot: '$(Symbols)' - outPathRoot: '$(Symbols)\signed' - binVersion: $(SigingVersion) - binVersionOverride: $(SigningVersionOverride) - condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual'), ne(variables['SkipFxDependent'], 'true')) - - - powershell: | - New-Item -ItemType Directory -Path $(Symbols)\signed -Force - displayName: 'Create empty signed folder' - condition: and(succeeded(), ne(variables['Build.Reason'], 'Manual'), ne(variables['SkipFxDependent'], 'true')) - - - powershell: | - tools/releaseBuild/vstsbuild.ps1 -ReleaseTag $(ReleaseTag) -Name win-$(Architecture)-package -BuildPath $(Symbols) -SignedFilesPath $(Symbols)\signed - displayName: 'Build Windows Universal - $(Architecture) Package' - continueOnError: true - condition: and(succeeded(), ne(variables['SkipFxDependent'], 'true')) - -- job: ComponentRegistrationJob - displayName: Component Registration - dependsOn: BuildJob - condition: succeeded() - pool: - name: Package ES Standard Build - strategy: - matrix: - release-anycpu: - BuildConfiguration: release - BuildPlatform: any cpu - - steps: - - - powershell: | - ./tools/releaseBuild/setReleaseTag.ps1 -ReleaseTag $(ReleaseTag) - displayName: 'Set ReleaseTag Variable' - - - powershell: | - $version = $env:ReleaseTag.Substring(1) - $vstsCommandString = "vso[task.setvariable variable=Version]$version" - Write-Host "sending " + $vstsCommandString - Write-Host "##$vstsCommandString" - displayName: 'Set Version Variable' - - - powershell: | - docker container prune --force - docker container ls --all --format '{{ json .ID }}' | ConvertFrom-Json | ForEach-Object {docker container rm --force --volumes $_} - displayName: 'Remove all containers' - continueOnError: true - - - powershell: | - docker image ls --format '{{ json .}}'|ConvertFrom-Json| ForEach-Object { - if($_.tag -eq '') - { - $formatString = 'yyyy-MM-dd HH:mm:ss zz00' - $createdAtString = $_.CreatedAt.substring(0,$_.CreatedAt.Length -4) - $createdAt = [DateTime]::ParseExact($createdAtString, $formatString,[System.Globalization.CultureInfo]::InvariantCulture) - if($createdAt -lt (Get-Date).adddays(-1)) - { - docker image rm $_.ID - } - } - } - exit 0 - displayName: 'Remove old images' - continueOnError: true - - - powershell: | - Write-verbose "--docker info---" -verbose - docker info - Write-verbose "--docker image ls---" -verbose - docker image ls - Write-verbose "--docker container ls --all---" -verbose - docker container ls --all - Write-verbose "--git branch ---" -verbose - git branch - exit 0 - displayName: 'Get Environment' - - - powershell: | - ./tools/releaseBuild/vstsbuild.ps1 -ReleaseTag $(ReleaseTag) -Name win-x64-component-registration - displayName: 'Build Windows Universal - Component Registration' - - - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 - displayName: 'Component Detection' - inputs: - sourceScanPath: '$(componentregistration)' - snapshotForceEnabled: true - -- job: PackageSigningJob - displayName: Package signing - dependsOn: BuildJob - condition: succeeded() - pool: - name: Package ES Standard Build - strategy: - matrix: - release-anycpu: - BuildConfiguration: release - BuildPlatform: any cpu - - steps: - - - powershell: | - tools/releaseBuild/setReleaseTag.ps1 -ReleaseTag $(ReleaseTag) - displayName: 'Set ReleaseTag Variable' - continueOnError: true - - - powershell: | - $version = $env:ReleaseTag.Substring(1) - $vstsCommandString = "vso[task.setvariable variable=Version]$version" - Write-Host "sending " + $vstsCommandString - Write-Host "##$vstsCommandString" - - $azureVersion = $env:ReleaseTag.ToLowerInvariant() -replace '\.', '-' - $vstsCommandString = "vso[task.setvariable variable=AzureVersion]$azureVersion" - Write-Host "sending " + $vstsCommandString - Write-Host "##$vstsCommandString" - - displayName: 'Set Version Variable' - continueOnError: true - - - task: DownloadBuildArtifacts@0 - displayName: 'Download artifacts' - inputs: - downloadType: specific - continueOnError: true - - - powershell: | - dir "$(System.ArtifactsDirectory)\*" -Recurse - displayName: 'dir artifacts directory' - continueOnError: true - - - powershell: | - Expand-Archive -Path "$(System.ArtifactsDirectory)\results\PowerShell-$(Version)-symbols-win-x86.zip" -Destination "$(Build.StagingDirectory)\symbols\x86" - displayName: 'Expand symbols zip - x86' - continueOnError: true - - - powershell: | - Expand-Archive -Path "$(System.ArtifactsDirectory)\results\PowerShell-$(Version)-symbols-win-x64.zip" -Destination "$(Build.StagingDirectory)\symbols\x64" - displayName: 'Expand symbols zip - x64' - continueOnError: true - - - powershell: | - Expand-Archive -Path "$(System.ArtifactsDirectory)\results\PowerShell-$(Version)-symbols-win-fxdependent.zip" -Destination "$(Build.StagingDirectory)\symbols\fxdependent" - displayName: 'Expand symbols zip - fxdependent' - continueOnError: true - - - powershell: | - tools/releaseBuild/generatePackgeSigning.ps1 -AuthenticodeFiles "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x64.msi","$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x86.msi" -path "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Generate Package Signing Xml' - - - powershell: | - Get-Content "$(System.ArtifactsDirectory)\package.xml" - displayName: 'print signing xml' - continueOnError: true - - - task: PkgESCodeSign@10 - displayName: 'CodeSign $(System.ArtifactsDirectory)\package.xml' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(System.ArtifactsDirectory)\package.xml' - outPathRoot: '$(Build.StagingDirectory)\signedPackages' - binVersion: $(SigingVersion) - binVersionOverride: $(SigningVersionOverride) - continueOnError: true - condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual')) - - - powershell: | - $packagePath = "$(Build.StagingDirectory)\signedPackages\PowerShell-$(Version)-win-x64.msi" - if(Test-Path -Path $packagePath) - { - Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath" - } - displayName: '[Create script] upload signed msi - x64' - continueOnError: true - condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual')) - - - task: AzureFileCopy@4 - displayName: 'upload signed msi to Azure - x64' - inputs: - SourcePath: '$(Build.StagingDirectory)\signedPackages\PowerShell-$(Version)-win-x64.msi' - azureSubscription: '$(AzureFileCopySubscription)' - Destination: AzureBlob - storage: '$(StorageAccount)' - ContainerName: '$(AzureVersion)' - continueOnError: true - condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual')) - - - powershell: | - $packagePath = "$(Build.StagingDirectory)\signedPackages\PowerShell-$(Version)-win-x86.msi" - if(Test-Path -Path $packagePath) - { - Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath" - } - displayName: '[create script] upload signed msi - x86' - continueOnError: true - - - task: AzureFileCopy@4 - displayName: 'upload signed msi to Azure - x86' - inputs: - SourcePath: '$(Build.StagingDirectory)\signedPackages\PowerShell-$(Version)-win-x86.msi' - azureSubscription: '$(AzureFileCopySubscription)' - Destination: AzureBlob - storage: '$(StorageAccount)' - ContainerName: '$(AzureVersion)' - continueOnError: true - condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual')) - - - powershell: | - $packagePath = "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x64.zip" - if(Test-Path -Path $packagePath) - { - Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath" - } - displayName: '[Create script] upload signed zip - x64' - continueOnError: true - - - task: AzureFileCopy@4 - displayName: 'upload signed zip to Azure - x64' - inputs: - SourcePath: '$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x64.zip' - azureSubscription: '$(AzureFileCopySubscription)' - Destination: AzureBlob - storage: '$(StorageAccount)' - ContainerName: '$(AzureVersion)' - continueOnError: true - condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual')) - - - powershell: | - $packagePath = "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x86.zip" - if(Test-Path -Path $packagePath) - { - Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath" - } - displayName: '[create script] upload signed zip - x86' - continueOnError: true - - - task: AzureFileCopy@4 - displayName: 'upload signed zip to Azure - x86' - inputs: - SourcePath: '$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x86.zip' - azureSubscription: '$(AzureFileCopySubscription)' - Destination: AzureBlob - storage: '$(StorageAccount)' - ContainerName: '$(AzureVersion)' - continueOnError: true - condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual')) - - - powershell: | - $packagePath = "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm32.zip" - if(Test-Path -Path $packagePath) - { - Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath" - } - displayName: '[create script] upload signed zip - arm' - continueOnError: true - - - task: AzureFileCopy@4 - displayName: 'upload signed zip to Azure - arm' - inputs: - SourcePath: '$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm32.zip' - azureSubscription: '$(AzureFileCopySubscription)' - Destination: AzureBlob - storage: '$(StorageAccount)' - ContainerName: '$(AzureVersion)' - continueOnError: true - condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual')) - - - powershell: | - $packagePath = "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm64.zip" - if(Test-Path -Path $packagePath) - { - Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath" - } - displayName: '[create script] upload signed zip - arm64' - continueOnError: true - - - task: AzureFileCopy@4 - displayName: 'upload signed zip to Azure - arm64' - inputs: - SourcePath: '$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm64.zip' - azureSubscription: '$(AzureFileCopySubscription)' - Destination: AzureBlob - storage: '$(StorageAccount)' - ContainerName: '$(AzureVersion)' - continueOnError: true - condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual')) - - - powershell: | - $packagePath = "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-fxdependent.zip" - if(Test-Path -Path $packagePath) - { - Write-Host "##vso[artifact.upload containerfolder=signedResults;artifactname=signedResults]$packagePath" - } - displayName: '[create script] upload signed zip - fxdependent' - continueOnError: true - - - task: AzureFileCopy@4 - displayName: 'upload signed zip to Azure - fxdependent' - inputs: - SourcePath: '$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-fxdependent.zip' - azureSubscription: '$(AzureFileCopySubscription)' - Destination: AzureBlob - storage: '$(StorageAccount)' - ContainerName: '$(AzureVersion)' - continueOnError: true - condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual')) diff --git a/tools/releaseBuild/azureDevOps/releaseBuild.yml b/tools/releaseBuild/azureDevOps/releaseBuild.yml index 2f38adc5367..48730050268 100644 --- a/tools/releaseBuild/azureDevOps/releaseBuild.yml +++ b/tools/releaseBuild/azureDevOps/releaseBuild.yml @@ -10,14 +10,18 @@ pr: - master - release* -variables: - DOTNET_CLI_TELEMETRY_OPTOUT: 1 - POWERSHELL_TELEMETRY_OPTOUT: 1 - -# Set AzDevOps Agent to clean the machine after the end of the build resources: -- repo: self - clean: true + repositories: + - repository: ComplianceRepo + type: github + endpoint: ComplianceGHRepo + name: PowerShell/compliance + +variables: + - name: DOTNET_CLI_TELEMETRY_OPTOUT + value: 1 + - name: POWERSHELL_TELEMETRY_OPTOUT + value: 1 stages: - stage: prep @@ -151,6 +155,10 @@ stages: pool: vmImage: 'windows-latest' steps: + - checkout: self + clean: true + fetchDepth: 1 + - template: templates/SetVersionVariables.yml parameters: ReleaseTagVar: $(ReleaseTagVar) diff --git a/tools/releaseBuild/azureDevOps/templates/SetVersionVariables.yml b/tools/releaseBuild/azureDevOps/templates/SetVersionVariables.yml index ec688f8a91c..0b8e5f42417 100644 --- a/tools/releaseBuild/azureDevOps/templates/SetVersionVariables.yml +++ b/tools/releaseBuild/azureDevOps/templates/SetVersionVariables.yml @@ -4,9 +4,29 @@ parameters: CreateJson: 'no' steps: +- powershell: | + $path = "./build.psm1" + + if(Test-Path -Path $path) + { + $vstsCommandString = "vso[task.setvariable variable=repoRoot]." + Write-Host ("sending " + $vstsCommandString) + Write-Host "##$vstsCommandString" + } + else{ + $path = "./PowerShell/build.psm1" + if(Test-Path -Path $path) + { + $vstsCommandString = "vso[task.setvariable variable=repoRoot]./PowerShell" + Write-Host ("sending " + $vstsCommandString) + Write-Host "##$vstsCommandString" + } + } + displayName: 'Set repo Root' + - powershell: | $createJson = ("${{ parameters.ReleaseTagVarName }}" -ne "no") - $releaseTag = tools/releaseBuild/setReleaseTag.ps1 -ReleaseTag ${{ parameters.ReleaseTagVar }} -Variable "${{ parameters.ReleaseTagVarName }}" -CreateJson:$createJson + $releaseTag = & "$env:REPOROOT/tools/releaseBuild/setReleaseTag.ps1" -ReleaseTag ${{ parameters.ReleaseTagVar }} -Variable "${{ parameters.ReleaseTagVarName }}" -CreateJson:$createJson $version = $releaseTag.Substring(1) $vstsCommandString = "vso[task.setvariable variable=Version]$version" Write-Host ("sending " + $vstsCommandString) diff --git a/tools/releaseBuild/azureDevOps/templates/checkAzureContainer.yml b/tools/releaseBuild/azureDevOps/templates/checkAzureContainer.yml index 1e8341c8258..6d2f88c254e 100644 --- a/tools/releaseBuild/azureDevOps/templates/checkAzureContainer.yml +++ b/tools/releaseBuild/azureDevOps/templates/checkAzureContainer.yml @@ -1,9 +1,14 @@ jobs: - job: DeleteBlob + variables: + runCodesignValidationInjection: false displayName: Delete blob is exists pool: vmImage: windows-latest steps: + - checkout: self + clean: true + - template: SetVersionVariables.yml parameters: ReleaseTagVar: $(ReleaseTagVar) diff --git a/tools/releaseBuild/azureDevOps/templates/cloneToOfficialPath.yml b/tools/releaseBuild/azureDevOps/templates/cloneToOfficialPath.yml new file mode 100644 index 00000000000..0a52f887671 --- /dev/null +++ b/tools/releaseBuild/azureDevOps/templates/cloneToOfficialPath.yml @@ -0,0 +1,16 @@ +steps: + - powershell: | + $dirSeparatorChar = [system.io.path]::DirectorySeparatorChar + $nativePath = "${dirSeparatorChar}PowerShell" + Write-Host "##vso[task.setvariable variable=PowerShellRoot]$nativePath" + + if ((Test-Path "$nativePath")) { + Remove-Item -Path "$nativePath" -Force -Recurse -Verbose -ErrorAction ignore + } + else { + Write-Verbose -Verbose -Message "No cleanup required." + } + + git clone --quiet $env:REPOROOT $nativePath + displayName: Clone PowerShell Repo to /PowerShell + errorActionPreference: silentlycontinue diff --git a/tools/releaseBuild/azureDevOps/templates/compliance.yml b/tools/releaseBuild/azureDevOps/templates/compliance.yml index 2b47711252f..64641fdd6c0 100644 --- a/tools/releaseBuild/azureDevOps/templates/compliance.yml +++ b/tools/releaseBuild/azureDevOps/templates/compliance.yml @@ -3,6 +3,8 @@ parameters: jobs: - job: compliance + variables: + runCodesignValidationInjection: false displayName: Compliance dependsOn: ${{ parameters.parentJobs }} @@ -13,6 +15,9 @@ jobs: timeoutInMinutes: 180 steps: + - checkout: self + clean: true + - template: SetVersionVariables.yml parameters: ReleaseTagVar: $(ReleaseTagVar) diff --git a/tools/releaseBuild/azureDevOps/templates/json.yml b/tools/releaseBuild/azureDevOps/templates/json.yml index f72f5518a17..44608f711f3 100644 --- a/tools/releaseBuild/azureDevOps/templates/json.yml +++ b/tools/releaseBuild/azureDevOps/templates/json.yml @@ -3,6 +3,8 @@ parameters: jobs: - job: json + variables: + runCodesignValidationInjection: false displayName: Create Json for Blob dependsOn: ${{ parameters.parentJobs }} @@ -15,6 +17,10 @@ jobs: # inputs: # # displayName: '' + - checkout: self + clean: true + fetchDepth: 1 + - template: SetVersionVariables.yml parameters: ReleaseTagVar: $(ReleaseTagVar) diff --git a/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml index 0d188be03b9..9b9eb3e1615 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml @@ -13,6 +13,9 @@ jobs: BuildPlatform: any cpu steps: + - checkout: self + clean: true + fetchDepth: 1 - template: shouldSign.yml diff --git a/tools/releaseBuild/azureDevOps/templates/mac-package-build.yml b/tools/releaseBuild/azureDevOps/templates/mac-package-build.yml index 57208f26ce9..8e89618c1c2 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-package-build.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-package-build.yml @@ -21,11 +21,6 @@ jobs: sudo chown $env:USER /PowerShell displayName: 'Create /PowerShell' - - pwsh: | - Write-Host "##vso[task.setvariable variable=PowerShellRoot]/PowerShell" - git clone $env:BUILD_REPOSITORY_LOCALPATH /PowerShell - displayName: Clone PowerShell Repo to /PowerShell - - template: shouldSign.yml #- task: @ @@ -36,6 +31,7 @@ jobs: parameters: ReleaseTagVar: $(ReleaseTagVar) + - template: cloneToOfficialPath.yml - task: DownloadBuildArtifacts@0 displayName: Download macosBinResults diff --git a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml index db3a8ba3dbc..c2b99b4173f 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml @@ -13,6 +13,9 @@ jobs: BuildPlatform: any cpu steps: + - checkout: self + clean: true + fetchDepth: 1 - template: shouldSign.yml diff --git a/tools/releaseBuild/azureDevOps/templates/mac.yml b/tools/releaseBuild/azureDevOps/templates/mac.yml index 96cf9636d67..564d3172082 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac.yml @@ -26,10 +26,7 @@ jobs: sudo chown $env:USER /PowerShell displayName: 'Create /PowerShell' - - pwsh: | - Write-Host "##vso[task.setvariable variable=PowerShellRoot]/PowerShell" - git clone $env:BUILD_REPOSITORY_LOCALPATH /PowerShell - displayName: Clone PowerShell Repo to /PowerShell + - template: cloneToOfficialPath.yml - pwsh: | tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 -location $(PowerShellRoot) -BootStrap diff --git a/tools/releaseBuild/azureDevOps/templates/vpackReleaseJob.yml b/tools/releaseBuild/azureDevOps/templates/vpackReleaseJob.yml index 97d3bea8d1d..2765bca5c67 100644 --- a/tools/releaseBuild/azureDevOps/templates/vpackReleaseJob.yml +++ b/tools/releaseBuild/azureDevOps/templates/vpackReleaseJob.yml @@ -7,6 +7,9 @@ jobs: condition: succeeded() pool: Package ES Standard Build steps: + - checkout: self + clean: true + fetchDepth: 1 - template: ./SetVersionVariables.yml parameters: diff --git a/tools/releaseBuild/azureDevOps/templates/windows-build.yml b/tools/releaseBuild/azureDevOps/templates/windows-build.yml deleted file mode 100644 index 8aab17585f3..00000000000 --- a/tools/releaseBuild/azureDevOps/templates/windows-build.yml +++ /dev/null @@ -1,126 +0,0 @@ -parameters: - BuildConfiguration: release - BuildPlatform: any cpu - Architecture: x64 - -jobs: -- job: build_windows_${{ parameters.Architecture }} - displayName: Build Windows - ${{ parameters.Architecture }} - condition: succeeded() - pool: - name: Package ES Standard Build - variables: - BuildConfiguration: ${{ parameters.BuildConfiguration }} - BuildPlatform: ${{ parameters.BuildPlatform }} - Architecture: ${{ parameters.Architecture }} - - steps: - - - checkout: self - clean: true - persistCredentials: true - - - template: shouldSign.yml - - template: SetVersionVariables.yml - parameters: - ReleaseTagVar: $(ReleaseTagVar) - - - task: PkgESSetupBuild@10 - displayName: 'Initialize build' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - useDfs: false - productName: PowerShellCore - branchVersion: true - disableWorkspace: true - disableBuildTools: true - disableNugetPack: true - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - - template: insert-nuget-config-azfeed.yml - - - powershell: | - docker container prune --force - docker container ls --all --format '{{ json .ID }}' | ConvertFrom-Json | ForEach-Object {docker container rm --force --volumes $_} - displayName: 'Remove all containers [Port to PSRelease]' - # Cleanup is not critical it passes every time it runs - continueOnError: true - - - powershell: | - docker image ls --format '{{ json .}}'|ConvertFrom-Json| ForEach-Object { - if($_.tag -eq '') - { - $formatString = 'yyyy-MM-dd HH:mm:ss zz00' - $createdAtString = $_.CreatedAt.substring(0,$_.CreatedAt.Length -4) - $createdAt = [DateTime]::ParseExact($createdAtString, $formatString,[System.Globalization.CultureInfo]::InvariantCulture) - if($createdAt -lt (Get-Date).adddays(-1)) - { - docker image rm $_.ID - } - } - } - exit 0 - displayName: 'Remove old images [Port to PSRelease]' - # Cleanup is not critical it passes every time it runs - continueOnError: true - - - powershell: | - Write-verbose "--docker info---" -verbose - docker info - Write-verbose "--docker image ls---" -verbose - docker image ls - Write-verbose "--docker container ls --all---" -verbose - docker container ls --all - exit 0 - displayName: 'Capture docker info' - # Diagnostics is not critical it passes every time it runs - continueOnError: true - - - powershell: | - tools/releaseBuild/vstsbuild.ps1 -ReleaseTag $(ReleaseTagVar) -Name win-$(Architecture)-symbols - displayName: 'Build Windows Universal - $(Architecture) Symbols zip' - - - powershell: | - if ("$env:Architecture" -like 'fxdependent*') - { - $(Build.SourcesDirectory)\tools\releaseBuild\updateSigning.ps1 -SkipPwshExe - } - else - { - $(Build.SourcesDirectory)\tools\releaseBuild\updateSigning.ps1 - } - displayName: 'Update Signing Xml' - - - powershell: | - $vstsCommandString = "vso[task.setvariable variable=Symbols]${env:Symbols_$(Architecture)}" - Write-Host "sending " + $vstsCommandString - Write-Host "##$vstsCommandString" - displayName: 'Get Symbols path [Update build.json]' - - - task: PkgESCodeSign@10 - displayName: 'CodeSign $(Architecture)' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(Build.SourcesDirectory)\tools\releaseBuild\signing.xml' - inPathRoot: '$(Symbols)' - outPathRoot: '$(Symbols)\signed' - binVersion: $(SigingVersion) - binVersionOverride: $(SigningVersionOverride) - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - - powershell: | - New-Item -ItemType Directory -Path $(Symbols)\signed -Force - displayName: 'Create empty signed folder' - condition: and(succeeded(), ne(variables['SHOULD_SIGN'], 'true')) - - - powershell: | - tools/releaseBuild/vstsbuild.ps1 -ReleaseTag $(ReleaseTagVar) -Name win-$(Architecture)-package -BuildPath $(Symbols) -SignedFilesPath $(Symbols)\signed - displayName: 'Build Windows Universal - $(Architecture) Package' - - - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 - displayName: 'Component Detection' - inputs: - sourceScanPath: '$(Build.SourcesDirectory)' - snapshotForceEnabled: true diff --git a/tools/releaseBuild/azureDevOps/templates/windows-hosted-build.yml b/tools/releaseBuild/azureDevOps/templates/windows-hosted-build.yml index 412a5d13f27..ea93a883d69 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-hosted-build.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-hosted-build.yml @@ -1,8 +1,13 @@ parameters: - BuildConfiguration: release - BuildPlatform: any cpu - Architecture: x64 - parentJob: '' + - name: BuildConfiguration + default: release + - name: BuildPlatform + default: any cpu + - name: Architecture + default: x64 + - name: parentJob + default: '' + jobs: - job: build_windows_${{ parameters.Architecture }} displayName: Build Windows - ${{ parameters.Architecture }} @@ -28,11 +33,7 @@ jobs: - template: insert-nuget-config-azfeed.yml - - powershell: | - Write-Host "##vso[task.setvariable variable=PowerShellRoot]/PowerShell" - $null = New-Item -ItemType Directory -Path /Powershell -Force - git clone $env:BUILD_REPOSITORY_LOCALPATH /PowerShell - displayName: Clone PowerShell Repo to /PowerShell + - template: cloneToOfficialPath.yml - powershell: | diff --git a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml index b4cdea15ccd..b753d44c2b5 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml @@ -14,6 +14,9 @@ jobs: BuildPlatform: any cpu steps: + - checkout: self + clean: true + fetchDepth: 1 - template: shouldSign.yml - template: SetVersionVariables.yml diff --git a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml index 7c1a6adadd2..544224f4765 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml @@ -1,8 +1,12 @@ parameters: - BuildConfiguration: release - BuildPlatform: any cpu - Architecture: x64 - parentJob: '' + - name: BuildConfiguration + default: release + - name: BuildPlatform + default: any cpu + - name: Architecture + default: x64 + - name: parentJob + default: '' jobs: - job: sign_windows_${{ parameters.Architecture }} @@ -12,10 +16,15 @@ jobs: pool: name: Package ES Standard Build variables: - BuildConfiguration: ${{ parameters.BuildConfiguration }} - BuildPlatform: ${{ parameters.BuildPlatform }} - Architecture: ${{ parameters.Architecture }} - DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1 + - name: BuildConfiguration + value: ${{ parameters.BuildConfiguration }} + - name: BuildPlatform + value: ${{ parameters.BuildPlatform }} + - name: Architecture + value: ${{ parameters.Architecture }} + - name: DOTNET_SKIP_FIRST_TIME_EXPERIENCE + value: 1 + - group: ESRP steps: @@ -23,6 +32,9 @@ jobs: clean: true persistCredentials: true + - checkout: ComplianceRepo + clean: true + - template: shouldSign.yml - template: SetVersionVariables.yml parameters: @@ -60,20 +72,7 @@ jobs: itemPattern: '**/*$(PkgFilter).zip' downloadPath: '$(System.ArtifactsDirectory)\Symbols' - - powershell: | - Write-Host "##vso[task.setvariable variable=PowerShellRoot]/PowerShell" - - if ((Test-Path "\PowerShell")) { - Remove-Item -Path "\PowerShell" -Force -Recurse -Verbose - } - else { - Write-Verbose -Verbose -Message "No cleanup required." - } - - git clone --quiet $env:BUILD_REPOSITORY_LOCALPATH '\PowerShell' - - displayName: Clone PowerShell Repo to /PowerShell - errorActionPreference: silentlycontinue + - template: cloneToOfficialPath.yml - powershell: | # cleanup previous install @@ -105,33 +104,65 @@ jobs: Expand-Archive -Path $zipPath -Destination "$(System.ArtifactsDirectory)\$expandedFolder" -Force displayName: Expand symbols zip - - powershell: | - if ("$env:Architecture" -like 'fxdependent*') - { - $(Build.SourcesDirectory)\tools\releaseBuild\updateSigning.ps1 -SkipPwshExe - } - else - { - $(Build.SourcesDirectory)\tools\releaseBuild\updateSigning.ps1 - } - displayName: 'Update Signing Xml' + - pwsh: | + $fullSymbolsFolder = "$(System.ArtifactsDirectory)\$($env:SYMBOLSFOLDER)" + + $filesToSignDirectory = "$(System.ArtifactsDirectory)\toBeSigned" + $null = New-Item -ItemType Directory -Path $filesToSignDirectory -Force + + $signedFilesDirectory = "$(System.ArtifactsDirectory)\signed" + $null = New-Item -ItemType Directory -Path $signedFilesDirectory -Force + + $itemsToCopyWithRecurse = @( + "$($fullSymbolsFolder)\*.ps1" + "$($fullSymbolsFolder)\Microsoft.PowerShell*.dll" + ) + + $itemsToCopy = @{ + "$($fullSymbolsFolder)\*.ps1" = "" + "$($fullSymbolsFolder)\Microsoft.Management.Infrastructure.CimCmdlets.dll" = "" + "$($fullSymbolsFolder)\Microsoft.WSMan.*.dll" = "" + "$($fullSymbolsFolder)\Modules\CimCmdlets\CimCmdlets.psd1" = "Modules\CimCmdlets" + "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\Diagnostics.format.ps1xml" = "Modules\Microsoft.PowerShell.Diagnostics" + "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\Event.format.ps1xml" = "Modules\Microsoft.PowerShell.Diagnostics" + "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\GetEvent.types.ps1xml" = "Modules\Microsoft.PowerShell.Diagnostics" + "$($fullSymbolsFolder)\Modules\Microsoft.WSMan.Management\Microsoft.WSMan.Management.psd1" = "Modules\Microsoft.WSMan.Management" + "$($fullSymbolsFolder)\Modules\Microsoft.WSMan.Management\WSMan.format.ps1xml" = "Modules\Microsoft.WSMan.Management" + "$($fullSymbolsFolder)\Modules\PSDiagnostics\PSDiagnostics.ps?1" = "Modules\PSDiagnostics" + "$($fullSymbolsFolder)\pwsh.dll" = "" + "$($fullSymbolsFolder)\System.Management.Automation.dll" = "" + } - - task: PkgESCodeSign@10 - displayName: 'CodeSign $(Architecture)' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(Build.SourcesDirectory)\tools\releaseBuild\signing.xml' - inPathRoot: '$(System.ArtifactsDirectory)\$(SymbolsFolder)' - outPathRoot: '$(System.ArtifactsDirectory)\signed' - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + if ("$env:Architecture" -notlike 'fxdependent*') + { + $itemsToCopy += @{"$($fullSymbolsFolder)\pwsh.exe" = ""} + } - - pwsh: | - New-Item -ItemType Directory -Path $(System.ArtifactsDirectory)\signed -Force - displayName: 'Create empty signed folder' - condition: and(succeeded(), ne(variables['SHOULD_SIGN'], 'true')) + Write-Verbose -verbose "recusively copying $($itemsToCopyWithRecurse | out-string) to $filesToSignDirectory" + Copy-Item -Path $itemsToCopyWithRecurse -Destination $filesToSignDirectory -Recurse -verbose - - powershell: | + foreach($pattern in $itemsToCopy.Keys) { + $destinationFolder = Join-Path $filesToSignDirectory -ChildPath $itemsToCopy.$pattern + $null = New-Item -ItemType Directory -Path $destinationFolder -Force + Write-Verbose -verbose "copying $pattern to $destinationFolder" + Copy-Item -Path $pattern -Destination $destinationFolder -Recurse -verbose + } + displayName: 'Prepare files to be signed' + + - template: EsrpSign.yml@ComplianceRepo + parameters: + buildOutputPath: $(System.ArtifactsDirectory)\toBeSigned + signOutputPath: $(System.ArtifactsDirectory)\signed + certificateId: "CP-230012" + pattern: | + **\*.dll + **\*.psd1 + **\*.psm1 + **\*.ps1xml + **\*.ps1 + useMinimatch: true + + - pwsh: | Import-Module $(PowerShellRoot)/build.psm1 -Force Import-Module $(PowerShellRoot)/tools/packaging -Force $signedFilesPath = '$(System.ArtifactsDirectory)\signed\' @@ -141,7 +172,7 @@ jobs: $dlls = Get-ChildItem $BuildPath\*.dll -Recurse $signatures = $dlls | Get-AuthenticodeSignature $missingSignatures = $signatures | Where-Object { $_.status -eq 'notsigned'}| select-object -ExpandProperty Path - tools/releaseBuild/generatePackgeSigning.ps1 -ThirdPartyFiles $missingSignatures -path "$(System.ArtifactsDirectory)\thirtdparty.xml" + & "${env:REPOROOT}/tools/releaseBuild/generatePackgeSigning.ps1" -ThirdPartyFiles $missingSignatures -path "$(System.ArtifactsDirectory)\thirtdparty.xml" displayName: Create ThirdParty Signing Xml condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) diff --git a/tools/releaseBuild/azureDevOps/vpackRelease.yml b/tools/releaseBuild/azureDevOps/vpackRelease.yml index 48b9e833844..1dc295fd181 100644 --- a/tools/releaseBuild/azureDevOps/vpackRelease.yml +++ b/tools/releaseBuild/azureDevOps/vpackRelease.yml @@ -17,11 +17,6 @@ variables: value: 1 - group: Azure Blob variable group -# Set AzDevOps Agent to clean the machine after the end of the build -resources: -- repo: self - clean: true - jobs: - job: rename displayName: Name the build @@ -29,6 +24,9 @@ jobs: pool: vmImage: 'windows-latest' steps: + - checkout: self + clean: true + fetchDepth: 1 - template: ./templates/SetVersionVariables.yml parameters: diff --git a/tools/releaseBuild/macOS/vsts.yml b/tools/releaseBuild/macOS/vsts.yml deleted file mode 100644 index b00fc9ae0b0..00000000000 --- a/tools/releaseBuild/macOS/vsts.yml +++ /dev/null @@ -1,47 +0,0 @@ -resources: -- repo: self - clean: true -queue: - name: Hosted Mac Internal -name: macOS_$(Build.SourceBranchName)_$(Build.BuildId) -steps: -#- task: @ -# inputs: -# -# displayName: '' -- task: ShellScript@2 - inputs: - scriptPath: 'tools/releaseBuild/setReleaseTag.sh' - args: '-ReleaseTag $(ReleaseTagVar) -Variable "ReleaseTagVar"' - displayName: 'Calculate Release Tag' -- task: ShellScript@2 - inputs: - scriptPath: 'tools/installpsh-osx.sh' - displayName: 'Install pwsh' -- task: ShellScript@2 - inputs: - scriptPath: 'tools/releaseBuild/macOS/createPowerShell.sh' - displayName: 'Create /PowerShell' -- powershell: | - Write-Host "##vso[task.setvariable variable=PowerShellRoot]/PowerShell" - git clone $env:BUILD_REPOSITORY_LOCALPATH /PowerShell - displayName: Clone PowerShell Repo to /PowerShell -- task: ShellScript@2 - inputs: - scriptPath: 'tools/releaseBuild/macOS/PowerShellPackageVsts.sh' - args: '-location $(PowerShellRoot) -BootStrap' - displayName: 'Bootstrap VM' -- powershell: | - Import-Module $(Build.SourcesDirectory)/build.psm1 -Force - New-NugetConfigFile -NugetFeedUrl $(AzDevOpsFeed) -UserName $(AzDevOpsFeedUserName) -ClearTextPAT $(AzDevOpsFeedPAT) -FeedName AzDevOpsFeed -Destination "$(PowerShellRoot)/src/Modules" - - if(-not (Test-Path "$(PowerShellRoot)/src/Modules/nuget.config")) - { - throw "nuget.config is not created" - } - displayName: 'Add nuget.config for AzDevOps feed for PSGallery modules ' -- powershell: | - $env:AZDEVOPSFEEDPAT = '$(AzDevOpsFeedPAT)' - $(Build.SourcesDirectory)/tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 -ReleaseTag $(ReleaseTagVar) -Destination $(System.ArtifactsDirectory) -ExtraPackage "tar" -location $(PowerShellRoot) -Build - $env:AZDEVOPSFEEDPAT = $null - displayName: 'Build and Package' From ab53bf178288ff5f06bebabdceeec6f7c6e2ad94 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Fri, 6 Nov 2020 13:55:39 -0800 Subject: [PATCH 09/27] Don't do a shallow checkout (#13992) # Conflicts: # tools/releaseBuild/azureDevOps/templates/checkAzureContainer.yml # tools/releaseBuild/azureDevOps/templates/release-GlobalToolTest.yml # tools/releaseBuild/azureDevOps/templates/release-SDKTests.yml # tools/releaseBuild/azureDevOps/templates/release-UpdateDepsJson.yml --- tools/releaseBuild/azureDevOps/releaseBuild.yml | 2 -- .../releaseBuild/azureDevOps/templates/checkAzureContainer.yml | 1 - tools/releaseBuild/azureDevOps/templates/json.yml | 1 - tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml | 1 - .../releaseBuild/azureDevOps/templates/mac-package-signing.yml | 1 - tools/releaseBuild/azureDevOps/templates/vpackReleaseJob.yml | 1 - .../azureDevOps/templates/windows-package-signing.yml | 1 - tools/releaseBuild/azureDevOps/vpackRelease.yml | 1 - 8 files changed, 9 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/releaseBuild.yml b/tools/releaseBuild/azureDevOps/releaseBuild.yml index 48730050268..6df2fe18f09 100644 --- a/tools/releaseBuild/azureDevOps/releaseBuild.yml +++ b/tools/releaseBuild/azureDevOps/releaseBuild.yml @@ -157,8 +157,6 @@ stages: steps: - checkout: self clean: true - fetchDepth: 1 - - template: templates/SetVersionVariables.yml parameters: ReleaseTagVar: $(ReleaseTagVar) diff --git a/tools/releaseBuild/azureDevOps/templates/checkAzureContainer.yml b/tools/releaseBuild/azureDevOps/templates/checkAzureContainer.yml index 6d2f88c254e..65a89a8a79e 100644 --- a/tools/releaseBuild/azureDevOps/templates/checkAzureContainer.yml +++ b/tools/releaseBuild/azureDevOps/templates/checkAzureContainer.yml @@ -8,7 +8,6 @@ jobs: steps: - checkout: self clean: true - - template: SetVersionVariables.yml parameters: ReleaseTagVar: $(ReleaseTagVar) diff --git a/tools/releaseBuild/azureDevOps/templates/json.yml b/tools/releaseBuild/azureDevOps/templates/json.yml index 44608f711f3..b9949200549 100644 --- a/tools/releaseBuild/azureDevOps/templates/json.yml +++ b/tools/releaseBuild/azureDevOps/templates/json.yml @@ -19,7 +19,6 @@ jobs: # displayName: '' - checkout: self clean: true - fetchDepth: 1 - template: SetVersionVariables.yml parameters: diff --git a/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml index 9b9eb3e1615..fddbe5f131d 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml @@ -15,7 +15,6 @@ jobs: steps: - checkout: self clean: true - fetchDepth: 1 - template: shouldSign.yml diff --git a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml index c2b99b4173f..05fe9114892 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml @@ -15,7 +15,6 @@ jobs: steps: - checkout: self clean: true - fetchDepth: 1 - template: shouldSign.yml diff --git a/tools/releaseBuild/azureDevOps/templates/vpackReleaseJob.yml b/tools/releaseBuild/azureDevOps/templates/vpackReleaseJob.yml index 2765bca5c67..c7ef645a878 100644 --- a/tools/releaseBuild/azureDevOps/templates/vpackReleaseJob.yml +++ b/tools/releaseBuild/azureDevOps/templates/vpackReleaseJob.yml @@ -9,7 +9,6 @@ jobs: steps: - checkout: self clean: true - fetchDepth: 1 - template: ./SetVersionVariables.yml parameters: diff --git a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml index b753d44c2b5..a2bfb771990 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml @@ -16,7 +16,6 @@ jobs: steps: - checkout: self clean: true - fetchDepth: 1 - template: shouldSign.yml - template: SetVersionVariables.yml diff --git a/tools/releaseBuild/azureDevOps/vpackRelease.yml b/tools/releaseBuild/azureDevOps/vpackRelease.yml index 1dc295fd181..70091eac8b5 100644 --- a/tools/releaseBuild/azureDevOps/vpackRelease.yml +++ b/tools/releaseBuild/azureDevOps/vpackRelease.yml @@ -26,7 +26,6 @@ jobs: steps: - checkout: self clean: true - fetchDepth: 1 - template: ./templates/SetVersionVariables.yml parameters: From 9e07586f09341bc7021a2b33872c1f29bd360bd5 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Wed, 11 Nov 2020 12:09:55 -0800 Subject: [PATCH 10/27] Migrate 3rd party signing to ESRP (#14010) Co-authored-by: Robert Holt # Conflicts: # tools/releaseBuild/azureDevOps/templates/windows-packaging.yml # Conflicts: # tools/releaseBuild/azureDevOps/templates/windows-packaging.yml --- .../templates/windows-packaging.yml | 60 ++++++++++--------- 1 file changed, 32 insertions(+), 28 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml index 544224f4765..a1c22b3ce5a 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml @@ -40,19 +40,6 @@ jobs: parameters: ReleaseTagVar: $(ReleaseTagVar) - - task: PkgESSetupBuild@10 - displayName: 'Initialize build' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - useDfs: false - productName: PowerShellCore - branchVersion: true - disableWorkspace: true - disableBuildTools: true - disableNugetPack: true - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - powershell: | $pkgFilter = if ( '$(Architecture)' -eq 'arm' ) { "arm32" @@ -114,8 +101,8 @@ jobs: $null = New-Item -ItemType Directory -Path $signedFilesDirectory -Force $itemsToCopyWithRecurse = @( - "$($fullSymbolsFolder)\*.ps1" - "$($fullSymbolsFolder)\Microsoft.PowerShell*.dll" + "$($fullSymbolsFolder)\*.ps1" + "$($fullSymbolsFolder)\Microsoft.PowerShell*.dll" ) $itemsToCopy = @{ @@ -126,6 +113,11 @@ jobs: "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\Diagnostics.format.ps1xml" = "Modules\Microsoft.PowerShell.Diagnostics" "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\Event.format.ps1xml" = "Modules\Microsoft.PowerShell.Diagnostics" "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\GetEvent.types.ps1xml" = "Modules\Microsoft.PowerShell.Diagnostics" + "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\Microsoft.PowerShell.Diagnostics.psd1" = "Modules\Microsoft.PowerShell.Diagnostics" + "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Host\Microsoft.PowerShell.Host.psd1" = "Modules\Microsoft.PowerShell.Host" + "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1" = "Modules\Microsoft.PowerShell.Management" + "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1" = "Modules\Microsoft.PowerShell.Security" + "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1" = "Modules\Microsoft.PowerShell.Utility" "$($fullSymbolsFolder)\Modules\Microsoft.WSMan.Management\Microsoft.WSMan.Management.psd1" = "Modules\Microsoft.WSMan.Management" "$($fullSymbolsFolder)\Modules\Microsoft.WSMan.Management\WSMan.format.ps1xml" = "Modules\Microsoft.WSMan.Management" "$($fullSymbolsFolder)\Modules\PSDiagnostics\PSDiagnostics.ps?1" = "Modules\PSDiagnostics" @@ -160,6 +152,7 @@ jobs: **\*.psm1 **\*.ps1xml **\*.ps1 + **\*.exe useMinimatch: true - pwsh: | @@ -172,29 +165,40 @@ jobs: $dlls = Get-ChildItem $BuildPath\*.dll -Recurse $signatures = $dlls | Get-AuthenticodeSignature $missingSignatures = $signatures | Where-Object { $_.status -eq 'notsigned'}| select-object -ExpandProperty Path - & "${env:REPOROOT}/tools/releaseBuild/generatePackgeSigning.ps1" -ThirdPartyFiles $missingSignatures -path "$(System.ArtifactsDirectory)\thirtdparty.xml" - displayName: Create ThirdParty Signing Xml - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - task: PkgESCodeSign@10 - displayName: 'CodeSign ThirdParty $(Architecture)' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(System.ArtifactsDirectory)\thirtdparty.xml' - inPathRoot: '$(System.ArtifactsDirectory)\$(SymbolsFolder)' - outPathRoot: '$(System.ArtifactsDirectory)\signedThirdParty' + Write-Verbose -verbose "to be signed:`r`n $($missingSignatures | Out-String)" + + $filesToSignDirectory = "$(System.ArtifactsDirectory)\thirdPartyToBeSigned" + $null = New-Item -ItemType Directory -Path $filesToSignDirectory -Force + + $signedFilesDirectory = "$(System.ArtifactsDirectory)\thirdPartySigned" + $null = New-Item -ItemType Directory -Path $signedFilesDirectory -Force + + $missingSignatures | ForEach-Object { + Copy-Item -Path $_ -Destination $filesToSignDirectory + } + + displayName: Create ThirdParty Signing Folder condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + - template: EsrpSign.yml@ComplianceRepo + parameters: + buildOutputPath: $(System.ArtifactsDirectory)\thirdPartyToBeSigned + signOutputPath: $(System.ArtifactsDirectory)\thirdPartySigned + certificateId: "CP-231522" + pattern: | + **\*.dll + useMinimatch: true + - powershell: | - Get-ChildItem '$(System.ArtifactsDirectory)\signedThirdParty\*' + Get-ChildItem '$(System.ArtifactsDirectory)\thirdPartySigned\*' displayName: Captrue ThirdParty Signed files condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - powershell: | Import-Module $(PowerShellRoot)/build.psm1 -Force Import-Module $(PowerShellRoot)/tools/packaging -Force - $signedFilesPath = '$(System.ArtifactsDirectory)\signedThirdParty\' + $signedFilesPath = '$(System.ArtifactsDirectory)\thirdPartySigned' $BuildPath = '$(System.ArtifactsDirectory)\$(SymbolsFolder)' Update-PSSignedBuildFolder -BuildPath $BuildPath -SignedFilesPath $SignedFilesPath From c951c6eae7799879bc2f06f4e56a3fc677dc3e81 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Mon, 23 Nov 2020 14:50:00 -0800 Subject: [PATCH 11/27] Move Linux to Esrp signing (#14210) # Conflicts: # tools/releaseBuild/azureDevOps/templates/linux.yml # Conflicts: # tools/releaseBuild/azureDevOps/templates/linux.yml --- .../templates/insert-nuget-config-azfeed.yml | 6 +- .../azureDevOps/templates/linux.yml | 78 +++++++++++-------- 2 files changed, 50 insertions(+), 34 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml b/tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml index ae697e70e33..d768a876372 100644 --- a/tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml +++ b/tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml @@ -1,9 +1,9 @@ steps: - powershell: | - Import-Module $(Build.SourcesDirectory)/build.psm1 -Force - New-NugetConfigFile -NugetFeedUrl $(AzDevOpsFeed) -UserName $(AzDevOpsFeedUserName) -ClearTextPAT $(AzDevOpsFeedPAT) -FeedName AzDevOpsFeed -Destination $(Build.SourcesDirectory)/src/Modules + Import-Module $env:REPOROOT/build.psm1 -Force + New-NugetConfigFile -NugetFeedUrl $(AzDevOpsFeed) -UserName $(AzDevOpsFeedUserName) -ClearTextPAT $(AzDevOpsFeedPAT) -FeedName AzDevOpsFeed -Destination $env:REPOROOT/src/Modules - if(-not (Test-Path "$(Build.SourcesDirectory)/src/Modules/nuget.config")) + if(-not (Test-Path "$env:REPOROOT/src/Modules/nuget.config")) { throw "nuget.config is not created" } diff --git a/tools/releaseBuild/azureDevOps/templates/linux.yml b/tools/releaseBuild/azureDevOps/templates/linux.yml index af8d42c7c0b..5263217404e 100644 --- a/tools/releaseBuild/azureDevOps/templates/linux.yml +++ b/tools/releaseBuild/azureDevOps/templates/linux.yml @@ -7,11 +7,19 @@ jobs: - job: build_${{ parameters.buildName }} displayName: Build ${{ parameters.buildName }} condition: succeeded() - pool: Hosted Ubuntu 1604 + pool: + vmImage: ubuntu-16.04 dependsOn: ${{ parameters.parentJob }} variables: - build: ${{ parameters.buildName }} + - name: runCodesignValidationInjection + value: false + - name: build + value: ${{ parameters.buildName }} + - group: ESRP + steps: + - checkout: self + clean: true - template: SetVersionVariables.yml parameters: @@ -34,13 +42,13 @@ jobs: - powershell: | - import-module ./build.psm1 + import-module "$env:REPOROOT/build.psm1" Sync-PSTags -AddRemoteIfMissing displayName: SyncTags condition: and(succeeded(), ne(variables['SkipBuild'], 'true')) - powershell: | - tools/releaseBuild/vstsbuild.ps1 -ReleaseTag $(ReleaseTagVar) -Name '$(build)' + & "$env:REPOROOT/tools/releaseBuild/vstsbuild.ps1" -ReleaseTag $(ReleaseTagVar) -Name '$(build)' displayName: 'Build and package' condition: and(succeeded(), ne(variables['SkipBuild'], 'true')) @@ -49,10 +57,19 @@ jobs: displayName: ${{ parameters.uploadDisplayName }} ${{ parameters.buildName }} dependsOn: build_${{ parameters.buildName }} condition: succeeded() - pool: Package ES Standard Build + pool: + vmImage: windows-latest variables: - buildName: ${{ parameters.buildName }} + - name: buildName + value: ${{ parameters.buildName }} + - group: ESRP + steps: + - checkout: self + clean: true + + - checkout: ComplianceRepo + clean: true - template: shouldSign.yml @@ -83,32 +100,29 @@ jobs: downloadPath: '$(System.ArtifactsDirectory)\rpm' condition: and(eq(variables['buildName'], 'RPM'),succeeded()) - - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3 - displayName: 'Run Defender Scan' - - - powershell: | - $authenticodefiles = @() - Get-ChildItem -Path '$(System.ArtifactsDirectory)\rpm\*.rpm' -recurse | ForEach-Object { $authenticodefiles += $_.FullName} - tools/releaseBuild/generatePackgeSigning.ps1 -LinuxFiles $authenticodeFiles -path "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Generate RPM Signing Xml' - condition: and(and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM')) - - - powershell: | - Get-Content "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Capture RPM signing xml' - condition: and(and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM')) - - - task: PkgESCodeSign@10 - displayName: 'CodeSign RPM $(System.ArtifactsDirectory)\package.xml' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) + - task: SFP.build-tasks.custom-build-task-2.EsrpMalwareScanning@1 + displayName: 'Malware Scanning' inputs: - signConfigXml: '$(System.ArtifactsDirectory)\package.xml' - outPathRoot: '$(Build.StagingDirectory)\signedPackages' - binVersion: $(SigingVersion) - binVersionOverride: $(SigningVersionOverride) - condition: and(and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM')) - + ConnectedServiceName: pwshEsrpScanning + FolderPath: $(System.ArtifactsDirectory) + Pattern: | + **\*.rpm + **\*.deb + **\*.tar.gz + UseMinimatch: true + SessionTimeout: 30 + + - ${{ if eq(variables['buildName'], 'RPM') }}: + - template: EsrpSign.yml@ComplianceRepo + parameters: + buildOutputPath: $(System.ArtifactsDirectory)\rpm + signOutputPath: $(Build.StagingDirectory)\signedPackages + certificateId: "CP-450779-Pgp" + pattern: | + **\*.rpm + useMinimatch: true + + # requires windows - task: AzureFileCopy@4 displayName: 'Upload to Azure - DEB and tar.gz' inputs: @@ -122,6 +136,7 @@ jobs: parameters: artifactPath: $(System.ArtifactsDirectory)\finished\release + # requires windows - task: AzureFileCopy@4 displayName: 'Upload to Azure - RPM - Unsigned' inputs: @@ -132,6 +147,7 @@ jobs: ContainerName: '$(AzureVersion)' condition: and(and(succeeded(), ne(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM')) + # requires windows - task: AzureFileCopy@4 displayName: 'Upload to Azure - RPM - Signed' inputs: From ce47a531c4a4108d6082758eb2bd54957f52ca00 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Fri, 13 Nov 2020 14:16:06 -0800 Subject: [PATCH 12/27] Move windows package signing to use ESRP (#14060) # Conflicts: # tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml # Conflicts: # tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml --- .../releaseBuild/azureDevOps/releaseBuild.yml | 1 + .../templates/windows-package-signing.yml | 62 ++++++++----------- 2 files changed, 28 insertions(+), 35 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/releaseBuild.yml b/tools/releaseBuild/azureDevOps/releaseBuild.yml index 6df2fe18f09..5e87ff58ec7 100644 --- a/tools/releaseBuild/azureDevOps/releaseBuild.yml +++ b/tools/releaseBuild/azureDevOps/releaseBuild.yml @@ -16,6 +16,7 @@ resources: type: github endpoint: ComplianceGHRepo name: PowerShell/compliance + ref: master variables: - name: DOTNET_CLI_TELEMETRY_OPTOUT diff --git a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml index a2bfb771990..dae25005e3c 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml @@ -8,15 +8,19 @@ jobs: ${{ parameters.parentJobs }} condition: succeeded() pool: - name: Package ES Standard Build + vmImage: windows-latest variables: - BuildConfiguration: release - BuildPlatform: any cpu + - name: DOTNET_SKIP_FIRST_TIME_EXPERIENCE + value: 1 + - group: ESRP steps: - checkout: self clean: true + - checkout: ComplianceRepo + clean: true + - template: shouldSign.yml - template: SetVersionVariables.yml parameters: @@ -36,36 +40,15 @@ jobs: # Diagnostics is not critical it passes every time it runs continueOnError: true - - powershell: | - $authenticodefiles = @( - "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x64.msi" - "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x86.msi" - ) - - $msixFiles = @( - "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x86.msix" - "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x64.msix" - "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm32.msix" - "$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm64.msix" - ) - - tools/releaseBuild/generatePackgeSigning.ps1 -AuthenticodeFiles $authenticodeFiles -path "$(System.ArtifactsDirectory)\package.xml" -MsixCertType $env:MSIX_TYPE -MsixFiles $msixFiles - displayName: 'Generate Package Signing Xml' - - - powershell: | - Get-Content "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Capture signing xml' - - - task: PkgESCodeSign@10 - displayName: 'CodeSign $(System.ArtifactsDirectory)\package.xml' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(System.ArtifactsDirectory)\package.xml' - outPathRoot: '$(Build.StagingDirectory)\signedPackages' - binVersion: $(SigingVersion) - binVersionOverride: $(SigningVersionOverride) - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + - template: EsrpSign.yml@ComplianceRepo + parameters: + buildOutputPath: $(System.ArtifactsDirectory)\signed + signOutputPath: $(Build.StagingDirectory)\signedPackages + certificateId: "CP-230012" + pattern: | + **\*.msi + **\*.msix + useMinimatch: true - powershell: | new-item -itemtype Directory -path '$(Build.StagingDirectory)\signedPackages' @@ -109,8 +92,17 @@ jobs: msi: no msix: no - - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3 - displayName: 'Run Defender Scan' + - task: SFP.build-tasks.custom-build-task-2.EsrpMalwareScanning@1 + displayName: 'Malware Scanning' + inputs: + ConnectedServiceName: pwshEsrpScanning + FolderPath: '$(Build.StagingDirectory)' + Pattern: | + **\*.msix + **\*.msi + **\*.zip + UseMinimatch: true + SessionTimeout: 30 - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 displayName: 'Component Detection' From 61c54ed80f97334c800352ae06752730fffd05ec Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Mon, 7 Dec 2020 12:11:54 -0800 Subject: [PATCH 13/27] Move macOS and nuget to esrp signing (#14324) # Conflicts: # tools/releaseBuild/azureDevOps/templates/nuget.yml --- .../azureDevOps/templates/linux.yml | 21 +++-- .../templates/mac-file-signing.yml | 42 ++++------ .../templates/mac-package-signing.yml | 38 +++------ .../azureDevOps/templates/nuget.yml | 81 +++++++++++-------- .../templates/windows-package-signing.yml | 18 ++--- 5 files changed, 93 insertions(+), 107 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/linux.yml b/tools/releaseBuild/azureDevOps/templates/linux.yml index 5263217404e..53e9b4f1924 100644 --- a/tools/releaseBuild/azureDevOps/templates/linux.yml +++ b/tools/releaseBuild/azureDevOps/templates/linux.yml @@ -21,6 +21,9 @@ jobs: - checkout: self clean: true + - checkout: ComplianceRepo + clean: true + - template: SetVersionVariables.yml parameters: ReleaseTagVar: $(ReleaseTagVar) @@ -100,17 +103,13 @@ jobs: downloadPath: '$(System.ArtifactsDirectory)\rpm' condition: and(eq(variables['buildName'], 'RPM'),succeeded()) - - task: SFP.build-tasks.custom-build-task-2.EsrpMalwareScanning@1 - displayName: 'Malware Scanning' - inputs: - ConnectedServiceName: pwshEsrpScanning - FolderPath: $(System.ArtifactsDirectory) - Pattern: | - **\*.rpm - **\*.deb - **\*.tar.gz - UseMinimatch: true - SessionTimeout: 30 + - template: EsrpScan.yml@ComplianceRepo + parameters: + scanPath: $(System.ArtifactsDirectory) + pattern: | + **\*.rpm + **\*.deb + **\*.tar.gz - ${{ if eq(variables['buildName'], 'RPM') }}: - template: EsrpSign.yml@ComplianceRepo diff --git a/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml index fddbe5f131d..46178671496 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml @@ -9,13 +9,15 @@ jobs: pool: name: Package ES Standard Build variables: - BuildConfiguration: release - BuildPlatform: any cpu + - group: ESRP steps: - checkout: self clean: true + - checkout: ComplianceRepo + clean: true + - template: shouldSign.yml - template: SetVersionVariables.yml @@ -63,27 +65,14 @@ jobs: Write-Host $zipFile displayName: 'Compress macOS binary files' - - pwsh: | - $pkgFiles = "$(Build.StagingDirectory)\macos\powershell-files-$(Version)-osx-x64.zip", "$(Build.StagingDirectory)\macos\powershell-lts-$(Version)-osx-x64.zip" - tools/releaseBuild/generatePackgeSigning.ps1 -MacDeveloperFiles $pkgFiles -path "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Generate macOS binary Signing Xml' - - - pwsh: | - Get-Content "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Capture macOS signing xml' - # Diagnostics is not critical it passes every time it runs - continueOnError: true - - - task: PkgESCodeSign@10 - displayName: 'CodeSign $(System.ArtifactsDirectory)\package.xml' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(System.ArtifactsDirectory)\package.xml' - outPathRoot: '$(Build.StagingDirectory)\signedMacOSPackages' - binVersion: $(SigingVersion) - binVersionOverride: $(SigningVersionOverride) - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + - template: EsrpSign.yml@ComplianceRepo + parameters: + buildOutputPath: $(Build.StagingDirectory)\macos + signOutputPath: $(Build.StagingDirectory)\signedMacOSPackages + certificateId: "CP-401337-Apple" + pattern: | + **\*.zip + useMinimatch: true - pwsh: | $destination = "$(System.ArtifactsDirectory)\azureMacOs" @@ -100,8 +89,11 @@ jobs: artifactName: signedMacOsBins condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3 - displayName: 'Run Defender Scan' + - template: EsrpScan.yml@ComplianceRepo + parameters: + scanPath: $(System.ArtifactsDirectory)\azureMacOs + pattern: | + **\* - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 displayName: 'Component Detection' diff --git a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml index 05fe9114892..3e3d69dcbe5 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml @@ -9,13 +9,15 @@ jobs: pool: name: Package ES Standard Build variables: - BuildConfiguration: release - BuildPlatform: any cpu + - group: ESRP steps: - checkout: self clean: true + - checkout: ComplianceRepo + clean: true + - template: shouldSign.yml - template: SetVersionVariables.yml @@ -50,27 +52,14 @@ jobs: } displayName: 'Compress macOS Package' - - pwsh: | - $pkgFiles = "$(Build.StagingDirectory)\macos\powershell-$(Version)-osx-x64.zip", "$(Build.StagingDirectory)\macos\powershell-lts-$(Version)-osx-x64.zip" - tools/releaseBuild/generatePackgeSigning.ps1 -MacDeveloperFiles $pkgFiles -path "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Generate macOS Package Signing Xml' - - - pwsh: | - Get-Content "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Capture macOS signing xml' - # Diagnostics is not critical it passes every time it runs - continueOnError: true - - - task: PkgESCodeSign@10 - displayName: 'CodeSign $(System.ArtifactsDirectory)\package.xml' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(System.ArtifactsDirectory)\package.xml' - outPathRoot: '$(Build.StagingDirectory)\signedMacOSPackages' - binVersion: $(SigingVersion) - binVersionOverride: $(SigningVersionOverride) - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + - template: EsrpSign.yml@ComplianceRepo + parameters: + buildOutputPath: $(Build.StagingDirectory)\macos + signOutputPath: $(Build.StagingDirectory)\signedMacOSPackages + certificateId: "CP-401337-Apple" + pattern: | + **\*.zip + useMinimatch: true - template: upload-final-results.yml parameters: @@ -120,9 +109,6 @@ jobs: ContainerName: '$(AzureVersion)' condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3 - displayName: 'Run Defender Scan' - - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 displayName: 'Component Detection' inputs: diff --git a/tools/releaseBuild/azureDevOps/templates/nuget.yml b/tools/releaseBuild/azureDevOps/templates/nuget.yml index ca1de4f8d0f..34709945891 100644 --- a/tools/releaseBuild/azureDevOps/templates/nuget.yml +++ b/tools/releaseBuild/azureDevOps/templates/nuget.yml @@ -12,16 +12,35 @@ jobs: timeoutInMinutes: 90 variables: - GenAPIToolPath: '$(System.ArtifactsDirectory)/GenAPI' - PackagePath: '$(System.ArtifactsDirectory)/UnifiedPackagePath' - winFxdPath: '$(System.ArtifactsDirectory)/winFxd' - winFxdWinDesktopPath: '$(System.ArtifactsDirectory)/winFxdWinDesktop' - linuxFxdPath: '$(System.ArtifactsDirectory)/linuxFxd' + - name: runCodesignValidationInjection + value: false + - name: build + value: ${{ parameters.buildName }} + - group: ESRP + - name: GenAPIToolPath + value: '$(System.ArtifactsDirectory)/GenAPI' + - name: PackagePath + value: '$(System.ArtifactsDirectory)/UnifiedPackagePath' + - name: winFxdPath + value: '$(System.ArtifactsDirectory)/winFxd' + - name: winFxdWinDesktopPath + value: '$(System.ArtifactsDirectory)/winFxdWinDesktop' + - name: linuxFxdPath + value: '$(System.ArtifactsDirectory)/linuxFxd' steps: + - checkout: self + clean: true + + - checkout: ComplianceRepo + clean: true + + - template: SetVersionVariables.yml + parameters: + ReleaseTagVar: $(ReleaseTagVar) - powershell: | - $content = Get-Content "$(Build.SourcesDirectory)/global.json" -Raw | ConvertFrom-Json + $content = Get-Content "$env:REPOROOT/global.json" -Raw | ConvertFrom-Json $vstsCommandString = "vso[task.setvariable variable=SDKVersion]$($content.sdk.version)" Write-Host "sending " + $vstsCommandString Write-Host "##$vstsCommandString" @@ -89,8 +108,9 @@ jobs: versionSpec: 4.9.3 - powershell: | - Import-Module $env:BUILD_SOURCESDIRECTORY\build.psm1 - Import-Module $env:BUILD_SOURCESDIRECTORY\tools\packaging + Import-Module $env:REPOROOT\build.psm1 + Import-Module $env:REPOROOT\tools\packaging + Find-Dotnet New-ILNugetPackage -PackagePath "$(PackagePath)" -PackageVersion "$(Version)" -WinFxdBinPath '$(winFxdPath)' -LinuxFxdBinPath '$(linuxFxdPath)' -GenAPIToolPath "$(GenAPIToolPath)" displayName: 'Create Nuget Package Folders' @@ -101,9 +121,9 @@ jobs: displayName: Capture fxd folders - powershell: | - Import-Module $env:BUILD_SOURCESDIRECTORY\build.psm1 - Import-Module $env:BUILD_SOURCESDIRECTORY\tools\packaging - + Import-Module $env:REPOROOT\build.psm1 + Import-Module $env:REPOROOT\tools\packaging + Find-Dotnet # Create unified package first New-GlobalToolNupkg -UnifiedPackage -LinuxBinPath "$(linuxFxdPath)" -WindowsBinPath "$(winFxdPath)" -WindowsDesktopBinPath "$(winFxdWinDesktopPath)" -PackageVersion "$(Version)" -DestinationPath "$(PackagePath)\globaltool" @@ -115,31 +135,24 @@ jobs: Get-ChildItem "$(PackagePath)" -Recurse displayName: Capture generated packages - - powershell: | - $packages = Get-ChildItem "$(PackagePath)\*.nupkg", "$(PackagePath)\globaltool\*.nupkg" | Select-Object -ExpandProperty FullName - - if($packages.Count -lt 1) - { - throw "No packages created" - } - - $(Build.SourcesDirectory)\tools\releaseBuild\generatePackgeSigning.ps1 -Path $(PackagePath)\NugetSigning.xml -NuPkgFiles $packages - displayName: Create signing file - - - task: PkgESCodeSign@10 - displayName: 'CodeSign Nuget Packages' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(PackagePath)\NugetSigning.xml' - inPathRoot: '$(PackagePath)' - outPathRoot: '$(System.ArtifactsDirectory)\signed' - binVersion: $(SigingVersion) - binVersionOverride: $(SigningVersionOverride) - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + - template: EsrpSign.yml@ComplianceRepo + parameters: + buildOutputPath: $(PackagePath) + signOutputPath: $(System.ArtifactsDirectory)\signed + certificateId: "CP-401405" + pattern: | + **\*.nupkg + useMinimatch: true + + - pwsh: | + if (-not (Test-Path '$(System.ArtifactsDirectory)\signed\')) { $null = New-Item -ItemType Directory -Path '$(System.ArtifactsDirectory)\signed\' } + Copy-Item -Path '$(PackagePath)\*.nupkg' -Destination '$(System.ArtifactsDirectory)\signed\' -Verbose -Force + Copy-Item -Path '$(PackagePath)\globaltool\*.nupkg' -Destination '$(System.ArtifactsDirectory)\signed\' -Verbose -Force + displayName: Fake copy when not signing + condition: eq(variables['SHOULD_SIGN'], 'false') - powershell: | - Import-Module $(Build.SourcesDirectory)\build.psm1 -Force + Import-Module "${env:REPOROOT}\build.psm1" -Force Get-ChildItem -Recurse "$(System.ArtifactsDirectory)\signed\*.nupkg" -Verbose | ForEach-Object { Start-NativeExecution -sb { nuget.exe verify -All $_.FullName } } displayName: Verify all packages are signed diff --git a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml index dae25005e3c..1f066796022 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml @@ -92,17 +92,13 @@ jobs: msi: no msix: no - - task: SFP.build-tasks.custom-build-task-2.EsrpMalwareScanning@1 - displayName: 'Malware Scanning' - inputs: - ConnectedServiceName: pwshEsrpScanning - FolderPath: '$(Build.StagingDirectory)' - Pattern: | - **\*.msix - **\*.msi - **\*.zip - UseMinimatch: true - SessionTimeout: 30 + - template: EsrpScan.yml@ComplianceRepo + parameters: + scanPath: $(Build.StagingDirectory) + pattern: | + **\*.msix + **\*.msi + **\*.zip - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 displayName: 'Component Detection' From d0075913a52005f69b31ce23a1038d50b18da913 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Wed, 9 Dec 2020 14:51:43 -0800 Subject: [PATCH 14/27] Fix issue with unsigned build (#14367) --- tools/releaseBuild/azureDevOps/templates/linux.yml | 1 + .../azureDevOps/templates/mac-file-signing.yml | 12 +++++++----- .../azureDevOps/templates/mac-package-signing.yml | 1 + tools/releaseBuild/azureDevOps/templates/nuget.yml | 1 + .../templates/windows-package-signing.yml | 1 + .../azureDevOps/templates/windows-packaging.yml | 2 ++ tools/releaseBuild/setReleaseTag.ps1 | 2 +- 7 files changed, 14 insertions(+), 6 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/linux.yml b/tools/releaseBuild/azureDevOps/templates/linux.yml index 53e9b4f1924..f8cfd397a3d 100644 --- a/tools/releaseBuild/azureDevOps/templates/linux.yml +++ b/tools/releaseBuild/azureDevOps/templates/linux.yml @@ -120,6 +120,7 @@ jobs: pattern: | **\*.rpm useMinimatch: true + shouldSign: $(SHOULD_SIGN) # requires windows - task: AzureFileCopy@4 diff --git a/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml index 46178671496..0332ec560d0 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml @@ -73,6 +73,7 @@ jobs: pattern: | **\*.zip useMinimatch: true + shouldSign: $(SHOULD_SIGN) - pwsh: | $destination = "$(System.ArtifactsDirectory)\azureMacOs" @@ -89,11 +90,12 @@ jobs: artifactName: signedMacOsBins condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - template: EsrpScan.yml@ComplianceRepo - parameters: - scanPath: $(System.ArtifactsDirectory)\azureMacOs - pattern: | - **\* + - ${{ if eq(variables['SHOULD_SIGN'], 'true') }}: + - template: EsrpScan.yml@ComplianceRepo + parameters: + scanPath: $(System.ArtifactsDirectory)\azureMacOs + pattern: | + **\* - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 displayName: 'Component Detection' diff --git a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml index 3e3d69dcbe5..8d13693ca5a 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml @@ -60,6 +60,7 @@ jobs: pattern: | **\*.zip useMinimatch: true + shouldSign: $(SHOULD_SIGN) - template: upload-final-results.yml parameters: diff --git a/tools/releaseBuild/azureDevOps/templates/nuget.yml b/tools/releaseBuild/azureDevOps/templates/nuget.yml index 34709945891..45061dddc64 100644 --- a/tools/releaseBuild/azureDevOps/templates/nuget.yml +++ b/tools/releaseBuild/azureDevOps/templates/nuget.yml @@ -143,6 +143,7 @@ jobs: pattern: | **\*.nupkg useMinimatch: true + shouldSign: $(SHOULD_SIGN) - pwsh: | if (-not (Test-Path '$(System.ArtifactsDirectory)\signed\')) { $null = New-Item -ItemType Directory -Path '$(System.ArtifactsDirectory)\signed\' } diff --git a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml index 1f066796022..c715891dcde 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml @@ -49,6 +49,7 @@ jobs: **\*.msi **\*.msix useMinimatch: true + shouldSign: $(SHOULD_SIGN) - powershell: | new-item -itemtype Directory -path '$(Build.StagingDirectory)\signedPackages' diff --git a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml index a1c22b3ce5a..c3f52a59d53 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml @@ -154,6 +154,7 @@ jobs: **\*.ps1 **\*.exe useMinimatch: true + shouldSign: $(SHOULD_SIGN) - pwsh: | Import-Module $(PowerShellRoot)/build.psm1 -Force @@ -189,6 +190,7 @@ jobs: pattern: | **\*.dll useMinimatch: true + shouldSign: $(SHOULD_SIGN) - powershell: | Get-ChildItem '$(System.ArtifactsDirectory)\thirdPartySigned\*' diff --git a/tools/releaseBuild/setReleaseTag.ps1 b/tools/releaseBuild/setReleaseTag.ps1 index f84f7a65e9b..5af7db863d7 100644 --- a/tools/releaseBuild/setReleaseTag.ps1 +++ b/tools/releaseBuild/setReleaseTag.ps1 @@ -79,7 +79,7 @@ if($ReleaseTag -eq 'fromBranch' -or !$ReleaseTag) New-BuildInfoJson -ReleaseTag $releaseTag } } - elseif($branchOnly -eq 'master' -or $branchOnly -like '*dailytest*') + elseif(($branchOnly -eq 'master' -and $env:BUILD_REASON -ne 'Manual') -or $branchOnly -like '*dailytest*') { $isDaily = $true Write-verbose "daily build" -verbose From 979a92113d149c9ef7da1e067106788bca1fd4f8 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Wed, 9 Dec 2020 13:09:21 -0800 Subject: [PATCH 15/27] Make AppLocker Enforce mode take precedence over UMCI Audit mode (#14353) --- .../security/wldpNativeMethods.cs | 33 ++++++++++--------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/src/System.Management.Automation/security/wldpNativeMethods.cs b/src/System.Management.Automation/security/wldpNativeMethods.cs index 08dd920df52..ef19a8817b4 100644 --- a/src/System.Management.Automation/security/wldpNativeMethods.cs +++ b/src/System.Management.Automation/security/wldpNativeMethods.cs @@ -72,28 +72,31 @@ public static SystemEnforcementMode GetSystemLockdownPolicy() /// An EnforcementMode that describes policy. public static SystemEnforcementMode GetLockdownPolicy(string path, SafeHandle handle) { - // Check the WLDP API - SystemEnforcementMode lockdownPolicy = GetWldpPolicy(path, handle); - if (lockdownPolicy == SystemEnforcementMode.Enforce) + // Check the WLDP File policy via API + var wldpFilePolicy = GetWldpPolicy(path, handle); + if (wldpFilePolicy == SystemEnforcementMode.Enforce) { - return lockdownPolicy; + return wldpFilePolicy; + } + + // Check the AppLocker File policy via API + // This needs to be checked before WLDP audit policy + // So, that we don't end up in Audit mode, + // when we should be enforce mode. + var appLockerFilePolicy = GetAppLockerPolicy(path, handle); + if (appLockerFilePolicy == SystemEnforcementMode.Enforce) + { + return appLockerFilePolicy; } // At this point, LockdownPolicy = Audit or Allowed. // If there was a WLDP policy, but WLDP didn't block it, // then it was explicitly allowed. Therefore, return the result for the file. SystemEnforcementMode systemWldpPolicy = s_cachedWldpSystemPolicy.GetValueOrDefault(SystemEnforcementMode.None); - if ((systemWldpPolicy == SystemEnforcementMode.Enforce) || - (systemWldpPolicy == SystemEnforcementMode.Audit)) - { - return lockdownPolicy; - } - - // Check the AppLocker API - lockdownPolicy = GetAppLockerPolicy(path, handle); - if (lockdownPolicy == SystemEnforcementMode.Enforce) + if ((systemWldpPolicy == SystemEnforcementMode.Audit) || + (systemWldpPolicy == SystemEnforcementMode.Enforce)) { - return lockdownPolicy; + return wldpFilePolicy; } // If there was a system-wide AppLocker policy, but AppLocker didn't block it, @@ -101,7 +104,7 @@ public static SystemEnforcementMode GetLockdownPolicy(string path, SafeHandle ha if (s_cachedSaferSystemPolicy.GetValueOrDefault(SaferPolicy.Allowed) == SaferPolicy.Disallowed) { - return lockdownPolicy; + return appLockerFilePolicy; } // If it's not set to 'Enforce' by the platform, allow debug overrides From 678cd0caf617e1807414028faf27803740c9c4ec Mon Sep 17 00:00:00 2001 From: Robert Holt Date: Thu, 10 Dec 2020 13:07:53 -0800 Subject: [PATCH 16/27] Fix syntax error in Windows packaging script (#14377) # Conflicts: # tools/releaseBuild/azureDevOps/templates/windows-packaging.yml --- .../releaseBuild/azureDevOps/templates/windows-packaging.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml index c3f52a59d53..3f4d8ba6c8e 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml @@ -125,13 +125,16 @@ jobs: "$($fullSymbolsFolder)\System.Management.Automation.dll" = "" } + $itemsToExclude = @( + ) + if ("$env:Architecture" -notlike 'fxdependent*') { $itemsToCopy += @{"$($fullSymbolsFolder)\pwsh.exe" = ""} } Write-Verbose -verbose "recusively copying $($itemsToCopyWithRecurse | out-string) to $filesToSignDirectory" - Copy-Item -Path $itemsToCopyWithRecurse -Destination $filesToSignDirectory -Recurse -verbose + Copy-Item -Path $itemsToCopyWithRecurse -Destination $filesToSignDirectory -Recurse -verbose -exclude $itemsToExclude foreach($pattern in $itemsToCopy.Keys) { $destinationFolder = Join-Path $filesToSignDirectory -ChildPath $itemsToCopy.$pattern From a012227f2ae2125cf6dc3968489b54f4948539c8 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Mon, 14 Dec 2020 13:59:27 -0800 Subject: [PATCH 17/27] Fix path signed RPMs are uploaded from in release build (#14424) --- tools/releaseBuild/azureDevOps/templates/linux.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/linux.yml b/tools/releaseBuild/azureDevOps/templates/linux.yml index f8cfd397a3d..cc1ea114506 100644 --- a/tools/releaseBuild/azureDevOps/templates/linux.yml +++ b/tools/releaseBuild/azureDevOps/templates/linux.yml @@ -151,7 +151,7 @@ jobs: - task: AzureFileCopy@4 displayName: 'Upload to Azure - RPM - Signed' inputs: - SourcePath: '$(Build.StagingDirectory)\signedPackages\*' + SourcePath: '$(Build.StagingDirectory)\signedPackages\release\*' azureSubscription: '$(AzureFileCopySubscription)' Destination: AzureBlob storage: '$(StorageAccount)' @@ -165,7 +165,7 @@ jobs: - template: upload-final-results.yml parameters: - artifactPath: '$(Build.StagingDirectory)\signedPackages' + artifactPath: '$(Build.StagingDirectory)\signedPackages\release' condition: and(and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM')) - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 From eb2295b58d8d0227caef1539500a961b62b9ee73 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Mon, 14 Dec 2020 14:16:55 -0800 Subject: [PATCH 18/27] Use one feed in each nuget.config in official builds (#14363) Co-authored-by: Robert Holt # Conflicts: # build.psm1 --- build.psm1 | 34 +++++++++++++------ nuget.config | 6 ++-- src/Modules/PSGalleryModules.csproj | 10 +++++- src/Modules/nuget.config | 11 ++++++ test/tools/Modules/nuget.config | 10 ++++++ .../AzArtifactFeed/PSGalleryToAzArtifacts.yml | 2 +- .../templates/insert-nuget-config-azfeed.yml | 22 +++++++++--- .../azureDevOps/templates/linux.yml | 5 ++- .../azureDevOps/templates/mac.yml | 16 +++------ .../templates/windows-hosted-build.yml | 6 ++-- .../templates/windows-packaging.yml | 4 +-- 11 files changed, 91 insertions(+), 35 deletions(-) create mode 100644 src/Modules/nuget.config create mode 100644 test/tools/Modules/nuget.config diff --git a/build.psm1 b/build.psm1 index d6c471cbeb2..027ee939f55 100644 --- a/build.psm1 +++ b/build.psm1 @@ -1,4 +1,4 @@ -# Copyright (c) Microsoft Corporation. All rights reserved. +# Copyright (c) Microsoft Corporation. # Licensed under the MIT License. # On Unix paths is separated by colon @@ -325,7 +325,8 @@ function Start-PSBuild { try { # Excluded sqlite3 folder is due to this Roslyn issue: https://github.com/dotnet/roslyn/issues/23060 # Excluded src/Modules/nuget.config as this is required for release build. - git clean -fdX --exclude .vs/PowerShell/v16/Server/sqlite3 --exclude src/Modules/nuget.config + # Excluded nuget.config as this is required for release build. + git clean -fdX --exclude .vs/PowerShell/v16/Server/sqlite3 --exclude src/Modules/nuget.config --exclude nuget.config } finally { Pop-Location } @@ -598,7 +599,11 @@ function Restore-PSPackage [Parameter()] $Options = (Get-PSOptions -DefaultToNew), - [switch] $Force + [switch] $Force, + + [switch] $InteractiveAuth, + + [switch] $PSModule ) if (-not $ProjectDirs) @@ -622,21 +627,28 @@ function Restore-PSPackage 'Microsoft.NET.Sdk' } - if ($Options.Runtime -notlike 'fxdependent*') { + if ($PSModule.IsPresent) { + $RestoreArguments = @("--verbosity") + } + elseif ($Options.Runtime -notlike 'fxdependent*') { $RestoreArguments = @("--runtime", $Options.Runtime, "/property:SDKToUse=$sdkToUse", "--verbosity") } else { $RestoreArguments = @("/property:SDKToUse=$sdkToUse", "--verbosity") } - if ($PSCmdlet.MyInvocation.BoundParameters["Verbose"].IsPresent) { + if ($VerbosePreference -eq 'Continue') { $RestoreArguments += "detailed" } else { $RestoreArguments += "quiet" } + if ($InteractiveAuth) { + $RestoreArguments += "--interactive" + } + $ProjectDirs | ForEach-Object { $project = $_ - Write-Log "Run dotnet restore $project $RestoreArguments" + Write-Log -message "Run dotnet restore $project $RestoreArguments" $retryCount = 0 $maxTries = 5 while($retryCount -lt $maxTries) @@ -647,7 +659,7 @@ function Restore-PSPackage } catch { - Write-Log "Failed to restore $project, retrying..." + Write-Log -message "Failed to restore $project, retrying..." $retryCount++ if($retryCount -ge $maxTries) { @@ -656,7 +668,7 @@ function Restore-PSPackage continue } - Write-Log "Done restoring $project" + Write-Log -message "Done restoring $project" break } } @@ -2390,7 +2402,7 @@ function Copy-PSGalleryModules Find-DotNet - Restore-PSPackage -ProjectDirs (Split-Path $CsProjPath) -Force:$Force.IsPresent + Restore-PSPackage -ProjectDirs (Split-Path $CsProjPath) -Force:$Force.IsPresent -PSModule $cache = dotnet nuget locals global-packages -l if ($cache -match "info : global-packages: (.*)") { @@ -3172,8 +3184,10 @@ function New-NugetConfigFile - + + + <[FEEDNAME]> diff --git a/nuget.config b/nuget.config index 00290082689..6548586147e 100644 --- a/nuget.config +++ b/nuget.config @@ -3,8 +3,8 @@ - - - + + + diff --git a/src/Modules/PSGalleryModules.csproj b/src/Modules/PSGalleryModules.csproj index 8320faa8111..92fc274b6c9 100644 --- a/src/Modules/PSGalleryModules.csproj +++ b/src/Modules/PSGalleryModules.csproj @@ -1,6 +1,14 @@ - + + PowerShell + Microsoft Corporation + (c) Microsoft Corporation. + + net5.0 + + true + diff --git a/src/Modules/nuget.config b/src/Modules/nuget.config new file mode 100644 index 00000000000..f5a7f806a36 --- /dev/null +++ b/src/Modules/nuget.config @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/test/tools/Modules/nuget.config b/test/tools/Modules/nuget.config new file mode 100644 index 00000000000..b0fc73009da --- /dev/null +++ b/test/tools/Modules/nuget.config @@ -0,0 +1,10 @@ + + + + + + + + + + diff --git a/tools/releaseBuild/azureDevOps/AzArtifactFeed/PSGalleryToAzArtifacts.yml b/tools/releaseBuild/azureDevOps/AzArtifactFeed/PSGalleryToAzArtifacts.yml index e6f5756b9d3..35a51f65ef2 100644 --- a/tools/releaseBuild/azureDevOps/AzArtifactFeed/PSGalleryToAzArtifacts.yml +++ b/tools/releaseBuild/azureDevOps/AzArtifactFeed/PSGalleryToAzArtifacts.yml @@ -15,7 +15,7 @@ steps: - powershell: | Import-Module -Force "$(Build.SourcesDirectory)/tools/releaseBuild/azureDevOps/AzArtifactFeed/SyncGalleryToAzArtifacts.psm1" - SyncGalleryToAzArtifacts -AzDevOpsFeedUserName $(AzDevOpsFeedUserName) -AzDevOpsPAT $(AzDevOpsFeedPAT) -Destination $(Build.ArtifactStagingDirectory) + SyncGalleryToAzArtifacts -AzDevOpsFeedUserName $(AzDevOpsFeedUserName) -AzDevOpsPAT $(AzDevOpsFeedPAT2) -Destination $(Build.ArtifactStagingDirectory) displayName: Download packages from PSGallery that need to be updated condition: succeededOrFailed() diff --git a/tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml b/tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml index d768a876372..5fdb9f7d977 100644 --- a/tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml +++ b/tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml @@ -1,11 +1,25 @@ +parameters: + - name: "repoRoot" + default: $(REPOROOT) + steps: -- powershell: | - Import-Module $env:REPOROOT/build.psm1 -Force - New-NugetConfigFile -NugetFeedUrl $(AzDevOpsFeed) -UserName $(AzDevOpsFeedUserName) -ClearTextPAT $(AzDevOpsFeedPAT) -FeedName AzDevOpsFeed -Destination $env:REPOROOT/src/Modules +- pwsh: | + Import-Module ${{ parameters.repoRoot }}/build.psm1 -Force + New-NugetConfigFile -NugetFeedUrl $(AzDevOpsFeed) -UserName $(AzDevOpsFeedUserName) -ClearTextPAT $(AzDevOpsFeedPAT2) -FeedName AzDevOpsFeed -Destination '${{ parameters.repoRoot }}/src/Modules' - if(-not (Test-Path "$env:REPOROOT/src/Modules/nuget.config")) + if(-not (Test-Path "${{ parameters.repoRoot }}/src/Modules/nuget.config")) { throw "nuget.config is not created" } displayName: 'Add nuget.config for Azure DevOps feed for PSGallery modules' condition: and(succeededOrFailed(), ne(variables['AzDevOpsFeed'], '')) +- pwsh: | + Import-Module ${{ parameters.repoRoot }}/build.psm1 -Force + New-NugetConfigFile -NugetFeedUrl $(AzDevOpsPackageFeed) -UserName $(AzDevOpsFeedUserName) -ClearTextPAT $(AzDevOpsFeedPAT2) -FeedName AzDevOpsFeed -Destination '${{ parameters.repoRoot }}' + + if(-not (Test-Path "${{ parameters.repoRoot }}/nuget.config")) + { + throw "nuget.config is not created" + } + displayName: 'Add nuget.config for Azure DevOps feed for packages' + condition: and(succeededOrFailed(), ne(variables['AzDevOpsPackageFeed'], '')) diff --git a/tools/releaseBuild/azureDevOps/templates/linux.yml b/tools/releaseBuild/azureDevOps/templates/linux.yml index cc1ea114506..0fac7ae4f24 100644 --- a/tools/releaseBuild/azureDevOps/templates/linux.yml +++ b/tools/releaseBuild/azureDevOps/templates/linux.yml @@ -42,7 +42,8 @@ jobs: displayName: 'Skip Alpine or fxdependent for PS v6.0.*' - template: insert-nuget-config-azfeed.yml - + parameters: + repoRoot: $(REPOROOT) - powershell: | import-module "$env:REPOROOT/build.psm1" @@ -51,7 +52,9 @@ jobs: condition: and(succeeded(), ne(variables['SkipBuild'], 'true')) - powershell: | + $env:AzDevOpsFeedPAT2 = '$(AzDevOpsFeedPAT2)' & "$env:REPOROOT/tools/releaseBuild/vstsbuild.ps1" -ReleaseTag $(ReleaseTagVar) -Name '$(build)' + $env:AzDevOpsFeedPAT2 = $null displayName: 'Build and package' condition: and(succeeded(), ne(variables['SkipBuild'], 'true')) diff --git a/tools/releaseBuild/azureDevOps/templates/mac.yml b/tools/releaseBuild/azureDevOps/templates/mac.yml index 564d3172082..b8425cd2ace 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac.yml @@ -32,20 +32,14 @@ jobs: tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 -location $(PowerShellRoot) -BootStrap displayName: 'Bootstrap VM' - - pwsh: | - Import-Module $(Build.SourcesDirectory)/build.psm1 -Force - New-NugetConfigFile -NugetFeedUrl $(AzDevOpsFeed) -UserName $(AzDevOpsFeedUserName) -ClearTextPAT $(AzDevOpsFeedPAT) -FeedName AzDevOpsFeed -Destination "$(PowerShellRoot)/src/Modules" - - if(-not (Test-Path "$(PowerShellRoot)/src/Modules/nuget.config")) - { - throw "nuget.config is not created" - } - displayName: 'Add nuget.config for AzDevOps feed for PSGallery modules ' + - template: /tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml + parameters: + repoRoot: $(PowerShellRoot) - pwsh: | - $env:AZDEVOPSFEEDPAT = '$(AzDevOpsFeedPAT)' + $env:AzDevOpsFeedPAT2 = '$(AzDevOpsFeedPAT2)' $(Build.SourcesDirectory)/tools/releaseBuild/macOS/PowerShellPackageVsts.ps1 -ReleaseTag $(ReleaseTagVar) -Destination $(System.ArtifactsDirectory) -Symbols -location $(PowerShellRoot) -Build -ArtifactName macosBinResults - $env:AZDEVOPSFEEDPAT = $null + $env:AzDevOpsFeedPAT2 = $null displayName: 'Build' - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 diff --git a/tools/releaseBuild/azureDevOps/templates/windows-hosted-build.yml b/tools/releaseBuild/azureDevOps/templates/windows-hosted-build.yml index ea93a883d69..55d92c5cc91 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-hosted-build.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-hosted-build.yml @@ -31,10 +31,12 @@ jobs: parameters: ReleaseTagVar: $(ReleaseTagVar) - - template: insert-nuget-config-azfeed.yml - - template: cloneToOfficialPath.yml + - template: /tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml + parameters: + repoRoot: $(PowerShellRoot) + - powershell: | $runtime = switch ($env:Architecture) diff --git a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml index 3f4d8ba6c8e..a2428f80cb1 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml @@ -61,7 +61,7 @@ jobs: - template: cloneToOfficialPath.yml - - powershell: | + - pwsh: | # cleanup previous install if((Test-Path "${env:ProgramFiles(x86)}\WiX Toolset xcopy")) { Remove-Item "${env:ProgramFiles(x86)}\WiX Toolset xcopy" -Recurse -Force @@ -69,7 +69,7 @@ jobs: $toolsDir = New-Item -ItemType Directory -Path '$(Build.ArtifactStagingDirectory)\tools' $wixUri = 'https://github.com/wixtoolset/wix3/releases/download/wix311rtm/wix311-binaries.zip' - Invoke-RestMethod -Uri $wixUri -OutFile '$(Build.ArtifactStagingDirectory)\tools\wix.zip' + Invoke-RestMethod -Uri $wixUri -OutFile '$(Build.ArtifactStagingDirectory)\tools\wix.zip' -MaximumRetryCount 5 -RetryIntervalSec 10 Import-Module '$(PowerShellRoot)/tools/releaseBuild/Images/microsoft_powershell_windowsservercore/wix.psm1' Install-WixZip -zipPath '$(Build.ArtifactStagingDirectory)\tools\wix.zip' From 5a310ba9d390c09b493bba40e3e1de9a955cc342 Mon Sep 17 00:00:00 2001 From: Paul Higinbotham Date: Wed, 16 Dec 2020 17:35:35 -0800 Subject: [PATCH 19/27] Disable libmi dependent tests for macOS. (#14446) # Conflicts: # test/powershell/engine/Remoting/RemoteSession.Basic.Tests.ps1 --- .../PSDesiredStateConfiguration.Tests.ps1 | 50 +++++++++++++++++++ .../configuration.Tests.ps1 | 3 ++ .../engine/Remoting/PSSession.Tests.ps1 | 12 +++-- .../Remoting/RemoteSession.Basic.Tests.ps1 | 29 +++++++---- 4 files changed, 81 insertions(+), 13 deletions(-) diff --git a/test/powershell/Modules/PSDesiredStateConfiguration/PSDesiredStateConfiguration.Tests.ps1 b/test/powershell/Modules/PSDesiredStateConfiguration/PSDesiredStateConfiguration.Tests.ps1 index e518ae267c5..f84c83b32ee 100644 --- a/test/powershell/Modules/PSDesiredStateConfiguration/PSDesiredStateConfiguration.Tests.ps1 +++ b/test/powershell/Modules/PSDesiredStateConfiguration/PSDesiredStateConfiguration.Tests.ps1 @@ -129,6 +129,10 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { Set-ItResult -Pending -Because "https://github.com/PowerShell/PSDesiredStateConfiguration/issues/26" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } + $resource = Get-DscResource -Name $name $resource | Should -Not -BeNullOrEmpty $resource.Name | Should -Be $Name @@ -148,6 +152,10 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { Set-ItResult -Pending -Because "https://github.com/PowerShell/PSDesiredStateConfiguration/issues/26" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } + if ($PendingBecause) { Set-ItResult -Pending -Because $PendingBecause } @@ -225,6 +233,10 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { Set-ItResult -Pending -Because "Will only find script from PSDesiredStateConfiguration without modulename" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } + if ($MissingLibmi) { Set-ItResult -Pending -Because "Libmi not available for this platform" } @@ -254,6 +266,10 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { Set-ItResult -Pending -Because "https://github.com/PowerShell/PSDesiredStateConfiguration/issues/12 and https://github.com/PowerShell/PowerShellGet/pull/529" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } + if ($PendingBecause) { Set-ItResult -Pending -Because $PendingBecause } @@ -315,6 +331,10 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { Set-ItResult -Pending -Because "Libmi not available for this platform" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } + if ($PendingBecause) { Set-ItResult -Pending -Because $PendingBecause } @@ -340,6 +360,10 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { Set-ItResult -Pending -Because "Libmi not available for this platform" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } + if ($PendingBecause) { Set-ItResult -Pending -Because $PendingBecause } @@ -402,6 +426,10 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { Set-ItResult -Pending -Because "Libmi not available for this platform" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } + if (!$IsLinux) { $result = Invoke-DscResource -Name PSModule -ModuleName $psGetModuleSpecification -Method set -Property @{ Name = 'PsDscResources' @@ -427,6 +455,10 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { Set-ItResult -Pending -Because "Libmi not available for this platform" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } + # using create scriptBlock because $using: doesn't work with existing Invoke-DscResource # Verified in Windows PowerShell on 20190814 $result = Invoke-DscResource -Name Script -ModuleName PSDscResources -Method Set -Property @{TestScript = { Write-Output 'test'; return $false }; GetScript = { return @{ } }; SetScript = [scriptblock]::Create("`$global:DSCMachineStatus = $value;return") } @@ -438,6 +470,9 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { if ($MissingLibmi) { Set-ItResult -Pending -Because "Libmi not available for this platform" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } $result = Invoke-DscResource -Name Script -ModuleName PSDscResources -Method Test -Property @{TestScript = { Write-Output 'test'; return $false }; GetScript = { return @{ } }; SetScript = { return } } $result | Should -Not -BeNullOrEmpty @@ -448,6 +483,9 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { if ($MissingLibmi) { Set-ItResult -Pending -Because "Libmi not available for this platform" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } $result = Invoke-DscResource -Name Script -ModuleName PSDscResources -Method Test -Property @{TestScript = { Write-Verbose 'test'; return $true }; GetScript = { return @{ } }; SetScript = { return } } $result | Should -BeTrue -Because "Test method return true" @@ -457,6 +495,9 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { if ($MissingLibmi) { Set-ItResult -Pending -Because "Libmi not available for this platform" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } $module = get-module PsDscResources -ListAvailable $moduleSpecification = @{ModuleName = $module.Name; ModuleVersion = $module.Version.ToString() } @@ -520,6 +561,9 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { if ($MissingLibmi) { Set-ItResult -Pending -Because "Libmi not available for this platform" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } { Invoke-DscResource -Name santoheusnaasonteuhsantoheu -Method Test -Property @{TestScript = { Write-Host 'test'; return $true }; GetScript = { return @{ } }; SetScript = { return } } -ErrorAction Stop @@ -531,6 +575,9 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { if ($IsLinux) { Set-ItResult -Pending -Because "https://github.com/PowerShell/PSDesiredStateConfiguration/issues/12 and https://github.com/PowerShell/PowerShellGet/pull/529" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } $result = Invoke-DscResource -Name PSModule -ModuleName $psGetModuleSpecification -Method Get -Property @{ Name = 'PsDscResources' } $result | Should -Not -BeNullOrEmpty @@ -577,6 +624,9 @@ Describe "Test PSDesiredStateConfiguration" -tags CI { if ($MissingLibmi) { Set-ItResult -Pending -Because "Libmi not available for this platform" } + if ($IsMacOS) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } $testString = '890574209347509120348' $result = Invoke-DscResource -Name XmlFileContentResource -ModuleName XmlContentDsc -Property @{Path = $resolvedXmlPath; XPath = '/configuration/appSetting/Test1'; Ensure = 'Present'; Attributes = @{ TestValue2 = $testString; Name = $testString } } -Method Set diff --git a/test/powershell/Modules/PSDesiredStateConfiguration/configuration.Tests.ps1 b/test/powershell/Modules/PSDesiredStateConfiguration/configuration.Tests.ps1 index c423e8d3392..2a07e05fb45 100644 --- a/test/powershell/Modules/PSDesiredStateConfiguration/configuration.Tests.ps1 +++ b/test/powershell/Modules/PSDesiredStateConfiguration/configuration.Tests.ps1 @@ -15,6 +15,9 @@ Describe "DSC MOF Compilation" -tags "CI" { if ($IsLinux) { Set-ItResult -Pending -Because "https://github.com/PowerShell/PowerShellGet/pull/529" } + if ($IsMacOs) { + Set-ItResult -Pending -Because "macOS is incompatible with libmi" + } Write-Verbose "DSC_HOME: ${env:DSC_HOME}" -verbose [Scriptblock]::Create(@" diff --git a/test/powershell/engine/Remoting/PSSession.Tests.ps1 b/test/powershell/engine/Remoting/PSSession.Tests.ps1 index 7d17a7f444d..f507c6ae308 100644 --- a/test/powershell/engine/Remoting/PSSession.Tests.ps1 +++ b/test/powershell/engine/Remoting/PSSession.Tests.ps1 @@ -5,6 +5,11 @@ # PSSession tests for non-Windows platforms # +function GetRandomString() +{ + return [System.IO.Path]::GetFileNameWithoutExtension([System.IO.Path]::GetRandomFileName()) +} + Describe "New-PSSessionOption parameters for non-Windows platforms" -Tag "CI" { BeforeAll { @@ -36,12 +41,13 @@ Describe "SkipCACheck and SkipCNCheck PSSession options are required for New-PSS BeforeAll { $originalDefaultParameterValues = $PSDefaultParameterValues.Clone() - if ($IsWindows) { + # Skip this test for macOS because the latest OS release is incompatible with our shipped libmi for WinRM/OMI. + if ($IsWindows -or $IsMacOS) { $PSDefaultParameterValues['it:skip'] = $true } else { $userName = "User_$(Get-Random -Maximum 99999)" - $userPassword = "Password_$(Get-Random -Maximum 99999)" + $userPassword = GetRandomString $cred = [pscredential]::new($userName, (ConvertTo-SecureString -String $userPassword -AsPlainText -Force)) $soSkipCA = New-PSSessionOption -SkipCACheck $soSkipCN = New-PSSessionOption -SkipCNCheck @@ -54,7 +60,7 @@ Describe "SkipCACheck and SkipCNCheck PSSession options are required for New-PSS $testCases = @( @{ - Name = 'Verifies expected error when session options is missing' + Name = 'Verifies expected error when session option is missing' ScriptBlock = { New-PSSession -cn localhost -Credential $cred -Authentication Basic -UseSSL } ExpectedErrorCode = 825 }, diff --git a/test/powershell/engine/Remoting/RemoteSession.Basic.Tests.ps1 b/test/powershell/engine/Remoting/RemoteSession.Basic.Tests.ps1 index fd68225c31c..63656b267b1 100644 --- a/test/powershell/engine/Remoting/RemoteSession.Basic.Tests.ps1 +++ b/test/powershell/engine/Remoting/RemoteSession.Basic.Tests.ps1 @@ -3,19 +3,25 @@ Import-Module HelpersCommon +function GetRandomString() +{ + return [System.IO.Path]::GetFileNameWithoutExtension([System.IO.Path]::GetRandomFileName()) +} + Describe "New-PSSession basic test" -Tag @("CI") { It "New-PSSession should not crash powershell" { $platformInfo = Get-PlatformInfo if ( ($platformInfo.Platform -match "alpine|raspbian") -or ($platformInfo.Platform -eq "debian" -and ($platformInfo.Version -eq '10' -or $platformInfo.Version -eq '')) -or # debian 11 has empty Version ID - ($platformInfo.Platform -eq 'centos' -and $platformInfo.Version -eq '8') + ($platformInfo.Platform -eq 'centos' -and $platformInfo.Version -eq '8') -or + ($IsMacOS) ) { - Set-ItResult -Skipped -Because "MI library not available for Alpine, Raspberry Pi, Debian 10 and 11, and CentOS 8" + Set-ItResult -Skipped -Because "MI library not available for Alpine, Raspberry Pi, Debian 10 and 11, CentOS 8, and not compatible with macOS" return } - { New-PSSession -ComputerName nonexistcomputer -Authentication Basic } | + { New-PSSession -ComputerName (GetRandomString) -Authentication Basic } | Should -Throw -ErrorId "InvalidOperation,Microsoft.PowerShell.Commands.NewPSSessionCommand" } } @@ -26,13 +32,14 @@ Describe "Basic Auth over HTTP not allowed on Unix" -Tag @("CI") { if ( ($platformInfo.Platform -match "alpine|raspbian") -or ($platformInfo.Platform -eq "debian" -and ($platformInfo.Version -eq '10' -or $platformInfo.Version -eq '')) -or # debian 11 has empty Version ID - ($platformInfo.Platform -eq 'centos' -and $platformInfo.Version -eq '8') + ($platformInfo.Platform -eq 'centos' -and $platformInfo.Version -eq '8') -or + ($IsMacOS) ) { - Set-ItResult -Skipped -Because "MI library not available for Alpine, Raspberry Pi, Debian 10 and 11, and CentOS 8" + Set-ItResult -Skipped -Because "MI library not available for Alpine, Raspberry Pi, Debian 10 and 11, CentOS 8, and not compatible with macOS" return } - $password = ConvertTo-SecureString -String "password" -AsPlainText -Force + $password = ConvertTo-SecureString -String (GetRandomString) -AsPlainText -Force $credential = [PSCredential]::new('username', $password) $err = ({New-PSSession -ComputerName 'localhost' -Credential $credential -Authentication Basic} | Should -Throw -PassThru -ErrorId 'System.Management.Automation.Remoting.PSRemotingDataStructureException,Microsoft.PowerShell.Commands.NewPSSessionCommand') @@ -42,18 +49,20 @@ Describe "Basic Auth over HTTP not allowed on Unix" -Tag @("CI") { $err.Exception.ErrorCode | Should -Be 801 } - It "New-PSSession should NOT throw a ConnectFailed exception when specifying Basic Auth over HTTPS on Unix" -skip:($IsWindows) { + # Skip this test for macOS because the latest OS release is incompatible with our shipped libmi for WinRM/OMI. + It "New-PSSession should NOT throw a ConnectFailed exception when specifying Basic Auth over HTTPS on Unix" -Skip:($IsWindows) { $platformInfo = Get-PlatformInfo if ( ($platformInfo.Platform -match "alpine|raspbian") -or ($platformInfo.Platform -eq "debian" -and ($platformInfo.Version -eq '10' -or $platformInfo.Version -eq '')) -or # debian 11 has empty Version ID - ($platformInfo.Platform -eq 'centos' -and $platformInfo.Version -eq '8') + ($platformInfo.Platform -eq 'centos' -and $platformInfo.Version -eq '8') -or + ($IsMacOS) ) { - Set-ItResult -Skipped -Because "MI library not available for Alpine, Raspberry Pi, Debian 10 and 11, and CentOS 8" + Set-ItResult -Skipped -Because "MI library not available for Alpine, Raspberry Pi, Debian 10 and 11, CentOS 8, and not compatible with macOS" return } - $password = ConvertTo-SecureString -String "password" -AsPlainText -Force + $password = ConvertTo-SecureString -String (GetRandomString) -AsPlainText -Force $credential = [PSCredential]::new('username', $password) # use a Uri that specifies HTTPS to test Basic Auth logic. From 62e3648f68285d154533e3d298e44d720c6b4f85 Mon Sep 17 00:00:00 2001 From: "James Truher [MSFT]" Date: Tue, 21 Jul 2020 09:43:53 -0700 Subject: [PATCH 20/27] Use PowerShell Core for build and test of package in CI build (#13223) --- .vsts-ci/templates/windows-packaging.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.vsts-ci/templates/windows-packaging.yml b/.vsts-ci/templates/windows-packaging.yml index df422b812d5..455efbb9fec 100644 --- a/.vsts-ci/templates/windows-packaging.yml +++ b/.vsts-ci/templates/windows-packaging.yml @@ -27,7 +27,7 @@ jobs: displayName: Bootstrap condition: succeededOrFailed() - - powershell: | + - pwsh: | Import-Module .\tools\ci.psm1 New-CodeCoverageAndTestPackage Invoke-CIFinish -NuGetKey $(NUGET_KEY) From dec9fcc77da6c1ff100abd66eb1db5c91794144e Mon Sep 17 00:00:00 2001 From: Paul Higinbotham Date: Wed, 19 Aug 2020 09:05:25 -0700 Subject: [PATCH 21/27] Disable WMF link invocation test (#13479) # Conflicts: # test/powershell/Installer/WindowsInstaller.Tests.ps1 --- test/powershell/Installer/WindowsInstaller.Tests.ps1 | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/test/powershell/Installer/WindowsInstaller.Tests.ps1 b/test/powershell/Installer/WindowsInstaller.Tests.ps1 index 5b88d653afe..6167e7fd47e 100644 --- a/test/powershell/Installer/WindowsInstaller.Tests.ps1 +++ b/test/powershell/Installer/WindowsInstaller.Tests.ps1 @@ -1,4 +1,4 @@ -# Copyright (c) Microsoft Corporation. All rights reserved. +# Copyright (c) Microsoft Corporation. # Licensed under the MIT License. Describe "Windows Installer" -Tags "Scenario" { @@ -21,7 +21,8 @@ Describe "Windows Installer" -Tags "Scenario" { ## Running 'Invoke-WebRequest' with WMF download URLs has been failing intermittently, ## because sometimes the URLs lead to a 'this download is no longer available' page. ## We use a retry logic here. Retry for 5 times with 1 second interval. - It "Pre-Requisistes link for '' is reachable: " -TestCases $linkCheckTestCases -skip:$skipTest { + # It "Pre-Requisistes link for '' is reachable: " -TestCases $linkCheckTestCases -Skip:$skipTest { + It "Pre-Requisistes link for '' is reachable: " -TestCases $linkCheckTestCases -Pending { param ($Url) foreach ($i in 1..5) { From 18218bb5f9a52c452ea0fcc87470ada4d5af74f5 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Mon, 21 Dec 2020 22:17:47 +0000 Subject: [PATCH 22/27] Merged PR 13904: fix directory creation failure fix directory creation failure --- tools/releaseBuild/azureDevOps/templates/nuget.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tools/releaseBuild/azureDevOps/templates/nuget.yml b/tools/releaseBuild/azureDevOps/templates/nuget.yml index 45061dddc64..3a4612d119e 100644 --- a/tools/releaseBuild/azureDevOps/templates/nuget.yml +++ b/tools/releaseBuild/azureDevOps/templates/nuget.yml @@ -171,7 +171,11 @@ jobs: artifactPath: '$(System.ArtifactsDirectory)\signed' - powershell: | - $null = New-Item -Path "$(System.ArtifactsDirectory)\signed\globaltool" -ItemType Directory + if (-not (Test-Path "$(System.ArtifactsDirectory)\signed\globaltool")) + { + $null = New-Item -Path "$(System.ArtifactsDirectory)\signed\globaltool" -ItemType Directory -Force + } + Move-Item -Path "$(System.ArtifactsDirectory)\signed\PowerShell.*" -Destination "$(System.ArtifactsDirectory)\signed\globaltool" -Force Get-ChildItem "$(System.ArtifactsDirectory)\signed\globaltool" -Recurse displayName: Move global tool packages to subfolder and capture From a5c0617737a9da4470f8b001790d04aec5a174f0 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Wed, 13 Jan 2021 00:58:47 +0000 Subject: [PATCH 23/27] Merged PR 13946: fix 704 get-module test failure add logging --- .../Get-Module.Tests.ps1 | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/test/powershell/Modules/Microsoft.PowerShell.Core/Get-Module.Tests.ps1 b/test/powershell/Modules/Microsoft.PowerShell.Core/Get-Module.Tests.ps1 index 5d901b7f8d5..82b08aa8439 100644 --- a/test/powershell/Modules/Microsoft.PowerShell.Core/Get-Module.Tests.ps1 +++ b/test/powershell/Modules/Microsoft.PowerShell.Core/Get-Module.Tests.ps1 @@ -63,6 +63,7 @@ Describe "Get-Module -ListAvailable" -Tags "CI" { ) $env:PSModulePath = Join-Path $testdrive "Modules" + Get-Module Microsoft.PowerShell.Management | Remove-Module -Force } AfterAll { @@ -170,11 +171,17 @@ Describe "Get-Module -ListAvailable" -Tags "CI" { $ModuleVersion ) - $moduleSpecification = @{ModuleName = $name ; ModuleVersion = $ModuleVersion} - $modules = Get-Module -FullyQualifiedName $moduleSpecification - $modules | Should -HaveCount 1 - $modules.Name | Should -BeExactly $ExpectedName - $modules.Version | Should -BeExactly $ModuleVersion + try { + $moduleSpecification = @{ModuleName = $name ; ModuleVersion = $ModuleVersion } + $modules = Get-Module -FullyQualifiedName $moduleSpecification + $modules | Should -HaveCount 1 + $modules.Name | Should -BeExactly $ExpectedName + $modules.Version | Should -BeExactly $ModuleVersion + } catch { + "psmodulepath: $env:PSModulePath" | Write-Verbose -Verbose + $modules | Select-Object Name, Version, path | Out-String -Width 1000 | Write-Verbose -Verbose + throw + } } It "Get-Module -Refresh -ListAvailable" { From 36330b451f2b20f48efa19f14b18178c640d272f Mon Sep 17 00:00:00 2001 From: Robert Holt Date: Wed, 13 Jan 2021 01:00:42 +0000 Subject: [PATCH 24/27] Merged PR 14104: Update .NET dependencies for 7.0.4 --- build.psm1 | 2 +- global.json | 2 +- .../Microsoft.PowerShell.Commands.Utility.csproj | 4 ++-- .../Microsoft.PowerShell.SDK.csproj | 4 ++-- src/Modules/PSGalleryModules.csproj | 4 ++-- .../Microsoft.PowerShell.Security/SecureString.Tests.ps1 | 6 +++--- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/build.psm1 b/build.psm1 index 027ee939f55..7d5fa3e211f 100644 --- a/build.psm1 +++ b/build.psm1 @@ -2405,7 +2405,7 @@ function Copy-PSGalleryModules Restore-PSPackage -ProjectDirs (Split-Path $CsProjPath) -Force:$Force.IsPresent -PSModule $cache = dotnet nuget locals global-packages -l - if ($cache -match "info : global-packages: (.*)") { + if ($cache -match "(?:info : )?global-packages: (.*)") { $nugetCache = $matches[1] } else { diff --git a/global.json b/global.json index aab18a8b2ef..d82f13f4dbe 100644 --- a/global.json +++ b/global.json @@ -1,5 +1,5 @@ { "sdk": { - "version": "3.1.106" + "version": "3.1.405" } } diff --git a/src/Microsoft.PowerShell.Commands.Utility/Microsoft.PowerShell.Commands.Utility.csproj b/src/Microsoft.PowerShell.Commands.Utility/Microsoft.PowerShell.Commands.Utility.csproj index fcdc4f66ada..258681b7161 100644 --- a/src/Microsoft.PowerShell.Commands.Utility/Microsoft.PowerShell.Commands.Utility.csproj +++ b/src/Microsoft.PowerShell.Commands.Utility/Microsoft.PowerShell.Commands.Utility.csproj @@ -33,8 +33,8 @@ - - + + diff --git a/src/Microsoft.PowerShell.SDK/Microsoft.PowerShell.SDK.csproj b/src/Microsoft.PowerShell.SDK/Microsoft.PowerShell.SDK.csproj index e7879cd90cc..0b2949a7bc3 100644 --- a/src/Microsoft.PowerShell.SDK/Microsoft.PowerShell.SDK.csproj +++ b/src/Microsoft.PowerShell.SDK/Microsoft.PowerShell.SDK.csproj @@ -16,7 +16,7 @@ - + @@ -30,7 +30,7 @@ - + diff --git a/src/Modules/PSGalleryModules.csproj b/src/Modules/PSGalleryModules.csproj index 92fc274b6c9..916db547f16 100644 --- a/src/Modules/PSGalleryModules.csproj +++ b/src/Modules/PSGalleryModules.csproj @@ -11,10 +11,10 @@ - + - + diff --git a/test/powershell/Modules/Microsoft.PowerShell.Security/SecureString.Tests.ps1 b/test/powershell/Modules/Microsoft.PowerShell.Security/SecureString.Tests.ps1 index 838719ad1af..7d91ccb22d4 100644 --- a/test/powershell/Modules/Microsoft.PowerShell.Security/SecureString.Tests.ps1 +++ b/test/powershell/Modules/Microsoft.PowerShell.Security/SecureString.Tests.ps1 @@ -24,9 +24,9 @@ Describe "SecureString conversion tests" -Tags "CI" { } It "can convert back from a secure string" { - $secret = "abcd" - $ss1 = ConvertTo-SecureString -AsPlainText -Force $secret + $value = "abcd" + $ss1 = ConvertTo-SecureString -AsPlainText -Force $value $ss2 = ConvertFrom-SecureString $ss1 | ConvertTo-SecureString - $ss2 | ConvertFrom-SecureString -AsPlainText | Should -Be $secret + $ss2 | ConvertFrom-SecureString -AsPlainText | Should -Be $value } } From f80154ad18a8b9eaee71e75aaae945b5b5bccdaf Mon Sep 17 00:00:00 2001 From: Robert Holt Date: Wed, 13 Jan 2021 18:39:16 +0000 Subject: [PATCH 25/27] Merged PR 14122: Update WXS file for 7.0.4 Update wxs file --- assets/files.wxs | 30 +++--------------------------- 1 file changed, 3 insertions(+), 27 deletions(-) diff --git a/assets/files.wxs b/assets/files.wxs index 1c85237572f..37b5f8b7532 100644 --- a/assets/files.wxs +++ b/assets/files.wxs @@ -1940,24 +1940,6 @@ - - - - - - - - - - - - - - - - - - @@ -3074,8 +3056,8 @@ - - + + @@ -4061,13 +4043,7 @@ - - - - - - - + From dc71ea2bd397c9ea9809e26d1d5e85719d6b6630 Mon Sep 17 00:00:00 2001 From: Robert Holt Date: Thu, 14 Jan 2021 21:11:47 +0000 Subject: [PATCH 26/27] Merged PR 14147: Remove myget feeds from test nuget.config Remove myget feeds from test nuget.config --- test/hosting/NuGet.Config | 2 -- 1 file changed, 2 deletions(-) diff --git a/test/hosting/NuGet.Config b/test/hosting/NuGet.Config index c2c6e1b7c2d..765346e5343 100644 --- a/test/hosting/NuGet.Config +++ b/test/hosting/NuGet.Config @@ -2,8 +2,6 @@ - - From 2f3b740ee4e7ac52eb886f4e3b113d6b46a74794 Mon Sep 17 00:00:00 2001 From: Robert Holt Date: Tue, 19 Jan 2021 22:12:16 +0000 Subject: [PATCH 27/27] Merged PR 14193: Update CHANGELOG for 7.0.4 --- .spelling | 6 ++++++ CHANGELOG/7.0.md | 43 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 49 insertions(+) diff --git a/.spelling b/.spelling index ab1d9720288..cacbde03054 100644 --- a/.spelling +++ b/.spelling @@ -861,6 +861,11 @@ SytzeAndr yashrajbharti Leonhardt tylerleonhardt +nuget.config +libmi +rpms +authenticode +env - CHANGELOG.md aavdberg asrosent @@ -935,3 +940,4 @@ wpaProfile - CHANGELOG/preview.md ThomasNieto spongemike2 + diff --git a/CHANGELOG/7.0.md b/CHANGELOG/7.0.md index b0130b2c80e..b51667e8264 100644 --- a/CHANGELOG/7.0.md +++ b/CHANGELOG/7.0.md @@ -1,5 +1,48 @@ # 7.0 Changelog +## [7.0.4] - 2021-01-19 + +### Build and Packaging Improvements + +
+ + +Bump .NET SDK to version 3.1.405 + + +
    +
  • Remove MyGet feeds from test nuget.config (Internal 14147)
    • +
  • Update WXS file for 7.0.4 (Internal 14122)
    • +
  • Update .NET dependencies for 7.0.4 (Internal 14104)
    • +
  • Fix 7.0.4 `Get-Module` test failure (Internal 13946)
    • +
  • Fix directory creation failure (Internal 13904)
    • +
  • Disable WMF link invocation test (#13479)
    • +
  • Use PowerShell Core for build and test of package in CI build (#13223)
    • +
  • Disable libmi dependent tests for macOS. (#14446)
    • +
  • Use one feed in each nuget.config in official builds (#14363)
    • +
  • Fix path signed RPMs are uploaded from in release build (#14424)
    • +
  • Fix syntax error in Windows packaging script (#14377)
    • +
  • Make AppLocker Enforce mode take precedence over UMCI Audit mode (#14353)
    • +
  • Fix issue with unsigned build (#14367)
    • +
  • Move macOS and NuGet to ESRP signing (#14324)
    • +
  • Move Windows package signing to use ESRP (#14060)
    • +
  • Move Linux to ESRP signing (#14210)
    • +
  • Migrate 3rd party signing to ESRP (#14010)
    • +
  • Don't do a shallow checkout (#13992)
    • +
  • Move to ESRP signing for Windows files (#13988)
    • +
  • Fix breaks in packages daily build due to macOS signing changes (#13421)
    • +
  • Sign individual files in package (#13392)
    • +
  • Use Authenticode certificate for MSIX signing (#13330)
    • +
  • Sign the MSIX files for the store (#12582)
    • +
  • Use temporary personal path at runspace startup when $env:HOME not defined (#13239)
    • +
  • Fix MSIX packaging to determine if a preview release by inspecting the semantic version string (#11991)
    • +
  • Add default help content to the assets folder (#13257)
    • +
+ +
+ +[7.0.4]: https://github.com/PowerShell/PowerShell/compare/v7.0.3...v7.0.4 + ## [7.0.3] - 2020-07-16 ### Tests