From 55c6e16d13ee7f31011a743f6fd372054f182713 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Tue, 17 Nov 2020 13:02:00 -0800 Subject: [PATCH 1/6] move linux to esrp signing --- .../azureDevOps/templates/linux.yml | 77 +++++++++++-------- 1 file changed, 45 insertions(+), 32 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/linux.yml b/tools/releaseBuild/azureDevOps/templates/linux.yml index 5c94fce0c26..5263217404e 100644 --- a/tools/releaseBuild/azureDevOps/templates/linux.yml +++ b/tools/releaseBuild/azureDevOps/templates/linux.yml @@ -7,11 +7,16 @@ jobs: - job: build_${{ parameters.buildName }} displayName: Build ${{ parameters.buildName }} condition: succeeded() - pool: Hosted Ubuntu 1604 + pool: + vmImage: ubuntu-16.04 dependsOn: ${{ parameters.parentJob }} variables: - build: ${{ parameters.buildName }} - runCodesignValidationInjection: false + - name: runCodesignValidationInjection + value: false + - name: build + value: ${{ parameters.buildName }} + - group: ESRP + steps: - checkout: self clean: true @@ -37,13 +42,13 @@ jobs: - powershell: | - import-module ./build.psm1 + import-module "$env:REPOROOT/build.psm1" Sync-PSTags -AddRemoteIfMissing displayName: SyncTags condition: and(succeeded(), ne(variables['SkipBuild'], 'true')) - powershell: | - tools/releaseBuild/vstsbuild.ps1 -ReleaseTag $(ReleaseTagVar) -Name '$(build)' + & "$env:REPOROOT/tools/releaseBuild/vstsbuild.ps1" -ReleaseTag $(ReleaseTagVar) -Name '$(build)' displayName: 'Build and package' condition: and(succeeded(), ne(variables['SkipBuild'], 'true')) @@ -52,10 +57,19 @@ jobs: displayName: ${{ parameters.uploadDisplayName }} ${{ parameters.buildName }} dependsOn: build_${{ parameters.buildName }} condition: succeeded() - pool: Package ES Standard Build + pool: + vmImage: windows-latest variables: - buildName: ${{ parameters.buildName }} + - name: buildName + value: ${{ parameters.buildName }} + - group: ESRP + steps: + - checkout: self + clean: true + + - checkout: ComplianceRepo + clean: true - template: shouldSign.yml @@ -86,32 +100,29 @@ jobs: downloadPath: '$(System.ArtifactsDirectory)\rpm' condition: and(eq(variables['buildName'], 'RPM'),succeeded()) - - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3 - displayName: 'Run Defender Scan' - - - powershell: | - $authenticodefiles = @() - Get-ChildItem -Path '$(System.ArtifactsDirectory)\rpm\*.rpm' -recurse | ForEach-Object { $authenticodefiles += $_.FullName} - tools/releaseBuild/generatePackgeSigning.ps1 -LinuxFiles $authenticodeFiles -path "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Generate RPM Signing Xml' - condition: and(and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM')) - - - powershell: | - Get-Content "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Capture RPM signing xml' - condition: and(and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM')) - - - task: PkgESCodeSign@10 - displayName: 'CodeSign RPM $(System.ArtifactsDirectory)\package.xml' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) + - task: SFP.build-tasks.custom-build-task-2.EsrpMalwareScanning@1 + displayName: 'Malware Scanning' inputs: - signConfigXml: '$(System.ArtifactsDirectory)\package.xml' - outPathRoot: '$(Build.StagingDirectory)\signedPackages' - binVersion: $(SigingVersion) - binVersionOverride: $(SigningVersionOverride) - condition: and(and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM')) - + ConnectedServiceName: pwshEsrpScanning + FolderPath: $(System.ArtifactsDirectory) + Pattern: | + **\*.rpm + **\*.deb + **\*.tar.gz + UseMinimatch: true + SessionTimeout: 30 + + - ${{ if eq(variables['buildName'], 'RPM') }}: + - template: EsrpSign.yml@ComplianceRepo + parameters: + buildOutputPath: $(System.ArtifactsDirectory)\rpm + signOutputPath: $(Build.StagingDirectory)\signedPackages + certificateId: "CP-450779-Pgp" + pattern: | + **\*.rpm + useMinimatch: true + + # requires windows - task: AzureFileCopy@4 displayName: 'Upload to Azure - DEB and tar.gz' inputs: @@ -125,6 +136,7 @@ jobs: parameters: artifactPath: $(System.ArtifactsDirectory)\finished\release + # requires windows - task: AzureFileCopy@4 displayName: 'Upload to Azure - RPM - Unsigned' inputs: @@ -135,6 +147,7 @@ jobs: ContainerName: '$(AzureVersion)' condition: and(and(succeeded(), ne(variables['SHOULD_SIGN'], 'true')),eq(variables['buildName'], 'RPM')) + # requires windows - task: AzureFileCopy@4 displayName: 'Upload to Azure - RPM - Signed' inputs: From 605e9424e256fa5a40d628723ea3fa67b54d8514 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Tue, 17 Nov 2020 13:02:11 -0800 Subject: [PATCH 2/6] move nuget to esrp signing --- .../azureDevOps/templates/nuget.yml | 54 +++++++++---------- 1 file changed, 26 insertions(+), 28 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/nuget.yml b/tools/releaseBuild/azureDevOps/templates/nuget.yml index 0e81e337aed..d6baea04afa 100644 --- a/tools/releaseBuild/azureDevOps/templates/nuget.yml +++ b/tools/releaseBuild/azureDevOps/templates/nuget.yml @@ -12,17 +12,29 @@ jobs: timeoutInMinutes: 90 variables: - runCodesignValidationInjection: false - GenAPIToolPath: '$(System.ArtifactsDirectory)/GenAPI' - PackagePath: '$(System.ArtifactsDirectory)/UnifiedPackagePath' - winFxdPath: '$(System.ArtifactsDirectory)/winFxd' - winFxdWinDesktopPath: '$(System.ArtifactsDirectory)/winFxdWinDesktop' - linuxFxdPath: '$(System.ArtifactsDirectory)/linuxFxd' + - name: runCodesignValidationInjection + value: false + - name: build + value: ${{ parameters.buildName }} + - group: ESRP + - name: GenAPIToolPath + value: '$(System.ArtifactsDirectory)/GenAPI' + - name: PackagePath + value: '$(System.ArtifactsDirectory)/UnifiedPackagePath' + - name: winFxdPath + value: '$(System.ArtifactsDirectory)/winFxd' + - name: winFxdWinDesktopPath + value: '$(System.ArtifactsDirectory)/winFxdWinDesktop' + - name: linuxFxdPath + value: '$(System.ArtifactsDirectory)/linuxFxd' steps: - checkout: self clean: true + - checkout: ComplianceRepo + clean: true + - powershell: | $content = Get-Content "$(Build.SourcesDirectory)/global.json" -Raw | ConvertFrom-Json $vstsCommandString = "vso[task.setvariable variable=SDKVersion]$($content.sdk.version)" @@ -117,28 +129,14 @@ jobs: Get-ChildItem "$(PackagePath)" -Recurse displayName: Capture generated packages - - powershell: | - $packages = Get-ChildItem "$(PackagePath)\*.nupkg", "$(PackagePath)\globaltool\*.nupkg" | Select-Object -ExpandProperty FullName - - if($packages.Count -lt 1) - { - throw "No packages created" - } - - $(Build.SourcesDirectory)\tools\releaseBuild\generatePackgeSigning.ps1 -Path $(PackagePath)\NugetSigning.xml -NuPkgFiles $packages - displayName: Create signing file - - - task: PkgESCodeSign@10 - displayName: 'CodeSign Nuget Packages' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(PackagePath)\NugetSigning.xml' - inPathRoot: '$(PackagePath)' - outPathRoot: '$(System.ArtifactsDirectory)\signed' - binVersion: $(SigingVersion) - binVersionOverride: $(SigningVersionOverride) - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + - template: EsrpSign.yml@ComplianceRepo + parameters: + buildOutputPath: $(PackagePath) + signOutputPath: $(System.ArtifactsDirectory)\signed + certificateId: "CP-401405" + pattern: | + **\*.nupkg + useMinimatch: true - pwsh: | if (-not (Test-Path '$(System.ArtifactsDirectory)\signed\')) { $null = New-Item -ItemType Directory -Path '$(System.ArtifactsDirectory)\signed\' } From 469ac903bea1897c209f03dba56fbda0f1541838 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Tue, 17 Nov 2020 13:23:24 -0800 Subject: [PATCH 3/6] fix nuget config creation --- .../azureDevOps/templates/insert-nuget-config-azfeed.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml b/tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml index ae697e70e33..d768a876372 100644 --- a/tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml +++ b/tools/releaseBuild/azureDevOps/templates/insert-nuget-config-azfeed.yml @@ -1,9 +1,9 @@ steps: - powershell: | - Import-Module $(Build.SourcesDirectory)/build.psm1 -Force - New-NugetConfigFile -NugetFeedUrl $(AzDevOpsFeed) -UserName $(AzDevOpsFeedUserName) -ClearTextPAT $(AzDevOpsFeedPAT) -FeedName AzDevOpsFeed -Destination $(Build.SourcesDirectory)/src/Modules + Import-Module $env:REPOROOT/build.psm1 -Force + New-NugetConfigFile -NugetFeedUrl $(AzDevOpsFeed) -UserName $(AzDevOpsFeedUserName) -ClearTextPAT $(AzDevOpsFeedPAT) -FeedName AzDevOpsFeed -Destination $env:REPOROOT/src/Modules - if(-not (Test-Path "$(Build.SourcesDirectory)/src/Modules/nuget.config")) + if(-not (Test-Path "$env:REPOROOT/src/Modules/nuget.config")) { throw "nuget.config is not created" } From cd46ef7a83440f6c30d337261148e3d376960f94 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Wed, 18 Nov 2020 09:48:11 -0800 Subject: [PATCH 4/6] REVERT ME - switch to pgp branch --- tools/releaseBuild/azureDevOps/releaseBuild.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/releaseBuild/azureDevOps/releaseBuild.yml b/tools/releaseBuild/azureDevOps/releaseBuild.yml index 5e87ff58ec7..9980a7cffbc 100644 --- a/tools/releaseBuild/azureDevOps/releaseBuild.yml +++ b/tools/releaseBuild/azureDevOps/releaseBuild.yml @@ -16,7 +16,7 @@ resources: type: github endpoint: ComplianceGHRepo name: PowerShell/compliance - ref: master + ref: pgp variables: - name: DOTNET_CLI_TELEMETRY_OPTOUT From f67733f830110bd171f5afb19be906cf1d35194a Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Thu, 19 Nov 2020 12:11:22 -0800 Subject: [PATCH 5/6] Revert "move nuget to esrp signing" This reverts commit 605e9424e256fa5a40d628723ea3fa67b54d8514. --- .../azureDevOps/templates/nuget.yml | 54 ++++++++++--------- 1 file changed, 28 insertions(+), 26 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/nuget.yml b/tools/releaseBuild/azureDevOps/templates/nuget.yml index d6baea04afa..0e81e337aed 100644 --- a/tools/releaseBuild/azureDevOps/templates/nuget.yml +++ b/tools/releaseBuild/azureDevOps/templates/nuget.yml @@ -12,29 +12,17 @@ jobs: timeoutInMinutes: 90 variables: - - name: runCodesignValidationInjection - value: false - - name: build - value: ${{ parameters.buildName }} - - group: ESRP - - name: GenAPIToolPath - value: '$(System.ArtifactsDirectory)/GenAPI' - - name: PackagePath - value: '$(System.ArtifactsDirectory)/UnifiedPackagePath' - - name: winFxdPath - value: '$(System.ArtifactsDirectory)/winFxd' - - name: winFxdWinDesktopPath - value: '$(System.ArtifactsDirectory)/winFxdWinDesktop' - - name: linuxFxdPath - value: '$(System.ArtifactsDirectory)/linuxFxd' + runCodesignValidationInjection: false + GenAPIToolPath: '$(System.ArtifactsDirectory)/GenAPI' + PackagePath: '$(System.ArtifactsDirectory)/UnifiedPackagePath' + winFxdPath: '$(System.ArtifactsDirectory)/winFxd' + winFxdWinDesktopPath: '$(System.ArtifactsDirectory)/winFxdWinDesktop' + linuxFxdPath: '$(System.ArtifactsDirectory)/linuxFxd' steps: - checkout: self clean: true - - checkout: ComplianceRepo - clean: true - - powershell: | $content = Get-Content "$(Build.SourcesDirectory)/global.json" -Raw | ConvertFrom-Json $vstsCommandString = "vso[task.setvariable variable=SDKVersion]$($content.sdk.version)" @@ -129,14 +117,28 @@ jobs: Get-ChildItem "$(PackagePath)" -Recurse displayName: Capture generated packages - - template: EsrpSign.yml@ComplianceRepo - parameters: - buildOutputPath: $(PackagePath) - signOutputPath: $(System.ArtifactsDirectory)\signed - certificateId: "CP-401405" - pattern: | - **\*.nupkg - useMinimatch: true + - powershell: | + $packages = Get-ChildItem "$(PackagePath)\*.nupkg", "$(PackagePath)\globaltool\*.nupkg" | Select-Object -ExpandProperty FullName + + if($packages.Count -lt 1) + { + throw "No packages created" + } + + $(Build.SourcesDirectory)\tools\releaseBuild\generatePackgeSigning.ps1 -Path $(PackagePath)\NugetSigning.xml -NuPkgFiles $packages + displayName: Create signing file + + - task: PkgESCodeSign@10 + displayName: 'CodeSign Nuget Packages' + env: + SYSTEM_ACCESSTOKEN: $(System.AccessToken) + inputs: + signConfigXml: '$(PackagePath)\NugetSigning.xml' + inPathRoot: '$(PackagePath)' + outPathRoot: '$(System.ArtifactsDirectory)\signed' + binVersion: $(SigingVersion) + binVersionOverride: $(SigningVersionOverride) + condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - pwsh: | if (-not (Test-Path '$(System.ArtifactsDirectory)\signed\')) { $null = New-Item -ItemType Directory -Path '$(System.ArtifactsDirectory)\signed\' } From 730a706bb38e51e04e181b2a09fe842ce7b3c610 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Fri, 20 Nov 2020 11:00:29 -0800 Subject: [PATCH 6/6] Revert "REVERT ME - switch to pgp branch" This reverts commit cd46ef7a83440f6c30d337261148e3d376960f94. --- tools/releaseBuild/azureDevOps/releaseBuild.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/releaseBuild/azureDevOps/releaseBuild.yml b/tools/releaseBuild/azureDevOps/releaseBuild.yml index 9980a7cffbc..5e87ff58ec7 100644 --- a/tools/releaseBuild/azureDevOps/releaseBuild.yml +++ b/tools/releaseBuild/azureDevOps/releaseBuild.yml @@ -16,7 +16,7 @@ resources: type: github endpoint: ComplianceGHRepo name: PowerShell/compliance - ref: pgp + ref: master variables: - name: DOTNET_CLI_TELEMETRY_OPTOUT