From 24053d1ea89b7c5c09cd47d30633ab107fb641ae Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Fri, 6 Nov 2020 14:13:01 -0800 Subject: [PATCH 1/5] Move 3rd party signing to ESRP --- .../templates/windows-packaging.yml | 47 ++++++++++++++----- 1 file changed, 34 insertions(+), 13 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml index e914c894d84..068981587c0 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml @@ -171,29 +171,50 @@ jobs: $dlls = Get-ChildItem $BuildPath\*.dll -Recurse $signatures = $dlls | Get-AuthenticodeSignature $missingSignatures = $signatures | Where-Object { $_.status -eq 'notsigned'}| select-object -ExpandProperty Path - & "${env:REPOROOT}/tools/releaseBuild/generatePackgeSigning.ps1" -ThirdPartyFiles $missingSignatures -path "$(System.ArtifactsDirectory)\thirtdparty.xml" - displayName: Create ThirdParty Signing Xml - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - task: PkgESCodeSign@10 - displayName: 'CodeSign ThirdParty $(Architecture)' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(System.ArtifactsDirectory)\thirtdparty.xml' - inPathRoot: '$(System.ArtifactsDirectory)\$(SymbolsFolder)' - outPathRoot: '$(System.ArtifactsDirectory)\signedThirdParty' + Write-Verbose -verbose "to be signed:`r`n $($missingSignatures | Out-String)" + + $filesToSignDirectory = "$(System.ArtifactsDirectory)\thirdPartyToBeSigned" + $null = New-Item -ItemType Directory -Path $filesToSignDirectory -Force + + $signedFilesDirectory = "$(System.ArtifactsDirectory)\thirdPartySigned" + $null = New-Item -ItemType Directory -Path $signedFilesDirectory -Force + + $missingSignatures | %{ + Copy-Item -Path $_ -Destination $filesToSignDirectory + } + + displayName: Create ThirdParty Signing Folder condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + - template: EsrpSign.yml@ComplianceRepo + parameters: + buildOutputPath: $(System.ArtifactsDirectory)\thirdPartyToBeSigned + signOutputPath: $(System.ArtifactsDirectory)\thirdPartySigned + certificateId: "CP-231522" + pattern: | + **\*.dll + useMinimatch: true + + # - task: PkgESCodeSign@10 + # displayName: 'CodeSign ThirdParty $(Architecture)' + # env: + # SYSTEM_ACCESSTOKEN: $(System.AccessToken) + # inputs: + # signConfigXml: '$(System.ArtifactsDirectory)\thirtdparty.xml' + # inPathRoot: '$(System.ArtifactsDirectory)\$(SymbolsFolder)' + # outPathRoot: '$(System.ArtifactsDirectory)\signedThirdParty' + # condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + - powershell: | - Get-ChildItem '$(System.ArtifactsDirectory)\signedThirdParty\*' + Get-ChildItem '$(System.ArtifactsDirectory)\thirdPartySigned\*' displayName: Captrue ThirdParty Signed files condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - powershell: | Import-Module $(PowerShellRoot)/build.psm1 -Force Import-Module $(PowerShellRoot)/tools/packaging -Force - $signedFilesPath = '$(System.ArtifactsDirectory)\signedThirdParty\' + $signedFilesPath = '$(System.ArtifactsDirectory)\thirdPartySigned' $BuildPath = '$(System.ArtifactsDirectory)\$(SymbolsFolder)' Update-PSSignedBuildFolder -BuildPath $BuildPath -SignedFilesPath $SignedFilesPath From 2f941f96888fc8319bc86b8510e507243f1bf756 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Fri, 6 Nov 2020 16:32:16 -0800 Subject: [PATCH 2/5] Add unsigned powershell files --- .../azureDevOps/templates/windows-packaging.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml index 068981587c0..77207d0635d 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml @@ -113,8 +113,8 @@ jobs: $null = New-Item -ItemType Directory -Path $signedFilesDirectory -Force $itemsToCopyWithRecurse = @( - "$($fullSymbolsFolder)\*.ps1" - "$($fullSymbolsFolder)\Microsoft.PowerShell*.dll" + "$($fullSymbolsFolder)\*.ps1" + "$($fullSymbolsFolder)\Microsoft.PowerShell*.dll" ) $itemsToCopy = @{ @@ -125,6 +125,11 @@ jobs: "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\Diagnostics.format.ps1xml" = "Modules\Microsoft.PowerShell.Diagnostics" "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\Event.format.ps1xml" = "Modules\Microsoft.PowerShell.Diagnostics" "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\GetEvent.types.ps1xml" = "Modules\Microsoft.PowerShell.Diagnostics" + "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Diagnostics\Microsoft.PowerShell.Diagnostics.psd1" = "Modules\Microsoft.PowerShell.Diagnostics" + "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Host\Microsoft.PowerShell.Host.psd1" = "Modules\Microsoft.PowerShell.Host" + "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1" = "Modules\Microsoft.PowerShell.Management" + "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1" = "Modules\Microsoft.PowerShell.Security" + "$($fullSymbolsFolder)\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1" = "Modules\Microsoft.PowerShell.Utility" "$($fullSymbolsFolder)\Modules\Microsoft.WSMan.Management\Microsoft.WSMan.Management.psd1" = "Modules\Microsoft.WSMan.Management" "$($fullSymbolsFolder)\Modules\Microsoft.WSMan.Management\WSMan.format.ps1xml" = "Modules\Microsoft.WSMan.Management" "$($fullSymbolsFolder)\Modules\PSDiagnostics\PSDiagnostics.ps?1" = "Modules\PSDiagnostics" @@ -159,6 +164,7 @@ jobs: **\*.psm1 **\*.ps1xml **\*.ps1 + **\*.exe useMinimatch: true - pwsh: | From cb4eea3e3ca535744f3880024a57c096d22680d7 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Sun, 8 Nov 2020 13:40:21 -0800 Subject: [PATCH 3/5] remove comment --- .../azureDevOps/templates/windows-packaging.yml | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml index 77207d0635d..bd6aec7bf38 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml @@ -202,16 +202,6 @@ jobs: **\*.dll useMinimatch: true - # - task: PkgESCodeSign@10 - # displayName: 'CodeSign ThirdParty $(Architecture)' - # env: - # SYSTEM_ACCESSTOKEN: $(System.AccessToken) - # inputs: - # signConfigXml: '$(System.ArtifactsDirectory)\thirtdparty.xml' - # inPathRoot: '$(System.ArtifactsDirectory)\$(SymbolsFolder)' - # outPathRoot: '$(System.ArtifactsDirectory)\signedThirdParty' - # condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - powershell: | Get-ChildItem '$(System.ArtifactsDirectory)\thirdPartySigned\*' displayName: Captrue ThirdParty Signed files From 2df660d8490a6201e5cfe6664a63b337f6453179 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Mon, 9 Nov 2020 12:29:59 -0800 Subject: [PATCH 4/5] use hosted machine --- .../azureDevOps/templates/windows-packaging.yml | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml index bd6aec7bf38..72c8cc1bf27 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml @@ -14,7 +14,7 @@ jobs: condition: succeeded() dependsOn: ${{ parameters.parentJob }} pool: - name: Package ES Standard Build + vmImage: windows-latest variables: - name: BuildConfiguration value: ${{ parameters.BuildConfiguration }} @@ -39,19 +39,6 @@ jobs: parameters: ReleaseTagVar: $(ReleaseTagVar) - - task: PkgESSetupBuild@10 - displayName: 'Initialize build' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - useDfs: false - productName: PowerShellCore - branchVersion: true - disableWorkspace: true - disableBuildTools: true - disableNugetPack: true - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - powershell: | $pkgFilter = if ( '$(Architecture)' -eq 'arm' ) { "arm32" From 72ac3faa701745c9f5991421eb29c26deb127f0d Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Wed, 11 Nov 2020 12:04:38 -0800 Subject: [PATCH 5/5] Update tools/releaseBuild/azureDevOps/templates/windows-packaging.yml Co-authored-by: Robert Holt --- tools/releaseBuild/azureDevOps/templates/windows-packaging.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml index 72c8cc1bf27..a89a397f343 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-packaging.yml @@ -173,7 +173,7 @@ jobs: $signedFilesDirectory = "$(System.ArtifactsDirectory)\thirdPartySigned" $null = New-Item -ItemType Directory -Path $signedFilesDirectory -Force - $missingSignatures | %{ + $missingSignatures | ForEach-Object { Copy-Item -Path $_ -Destination $filesToSignDirectory }