Skip to content

Commit b1fbe52

Browse files
daxian-dbwdaxian-dbw
authored
[release/v7.6.2] Fix *nix permissions and use certificate_logical_to_actual (#27439)
1 parent 4c69848 commit b1fbe52

9 files changed

Lines changed: 141 additions & 25 deletions

File tree

‎.pipelines/templates/linux-package-build.yml‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
parameters:
22
unsignedDrop: 'drop_linux_build_linux_x64'
3-
signedeDrop: 'drop_linux_sign_linux_x64'
3+
signedDrop: 'drop_linux_sign_linux_x64'
44
packageType: deb
55
jobName: 'deb'
6-
signingProfile: 'CP-450779-pgpdetached'
76

87
jobs:
98
- job: ${{ parameters.jobName }}
@@ -20,6 +19,7 @@ jobs:
2019
- name: skipNugetSecurityAnalysis
2120
value: true
2221
- group: DotNetPrivateBuildAccess
22+
- group: certificate_logical_to_actual
2323
- name: ob_outputDirectory
2424
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
2525
- name: ob_sdl_binskim_enabled
@@ -34,8 +34,16 @@ jobs:
3434
value: $(Build.SourcesDirectory)/PowerShell/.config/tsaoptions.json
3535
- name: ob_sdl_credscan_suppressionsFile
3636
value: $(Build.SourcesDirectory)/PowerShell/.config/suppress.json
37-
- name: SigningProfile
38-
value: ${{ parameters.signingProfile }}
37+
# PGP signing profile selection: Mariner (Azure Linux) packages ship through
38+
# a different distribution channel and must be signed with the Mariner release
39+
# key; all other Linux packages use the standard PowerShell Linux key. Both
40+
# key codes come from the `certificate_logical_to_actual` variable group.
41+
- ${{ if startsWith(parameters.jobName, 'mariner') }}:
42+
- name: SigningProfile
43+
value: $(pgp_release_cert_id)
44+
- ${{ else }}:
45+
- name: SigningProfile
46+
value: $(pgp_linux_cert_id)
3947

4048
steps:
4149
- checkout: self
@@ -193,6 +201,13 @@ jobs:
193201
$pkgPath = Get-ChildItem -Path $(Pipeline.Workspace) -Filter $pkgFilter -Recurse -File | Select-Object -ExpandProperty FullName
194202
Write-Verbose -Verbose "pkgPath: $pkgPath"
195203
Copy-Item -Path $pkgPath -Destination '$(ob_outputDirectory)' -Force -Verbose
204+
205+
if ($pkgPath -like '*.tar.gz') {
206+
$entry = & tar -tzvf $pkgPath | Where-Object { $_ -match '\spwsh$' } | Select-Object -First 1
207+
if ($entry -notmatch '^-..x') {
208+
throw "pwsh is not executable in $pkgPath : $entry"
209+
}
210+
}
196211
displayName: 'Copy artifacts to output directory'
197212
env:
198213
__DOTNET_RUNTIME_FEED_KEY: $(RUNTIME_SOURCEFEED_KEY)

‎.pipelines/templates/mac-package-build.yml‎

Lines changed: 59 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ jobs:
2222
- name: skipNugetSecurityAnalysis
2323
value: true
2424
- group: DotNetPrivateBuildAccess
25+
- group: certificate_logical_to_actual
2526
- name: ob_outputDirectory
2627
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
2728
- name: ob_sdl_binskim_enabled
@@ -76,6 +77,14 @@ jobs:
7677
# Diagnostics is not critical it passes every time it runs
7778
continueOnError: true
7879
80+
- pwsh: |
81+
$signedDir = "$(Pipeline.Workspace)/CoOrdinatedBuildPipeline/drop_macos_sign_${{ parameters.buildArchitecture }}/Signed-${{ parameters.buildArchitecture }}"
82+
Get-ChildItem $signedDir -Recurse -Include 'pwsh', '*.dylib' | ForEach-Object {
83+
codesign --verify --deep --strict --verbose=4 $_.FullName
84+
if ($LASTEXITCODE -ne 0) { throw "codesign verification failed for $($_.FullName)" }
85+
}
86+
displayName: 'Verify Apple codesign on signed binaries'
87+
7988
- pwsh: |
8089
# Add -SkipReleaseChecks as a mitigation to unblock release.
8190
# macos-10.15 does not allow creating a folder under root. Hence, moving the folder.
@@ -154,11 +163,20 @@ jobs:
154163
155164
foreach($t in $tarPkgPath) {
156165
$file = $t.FullName
166+
$entry = & tar -tzvf $file | Where-Object { $_ -match '\spwsh$' } | Select-Object -First 1
167+
if ($entry -notmatch '^-..x') {
168+
throw "pwsh is not executable in $file : $entry"
169+
}
157170
Write-Verbose -verbose "Uploading $file to macos-pkgs"
158171
Write-Host "##vso[artifact.upload containerfolder=macos-pkgs;artifactname=macos-pkgs]$file"
159172
}
160173
174+
$packageInfo = Get-MacOSPackageIdentifierInfo -Version '$(Version)' -LTS:$LTS
175+
Write-Verbose -Verbose "BundleId: $($packageInfo.PackageIdentifier)"
176+
Write-Host "##vso[task.setvariable variable=BundleId;isOutput=true]$($packageInfo.PackageIdentifier)"
177+
161178
displayName: 'Package ${{ parameters.buildArchitecture}}'
179+
name: packageStep
162180
env:
163181
__DOTNET_RUNTIME_FEED_KEY: $(RUNTIME_SOURCEFEED_KEY)
164182
@@ -170,6 +188,7 @@ jobs:
170188
type: windows
171189

172190
variables:
191+
- group: certificate_logical_to_actual
173192
- name: ob_outputDirectory
174193
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
175194
- name: ob_sdl_binskim_enabled
@@ -178,7 +197,8 @@ jobs:
178197
value: $(Build.SourcesDirectory)/PowerShell/.config/suppress.json
179198
- name: BuildArch
180199
value: ${{ parameters.buildArchitecture }}
181-
- group: mscodehub-macos-package-signing
200+
- name: BundleId
201+
value: $[ dependencies.package_macOS_${{ parameters.buildArchitecture }}.outputs['packageStep.BundleId'] ]
182202

183203
steps:
184204
- download: current
@@ -216,32 +236,59 @@ jobs:
216236
inline_operation: |
217237
[
218238
{
219-
"KeyCode": "$(KeyCode)",
239+
"KeyCode": "$(apple_cert_id)",
220240
"OperationCode": "MacAppDeveloperSign",
221241
"ToolName": "sign",
222242
"ToolVersion": "1.0",
223243
"Parameters": {
224-
"Hardening": "Enable",
225-
"OpusInfo": "http://microsoft.com"
244+
"Hardening": "--options=runtime"
245+
}
246+
}
247+
]
248+
249+
- task: onebranch.pipeline.signing@1
250+
displayName: 'OneBranch Notarize Package'
251+
inputs:
252+
command: 'sign'
253+
files_to_sign: '**/*-osx-*.zip'
254+
search_root: '$(Pipeline.Workspace)'
255+
inline_operation: |
256+
[
257+
{
258+
"KeyCode": "$(apple_cert_id)",
259+
"OperationCode": "MacAppNotarize",
260+
"ToolName": "sign",
261+
"ToolVersion": "1.0",
262+
"Parameters": {
263+
"BundleId": "$(BundleId)"
226264
}
227265
}
228266
]
267+
timeoutInMinutes: 120
229268

230269
- pwsh: |
231270
$signedPkg = Get-ChildItem -Path $(Pipeline.Workspace) -Filter "*osx*.zip" -File
232271
272+
if (-not (Test-Path $(ob_outputDirectory))) {
273+
$null = New-Item -Path $(ob_outputDirectory) -ItemType Directory
274+
}
275+
276+
$expandDir = "$(Pipeline.Workspace)/pkgExpand"
277+
$null = New-Item -Path $expandDir -ItemType Directory -Force
278+
233279
$signedPkg | ForEach-Object {
234280
Write-Verbose -Verbose "Signed package zip: $_"
281+
Expand-Archive -Path $_ -DestinationPath $expandDir -Verbose
282+
}
235283
236-
if (-not (Test-Path $_)) {
237-
throw "Package not found: $_"
238-
}
239-
240-
if (-not (Test-Path $(ob_outputDirectory))) {
241-
$null = New-Item -Path $(ob_outputDirectory) -ItemType Directory
242-
}
284+
# ESRP's signing pipeline nests the PKG inside a '<hash>.zip.unzipped' subfolder
285+
$pkgFile = Get-ChildItem -Path $expandDir -Filter '*.pkg' -Recurse -File
286+
if (-not $pkgFile) {
287+
throw "Package not found in: $signedPkg"
288+
}
243289
244-
Expand-Archive -Path $_ -DestinationPath $(ob_outputDirectory) -Verbose
290+
$pkgFile | ForEach-Object {
291+
Move-Item -Path $_ -Destination $(ob_outputDirectory) -Verbose
245292
}
246293
247294
Write-Verbose -Verbose "Expanded pkg file:"

‎.pipelines/templates/mac.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,4 +152,36 @@ jobs:
152152
binPath: $(DropRootPath)
153153
OfficialBuild: $(ps_official_build)
154154

155+
# Apple-sign the Mach-O binaries inside the signed output.
156+
- pwsh: |
157+
$signedDir = "$(ob_outputDirectory)/Signed-$(Runtime)"
158+
$zipFile = "$(Pipeline.Workspace)/macho-$(BuildArchitecture).zip"
159+
Compress-Archive -Path "$signedDir/*" -DestinationPath $zipFile -Force
160+
displayName: Compress signed folder for Apple signing
161+
162+
- task: onebranch.pipeline.signing@1
163+
displayName: Apple CodeSign Mach-O binaries
164+
inputs:
165+
command: 'sign'
166+
files_to_sign: 'macho-$(BuildArchitecture).zip'
167+
search_root: '$(Pipeline.Workspace)'
168+
inline_operation: |
169+
[
170+
{
171+
"KeyCode": "$(apple_cert_id)",
172+
"OperationCode": "MacAppDeveloperSign",
173+
"ToolName": "sign",
174+
"ToolVersion": "1.0",
175+
"Parameters": {
176+
"Hardening": "--options=runtime"
177+
}
178+
}
179+
]
180+
181+
- pwsh: |
182+
$signedDir = "$(ob_outputDirectory)/Signed-$(Runtime)"
183+
$zipFile = "$(Pipeline.Workspace)/macho-$(BuildArchitecture).zip"
184+
Expand-Archive -Path $zipFile -DestinationPath $signedDir -Force -Verbose
185+
displayName: Expand Apple-signed Mach-O binaries into signed output
186+
155187
- template: /.pipelines/templates/step/finalize.yml@self

‎.pipelines/templates/nupkg.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ jobs:
2323
- group: mscodehub-feed-read-general
2424
- group: mscodehub-feed-read-akv
2525
- group: DotNetPrivateBuildAccess
26+
- group: certificate_logical_to_actual
2627

2728
steps:
2829
- checkout: self
@@ -208,7 +209,7 @@ jobs:
208209
displayName: Sign nupkg files
209210
inputs:
210211
command: 'sign'
211-
cp_code: 'CP-401405'
212+
cp_code: '$(nuget_cert_id)'
212213
files_to_sign: '**\*.nupkg'
213214
search_root: '$(Pipeline.Workspace)\nupkg'
214215

@@ -268,7 +269,7 @@ jobs:
268269
displayName: Sign nupkg files
269270
inputs:
270271
command: 'sign'
271-
cp_code: 'CP-401405'
272+
cp_code: '$(nuget_cert_id)'
272273
files_to_sign: '**\*.nupkg'
273274
search_root: '$(Pipeline.Workspace)\globaltools'
274275

‎.pipelines/templates/shouldSign.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@ parameters:
66
steps:
77
- powershell: |
88
$shouldSign = $true
9-
$authenticodeCert = 'CP-230012'
10-
$msixCert = 'CP-230012'
9+
$authenticodeCert = '$(authenticode_cert_id)'
10+
$msixCert = '$(authenticode_cert_id)'
1111
if($env:IS_DAILY -eq 'true')
1212
{
13-
$authenticodeCert = 'CP-460906'
13+
$authenticodeCert = '$(authenticode_test_cert_id)'
1414
}
1515
if($env:SKIP_SIGNING -eq 'Yes')
1616
{

‎.pipelines/templates/stages/PowerShell-Packages-Stages.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,15 +100,13 @@ stages:
100100
signedDrop: 'drop_linux_sign_linux_fxd_x64_mariner'
101101
packageType: rpm-fxdependent #mariner-x64
102102
jobName: mariner_x64
103-
signingProfile: 'CP-459159-pgpdetached'
104103

105104
- template: /.pipelines/templates/linux-package-build.yml@self
106105
parameters:
107106
unsignedDrop: 'drop_linux_build_linux_fxd_arm64_mariner'
108107
signedDrop: 'drop_linux_sign_linux_fxd_arm64_mariner'
109108
packageType: rpm-fxdependent-arm64 #mariner-arm64
110109
jobName: mariner_arm64
111-
signingProfile: 'CP-459159-pgpdetached'
112110

113111
- template: /.pipelines/templates/linux-package-build.yml@self
114112
parameters:

‎.pipelines/templates/windows-hosted-build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -315,7 +315,7 @@ jobs:
315315
displayName: Sign nupkg files
316316
inputs:
317317
command: 'sign'
318-
cp_code: 'CP-401405'
318+
cp_code: '$(nuget_cert_id)'
319319
files_to_sign: '**\*.nupkg'
320320
search_root: '$(ob_outputDirectory)\globaltool'
321321
condition: and(succeeded(), eq(variables['Architecture'], 'fxdependent'))

‎tools/packaging/packaging.psd1‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
'Test-PackageManifest'
2727
'Update-PSSignedBuildFolder'
2828
'Test-Bom'
29+
'Get-MacOSPackageIdentifierInfo'
2930
)
3031
RootModule = "packaging.psm1"
3132
RequiredModules = @("build")

‎tools/packaging/packaging.psm1‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -825,6 +825,18 @@ function New-TarballPackage {
825825
$Staging = "$PSScriptRoot/staging"
826826
New-StagingFolder -StagingPath $Staging -PackageSourcePath $PackageSourcePath -R2RVerification $R2RVerification
827827

828+
# Ensure PowerShell executable has correct permissions in tarball
829+
$pwshInStaging = Join-Path $Staging 'pwsh'
830+
if (Test-Path -LiteralPath $pwshInStaging) {
831+
Start-NativeExecution { chmod 755 $pwshInStaging }
832+
}
833+
834+
# Included .NET executable for producing crash dumps
835+
$createdumpInStaging = Join-Path $Staging 'createdump'
836+
if (Test-Path -LiteralPath $createdumpInStaging) {
837+
Start-NativeExecution { chmod 755 $createdumpInStaging }
838+
}
839+
828840
if (Get-Command -Name tar -CommandType Application -ErrorAction Ignore) {
829841
if ($Force -or $PSCmdlet.ShouldProcess("Create tarball package")) {
830842
$options = "-czf"
@@ -1243,7 +1255,11 @@ function New-UnixPackage {
12431255
find $Staging -type f | xargs chmod 644
12441256
chmod 644 $ManGzipInfo.GzipFile
12451257
# refers to executable, does not vary by channel
1246-
chmod 755 "$Staging/pwsh" #only the executable file should be granted the execution permission
1258+
chmod 755 "$Staging/pwsh" # only the executable file should be granted the execution permission
1259+
# Included .NET executable for producing crash dumps
1260+
if (Test-Path "$Staging/createdump") {
1261+
chmod 755 "$Staging/createdump"
1262+
}
12471263
}
12481264
}
12491265

@@ -1923,6 +1939,12 @@ $(if ($extendedDescription) { $extendedDescription + "`n" })
19231939
Start-NativeExecution { chmod 755 $pwshPath }
19241940
}
19251941

1942+
# Included .NET executable for producing crash dumps
1943+
$createdumpPath = "$targetPath/createdump"
1944+
if (Test-Path $createdumpPath) {
1945+
Start-NativeExecution { chmod 755 $createdumpPath }
1946+
}
1947+
19261948
# Calculate md5sums for all files in data directory (excluding symlinks)
19271949
$md5sumsFile = Join-Path $debianDir "md5sums"
19281950
$md5Content = ""

0 commit comments

Comments
 (0)