From e2522d2050acfbb633661c28da9ef5be3a431430 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Tue, 17 Nov 2020 13:02:11 -0800 Subject: [PATCH 01/11] move nuget to esrp signing --- .../azureDevOps/templates/nuget.yml | 54 +++++++++---------- 1 file changed, 26 insertions(+), 28 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/nuget.yml b/tools/releaseBuild/azureDevOps/templates/nuget.yml index 0e81e337aed..d6baea04afa 100644 --- a/tools/releaseBuild/azureDevOps/templates/nuget.yml +++ b/tools/releaseBuild/azureDevOps/templates/nuget.yml @@ -12,17 +12,29 @@ jobs: timeoutInMinutes: 90 variables: - runCodesignValidationInjection: false - GenAPIToolPath: '$(System.ArtifactsDirectory)/GenAPI' - PackagePath: '$(System.ArtifactsDirectory)/UnifiedPackagePath' - winFxdPath: '$(System.ArtifactsDirectory)/winFxd' - winFxdWinDesktopPath: '$(System.ArtifactsDirectory)/winFxdWinDesktop' - linuxFxdPath: '$(System.ArtifactsDirectory)/linuxFxd' + - name: runCodesignValidationInjection + value: false + - name: build + value: ${{ parameters.buildName }} + - group: ESRP + - name: GenAPIToolPath + value: '$(System.ArtifactsDirectory)/GenAPI' + - name: PackagePath + value: '$(System.ArtifactsDirectory)/UnifiedPackagePath' + - name: winFxdPath + value: '$(System.ArtifactsDirectory)/winFxd' + - name: winFxdWinDesktopPath + value: '$(System.ArtifactsDirectory)/winFxdWinDesktop' + - name: linuxFxdPath + value: '$(System.ArtifactsDirectory)/linuxFxd' steps: - checkout: self clean: true + - checkout: ComplianceRepo + clean: true + - powershell: | $content = Get-Content "$(Build.SourcesDirectory)/global.json" -Raw | ConvertFrom-Json $vstsCommandString = "vso[task.setvariable variable=SDKVersion]$($content.sdk.version)" @@ -117,28 +129,14 @@ jobs: Get-ChildItem "$(PackagePath)" -Recurse displayName: Capture generated packages - - powershell: | - $packages = Get-ChildItem "$(PackagePath)\*.nupkg", "$(PackagePath)\globaltool\*.nupkg" | Select-Object -ExpandProperty FullName - - if($packages.Count -lt 1) - { - throw "No packages created" - } - - $(Build.SourcesDirectory)\tools\releaseBuild\generatePackgeSigning.ps1 -Path $(PackagePath)\NugetSigning.xml -NuPkgFiles $packages - displayName: Create signing file - - - task: PkgESCodeSign@10 - displayName: 'CodeSign Nuget Packages' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(PackagePath)\NugetSigning.xml' - inPathRoot: '$(PackagePath)' - outPathRoot: '$(System.ArtifactsDirectory)\signed' - binVersion: $(SigingVersion) - binVersionOverride: $(SigningVersionOverride) - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + - template: EsrpSign.yml@ComplianceRepo + parameters: + buildOutputPath: $(PackagePath) + signOutputPath: $(System.ArtifactsDirectory)\signed + certificateId: "CP-401405" + pattern: | + **\*.nupkg + useMinimatch: true - pwsh: | if (-not (Test-Path '$(System.ArtifactsDirectory)\signed\')) { $null = New-Item -ItemType Directory -Path '$(System.ArtifactsDirectory)\signed\' } From f0af739cbbb26bb9f9f80e9ca2882983bb153732 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Fri, 20 Nov 2020 12:10:47 -0800 Subject: [PATCH 02/11] move to malware signing templates --- .../azureDevOps/templates/linux.yml | 18 +++++++----------- .../templates/windows-package-signing.yml | 18 +++++++----------- 2 files changed, 14 insertions(+), 22 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/linux.yml b/tools/releaseBuild/azureDevOps/templates/linux.yml index 5263217404e..84cb532a4ee 100644 --- a/tools/releaseBuild/azureDevOps/templates/linux.yml +++ b/tools/releaseBuild/azureDevOps/templates/linux.yml @@ -100,17 +100,13 @@ jobs: downloadPath: '$(System.ArtifactsDirectory)\rpm' condition: and(eq(variables['buildName'], 'RPM'),succeeded()) - - task: SFP.build-tasks.custom-build-task-2.EsrpMalwareScanning@1 - displayName: 'Malware Scanning' - inputs: - ConnectedServiceName: pwshEsrpScanning - FolderPath: $(System.ArtifactsDirectory) - Pattern: | - **\*.rpm - **\*.deb - **\*.tar.gz - UseMinimatch: true - SessionTimeout: 30 + - template: EsrpScan.yml@ComplianceRepo + parameters: + scanPath: $(System.ArtifactsDirectory) + pattern: | + **\*.rpm + **\*.deb + **\*.tar.gz - ${{ if eq(variables['buildName'], 'RPM') }}: - template: EsrpSign.yml@ComplianceRepo diff --git a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml index 3803226958a..81c1a2228d9 100644 --- a/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml @@ -93,17 +93,13 @@ jobs: msi: no msix: no - - task: SFP.build-tasks.custom-build-task-2.EsrpMalwareScanning@1 - displayName: 'Malware Scanning' - inputs: - ConnectedServiceName: pwshEsrpScanning - FolderPath: '$(Build.StagingDirectory)' - Pattern: | - **\*.msix - **\*.msi - **\*.zip - UseMinimatch: true - SessionTimeout: 30 + - template: EsrpScan.yml@ComplianceRepo + parameters: + scanPath: $(Build.StagingDirectory) + pattern: | + **\*.msix + **\*.msi + **\*.zip - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 displayName: 'Component Detection' From a094b67ebcf500efd3b6a306821ed9f5ff2628b1 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Fri, 20 Nov 2020 12:10:47 -0800 Subject: [PATCH 03/11] move macos to esrp signing --- .../templates/mac-file-signing.yml | 39 ++++++++----------- 1 file changed, 16 insertions(+), 23 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml index fddbe5f131d..8df521aede9 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml @@ -16,6 +16,9 @@ jobs: - checkout: self clean: true + - checkout: ComplianceRepo + clean: true + - template: shouldSign.yml - template: SetVersionVariables.yml @@ -63,27 +66,14 @@ jobs: Write-Host $zipFile displayName: 'Compress macOS binary files' - - pwsh: | - $pkgFiles = "$(Build.StagingDirectory)\macos\powershell-files-$(Version)-osx-x64.zip", "$(Build.StagingDirectory)\macos\powershell-lts-$(Version)-osx-x64.zip" - tools/releaseBuild/generatePackgeSigning.ps1 -MacDeveloperFiles $pkgFiles -path "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Generate macOS binary Signing Xml' - - - pwsh: | - Get-Content "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Capture macOS signing xml' - # Diagnostics is not critical it passes every time it runs - continueOnError: true - - - task: PkgESCodeSign@10 - displayName: 'CodeSign $(System.ArtifactsDirectory)\package.xml' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(System.ArtifactsDirectory)\package.xml' - outPathRoot: '$(Build.StagingDirectory)\signedMacOSPackages' - binVersion: $(SigingVersion) - binVersionOverride: $(SigningVersionOverride) - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + - template: EsrpSign.yml@ComplianceRepo + parameters: + buildOutputPath: $(Build.StagingDirectory)\macos + signOutputPath: $(Build.StagingDirectory)\signedMacOSPackages + certificateId: "CP-401337-Apple" + pattern: | + **\*.zip + useMinimatch: true - pwsh: | $destination = "$(System.ArtifactsDirectory)\azureMacOs" @@ -100,8 +90,11 @@ jobs: artifactName: signedMacOsBins condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3 - displayName: 'Run Defender Scan' + - template: EsrpScan.yml@ComplianceRepo + parameters: + scanPath: $(System.ArtifactsDirectory)\azureMacOs + pattern: | + **\* - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 displayName: 'Component Detection' From 3548afb52977528d9ab5155067f5390b5fd2593b Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Wed, 2 Dec 2020 13:24:45 -0800 Subject: [PATCH 04/11] REVERT ME: move to using macos compliance branch --- tools/releaseBuild/azureDevOps/releaseBuild.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/releaseBuild/azureDevOps/releaseBuild.yml b/tools/releaseBuild/azureDevOps/releaseBuild.yml index 5e87ff58ec7..7b683a85d16 100644 --- a/tools/releaseBuild/azureDevOps/releaseBuild.yml +++ b/tools/releaseBuild/azureDevOps/releaseBuild.yml @@ -16,7 +16,7 @@ resources: type: github endpoint: ComplianceGHRepo name: PowerShell/compliance - ref: master + ref: macos variables: - name: DOTNET_CLI_TELEMETRY_OPTOUT From 704dbf1371d885285c6e852b8e40c22790f33409 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Wed, 2 Dec 2020 13:26:09 -0800 Subject: [PATCH 05/11] explicitly checkout the other repo --- tools/releaseBuild/azureDevOps/templates/linux.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tools/releaseBuild/azureDevOps/templates/linux.yml b/tools/releaseBuild/azureDevOps/templates/linux.yml index 84cb532a4ee..53e9b4f1924 100644 --- a/tools/releaseBuild/azureDevOps/templates/linux.yml +++ b/tools/releaseBuild/azureDevOps/templates/linux.yml @@ -21,6 +21,9 @@ jobs: - checkout: self clean: true + - checkout: ComplianceRepo + clean: true + - template: SetVersionVariables.yml parameters: ReleaseTagVar: $(ReleaseTagVar) From 788829c93d34dc36e275cc6904760eb777197f8d Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Wed, 2 Dec 2020 14:31:33 -0800 Subject: [PATCH 06/11] fix build sources in nuget --- .../releaseBuild/azureDevOps/templates/nuget.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/nuget.yml b/tools/releaseBuild/azureDevOps/templates/nuget.yml index d6baea04afa..a23b9c1ad67 100644 --- a/tools/releaseBuild/azureDevOps/templates/nuget.yml +++ b/tools/releaseBuild/azureDevOps/templates/nuget.yml @@ -35,8 +35,12 @@ jobs: - checkout: ComplianceRepo clean: true + - template: SetVersionVariables.yml + parameters: + ReleaseTagVar: $(ReleaseTagVar) + - powershell: | - $content = Get-Content "$(Build.SourcesDirectory)/global.json" -Raw | ConvertFrom-Json + $content = Get-Content "$env:REPOROOT/global.json" -Raw | ConvertFrom-Json $vstsCommandString = "vso[task.setvariable variable=SDKVersion]$($content.sdk.version)" Write-Host "sending " + $vstsCommandString Write-Host "##$vstsCommandString" @@ -102,8 +106,8 @@ jobs: displayName: 'Install NuGet.exe' - powershell: | - Import-Module $env:BUILD_SOURCESDIRECTORY\build.psm1 - Import-Module $env:BUILD_SOURCESDIRECTORY\tools\packaging + Import-Module $env:REPOROOT\build.psm1 + Import-Module $env:REPOROOT\tools\packaging Find-Dotnet New-ILNugetPackage -PackagePath "$(PackagePath)" -PackageVersion "$(Version)" -WinFxdBinPath '$(winFxdPath)' -LinuxFxdBinPath '$(linuxFxdPath)' -GenAPIToolPath "$(GenAPIToolPath)" displayName: 'Create Nuget Package Folders' @@ -115,8 +119,8 @@ jobs: displayName: Capture fxd folders - powershell: | - Import-Module $env:BUILD_SOURCESDIRECTORY\build.psm1 - Import-Module $env:BUILD_SOURCESDIRECTORY\tools\packaging + Import-Module $env:REPOROOT\build.psm1 + Import-Module $env:REPOROOT\tools\packaging Find-Dotnet # Create unified package first New-GlobalToolNupkg -UnifiedPackage -LinuxBinPath "$(linuxFxdPath)" -WindowsBinPath "$(winFxdPath)" -WindowsDesktopBinPath "$(winFxdWinDesktopPath)" -PackageVersion "$(Version)" -DestinationPath "$(PackagePath)\globaltool" @@ -146,7 +150,7 @@ jobs: condition: eq(variables['SHOULD_SIGN'], 'false') - powershell: | - Import-Module $(Build.SourcesDirectory)\build.psm1 -Force + Import-Module "${env:REPOROOT}\build.psm1" -Force Get-ChildItem -Recurse "$(System.ArtifactsDirectory)\signed\*.nupkg" -Verbose | ForEach-Object { Start-NativeExecution -sb { nuget.exe verify -All $_.FullName } } displayName: Verify all packages are signed condition: eq(variables['SHOULD_SIGN'], 'true') From e101909501e16ce134db60bac06ee39a7df40d0a Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Wed, 2 Dec 2020 15:36:34 -0800 Subject: [PATCH 07/11] add variable group --- tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml index 8df521aede9..46178671496 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-file-signing.yml @@ -9,8 +9,7 @@ jobs: pool: name: Package ES Standard Build variables: - BuildConfiguration: release - BuildPlatform: any cpu + - group: ESRP steps: - checkout: self From a668a5106a03603773761892c44f5a845a9448d0 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Wed, 2 Dec 2020 16:28:55 -0800 Subject: [PATCH 08/11] scan before upload --- tools/releaseBuild/azureDevOps/templates/mac.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tools/releaseBuild/azureDevOps/templates/mac.yml b/tools/releaseBuild/azureDevOps/templates/mac.yml index f38e9b63573..9e6d8173864 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac.yml @@ -51,6 +51,12 @@ jobs: $env:AZDEVOPSFEEDPAT = $null displayName: 'Build' + - template: EsrpScan.yml@ComplianceRepo + parameters: + scanPath: $(Build.SourcesDirectory)/macosBinResults + pattern: | + **\*.zip + - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 displayName: 'Component Detection' inputs: From 15003e57259352b402b9c19f0e68e206ad317525 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Thu, 3 Dec 2020 10:30:33 -0800 Subject: [PATCH 09/11] finish macos signing --- .../templates/mac-package-signing.yml | 38 ++++++------------- 1 file changed, 12 insertions(+), 26 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml index 05fe9114892..3e3d69dcbe5 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac-package-signing.yml @@ -9,13 +9,15 @@ jobs: pool: name: Package ES Standard Build variables: - BuildConfiguration: release - BuildPlatform: any cpu + - group: ESRP steps: - checkout: self clean: true + - checkout: ComplianceRepo + clean: true + - template: shouldSign.yml - template: SetVersionVariables.yml @@ -50,27 +52,14 @@ jobs: } displayName: 'Compress macOS Package' - - pwsh: | - $pkgFiles = "$(Build.StagingDirectory)\macos\powershell-$(Version)-osx-x64.zip", "$(Build.StagingDirectory)\macos\powershell-lts-$(Version)-osx-x64.zip" - tools/releaseBuild/generatePackgeSigning.ps1 -MacDeveloperFiles $pkgFiles -path "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Generate macOS Package Signing Xml' - - - pwsh: | - Get-Content "$(System.ArtifactsDirectory)\package.xml" - displayName: 'Capture macOS signing xml' - # Diagnostics is not critical it passes every time it runs - continueOnError: true - - - task: PkgESCodeSign@10 - displayName: 'CodeSign $(System.ArtifactsDirectory)\package.xml' - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - inputs: - signConfigXml: '$(System.ArtifactsDirectory)\package.xml' - outPathRoot: '$(Build.StagingDirectory)\signedMacOSPackages' - binVersion: $(SigingVersion) - binVersionOverride: $(SigningVersionOverride) - condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) + - template: EsrpSign.yml@ComplianceRepo + parameters: + buildOutputPath: $(Build.StagingDirectory)\macos + signOutputPath: $(Build.StagingDirectory)\signedMacOSPackages + certificateId: "CP-401337-Apple" + pattern: | + **\*.zip + useMinimatch: true - template: upload-final-results.yml parameters: @@ -120,9 +109,6 @@ jobs: ContainerName: '$(AzureVersion)' condition: and(succeeded(), eq(variables['SHOULD_SIGN'], 'true')) - - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3 - displayName: 'Run Defender Scan' - - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 displayName: 'Component Detection' inputs: From f25e009f0bbf9a3e2857111591728609ab8e2565 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Thu, 3 Dec 2020 13:47:42 -0800 Subject: [PATCH 10/11] Revert "scan before upload" This reverts commit a668a5106a03603773761892c44f5a845a9448d0. --- tools/releaseBuild/azureDevOps/templates/mac.yml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/tools/releaseBuild/azureDevOps/templates/mac.yml b/tools/releaseBuild/azureDevOps/templates/mac.yml index 9e6d8173864..f38e9b63573 100644 --- a/tools/releaseBuild/azureDevOps/templates/mac.yml +++ b/tools/releaseBuild/azureDevOps/templates/mac.yml @@ -51,12 +51,6 @@ jobs: $env:AZDEVOPSFEEDPAT = $null displayName: 'Build' - - template: EsrpScan.yml@ComplianceRepo - parameters: - scanPath: $(Build.SourcesDirectory)/macosBinResults - pattern: | - **\*.zip - - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 displayName: 'Component Detection' inputs: From 0c4d203024c95c33a04503e74f0e8b6f2bfdb02d Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Thu, 3 Dec 2020 15:12:30 -0800 Subject: [PATCH 11/11] Revert "REVERT ME: move to using macos compliance branch" This reverts commit 3548afb52977528d9ab5155067f5390b5fd2593b. --- tools/releaseBuild/azureDevOps/releaseBuild.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/releaseBuild/azureDevOps/releaseBuild.yml b/tools/releaseBuild/azureDevOps/releaseBuild.yml index 7b683a85d16..5e87ff58ec7 100644 --- a/tools/releaseBuild/azureDevOps/releaseBuild.yml +++ b/tools/releaseBuild/azureDevOps/releaseBuild.yml @@ -16,7 +16,7 @@ resources: type: github endpoint: ComplianceGHRepo name: PowerShell/compliance - ref: macos + ref: master variables: - name: DOTNET_CLI_TELEMETRY_OPTOUT