Skip to content

Fix *nix permissions and use certificate_logical_to_actual #27385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
andyleejordan merged 3 commits into from
May 5, 2026
+58 −16
Merged

Fix *nix permissions and use certificate_logical_to_actual #27385

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0990ddc
Fix executable permissions for pwsh and createdump
andyleejordan Apr 24, 2026
2237859
Move ESRP key codes into the `certificate_logical_to_actual` variable…
andyleejordan Apr 25, 2026
47e0c13
Correct typo in package parameters
andyleejordan May 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 19 additions & 4 deletions .pipelines/templates/linux-package-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,8 @@
parameters:
unsignedDrop: 'drop_linux_build_linux_x64'
signedeDrop: 'drop_linux_sign_linux_x64'
signedDrop: 'drop_linux_sign_linux_x64'
packageType: deb
jobName: 'deb'
signingProfile: 'CP-450779-pgpdetached'

jobs:
- job: ${{ parameters.jobName }}
Expand All @@ -20,6 +19,7 @@ jobs:
- name: skipNugetSecurityAnalysis
value: true
- group: DotNetPrivateBuildAccess
- group: certificate_logical_to_actual
- name: ob_outputDirectory
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
- name: ob_sdl_binskim_enabled
Expand All @@ -34,8 +34,16 @@ jobs:
value: $(Build.SourcesDirectory)/PowerShell/.config/tsaoptions.json
- name: ob_sdl_credscan_suppressionsFile
value: $(Build.SourcesDirectory)/PowerShell/.config/suppress.json
- name: SigningProfile
value: ${{ parameters.signingProfile }}
# PGP signing profile selection: Mariner (Azure Linux) packages ship through
# a different distribution channel and must be signed with the Mariner release
# key; all other Linux packages use the standard PowerShell Linux key. Both
# key codes come from the `certificate_logical_to_actual` variable group.
- ${{ if startsWith(parameters.jobName, 'mariner') }}:
- name: SigningProfile
value: $(pgp_release_cert_id)
- ${{ else }}:
- name: SigningProfile
value: $(pgp_linux_cert_id)

steps:
- checkout: self
Expand Down Expand Up @@ -192,6 +200,13 @@ jobs:
$pkgPath = Get-ChildItem -Path $(Pipeline.Workspace) -Filter $pkgFilter -Recurse -File | Select-Object -ExpandProperty FullName
Write-Verbose -Verbose "pkgPath: $pkgPath"
Copy-Item -Path $pkgPath -Destination '$(ob_outputDirectory)' -Force -Verbose

if ($pkgPath -like '*.tar.gz') {
$entry = & tar -tzvf $pkgPath | Where-Object { $_ -match '\spwsh$' } | Select-Object -First 1
if ($entry -notmatch '^-..x') {
throw "pwsh is not executable in $pkgPath : $entry"
Comment thread
andyleejordan marked this conversation as resolved.
}
}
displayName: 'Copy artifacts to output directory'
env:
__DOTNET_RUNTIME_FEED_KEY: $(RUNTIME_SOURCEFEED_KEY)
Expand Down
10 changes: 8 additions & 2 deletions .pipelines/templates/mac-package-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ jobs:
- name: skipNugetSecurityAnalysis
value: true
- group: DotNetPrivateBuildAccess
- group: certificate_logical_to_actual
- name: ob_outputDirectory
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
- name: ob_sdl_binskim_enabled
Expand Down Expand Up @@ -162,6 +163,10 @@ jobs:

foreach($t in $tarPkgPath) {
$file = $t.FullName
$entry = & tar -tzvf $file | Where-Object { $_ -match '\spwsh$' } | Select-Object -First 1
if ($entry -notmatch '^-..x') {
throw "pwsh is not executable in $file : $entry"
}
Write-Verbose -verbose "Uploading $file to macos-pkgs"
Write-Host "##vso[artifact.upload containerfolder=macos-pkgs;artifactname=macos-pkgs]$file"
}
Expand All @@ -183,6 +188,7 @@ jobs:
type: windows

variables:
- group: certificate_logical_to_actual
- name: ob_outputDirectory
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
- name: ob_sdl_binskim_enabled
Expand Down Expand Up @@ -230,7 +236,7 @@ jobs:
inline_operation: |
[
{
"KeyCode": "CP-401337-Apple",
"KeyCode": "$(apple_cert_id)",
"OperationCode": "MacAppDeveloperSign",
"ToolName": "sign",
"ToolVersion": "1.0",
Expand All @@ -249,7 +255,7 @@ jobs:
inline_operation: |
[
{
"KeyCode": "CP-401337-Apple",
"KeyCode": "$(apple_cert_id)",
"OperationCode": "MacAppNotarize",
"ToolName": "sign",
"ToolVersion": "1.0",
Expand Down
2 changes: 1 addition & 1 deletion .pipelines/templates/mac.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,7 @@ jobs:
inline_operation: |
[
{
"KeyCode": "CP-401337-Apple",
"KeyCode": "$(apple_cert_id)",
"OperationCode": "MacAppDeveloperSign",
"ToolName": "sign",
"ToolVersion": "1.0",
Expand Down
5 changes: 3 additions & 2 deletions .pipelines/templates/nupkg.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ jobs:
- group: mscodehub-feed-read-general
- group: mscodehub-feed-read-akv
- group: DotNetPrivateBuildAccess
- group: certificate_logical_to_actual

steps:
- checkout: self
Expand Down Expand Up @@ -208,7 +209,7 @@ jobs:
displayName: Sign nupkg files
inputs:
command: 'sign'
cp_code: 'CP-401405'
cp_code: '$(nuget_cert_id)'
files_to_sign: '**\*.nupkg'
search_root: '$(Pipeline.Workspace)\nupkg'

Expand Down Expand Up @@ -268,7 +269,7 @@ jobs:
displayName: Sign nupkg files
inputs:
command: 'sign'
cp_code: 'CP-401405'
cp_code: '$(nuget_cert_id)'
files_to_sign: '**\*.nupkg'
search_root: '$(Pipeline.Workspace)\globaltools'

Expand Down
6 changes: 3 additions & 3 deletions .pipelines/templates/shouldSign.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,11 @@ parameters:
steps:
- powershell: |
$shouldSign = $true
$authenticodeCert = 'CP-230012'
$msixCert = 'CP-230012'
$authenticodeCert = '$(authenticode_cert_id)'
$msixCert = '$(authenticode_cert_id)'
if($env:IS_DAILY -eq 'true')
{
$authenticodeCert = 'CP-460906'
$authenticodeCert = '$(authenticode_test_cert_id)'
}
if($env:SKIP_SIGNING -eq 'Yes')
{
Expand Down
2 changes: 0 additions & 2 deletions .pipelines/templates/stages/PowerShell-Packages-Stages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,15 +93,13 @@ stages:
signedDrop: 'drop_linux_sign_linux_fxd_x64_mariner'
packageType: rpm-fxdependent #mariner-x64
jobName: mariner_x64
signingProfile: 'CP-459159-pgpdetached'

- template: /.pipelines/templates/linux-package-build.yml@self
parameters:
unsignedDrop: 'drop_linux_build_linux_fxd_arm64_mariner'
signedDrop: 'drop_linux_sign_linux_fxd_arm64_mariner'
packageType: rpm-fxdependent-arm64 #mariner-arm64
jobName: mariner_arm64
signingProfile: 'CP-459159-pgpdetached'

- template: /.pipelines/templates/linux-package-build.yml@self
parameters:
Expand Down
2 changes: 1 addition & 1 deletion .pipelines/templates/windows-hosted-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -315,7 +315,7 @@ jobs:
displayName: Sign nupkg files
inputs:
command: 'sign'
cp_code: 'CP-401405'
cp_code: '$(nuget_cert_id)'
files_to_sign: '**\*.nupkg'
search_root: '$(ob_outputDirectory)\globaltool'
condition: and(succeeded(), eq(variables['Architecture'], 'fxdependent'))
Expand Down
24 changes: 23 additions & 1 deletion tools/packaging/packaging.psm1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -776,6 +776,18 @@ function New-TarballPackage {
$Staging = "$PSScriptRoot/staging"
New-StagingFolder -StagingPath $Staging -PackageSourcePath $PackageSourcePath -R2RVerification $R2RVerification

# Ensure PowerShell executable has correct permissions in tarball
$pwshInStaging = Join-Path $Staging 'pwsh'
if (Test-Path -LiteralPath $pwshInStaging) {
Start-NativeExecution { chmod 755 $pwshInStaging }
}

# Included .NET executable for producing crash dumps
$createdumpInStaging = Join-Path $Staging 'createdump'
if (Test-Path -LiteralPath $createdumpInStaging) {
Start-NativeExecution { chmod 755 $createdumpInStaging }
Copy link
Copy Markdown
Member

@adityapatwardhan adityapatwardhan May 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be chmod a+x, so we dont change other bits.

Copy link
Copy Markdown
Member Author

@andyleejordan andyleejordan May 5, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The proposed change is consistent with the existing choice to use numbered / explicit permissions in packaging.psm1 so I don't we should differ here until if and when we want to update the whole file (and run that through a barrage of testing). That said, I don't think I recommend that, because I posit that "don't change other bits" doesn't really apply here, since the root bug being addressed is that the pipeline moves the files from *nix where they were made (with correct permisison bits) to Windows which loses all sense of file permissions, that is, all the bits have already been changed, so updating them explicitly is I think more correct.

Screenshot 2026-05-05 at 12 33 38 PM

}

if (Get-Command -Name tar -CommandType Application -ErrorAction Ignore) {
if ($Force -or $PSCmdlet.ShouldProcess("Create tarball package")) {
$options = "-czf"
Expand Down Expand Up @@ -1194,7 +1206,11 @@ function New-UnixPackage {
find $Staging -type f | xargs chmod 644
chmod 644 $ManGzipInfo.GzipFile
# refers to executable, does not vary by channel
chmod 755 "$Staging/pwsh" #only the executable file should be granted the execution permission
chmod 755 "$Staging/pwsh" # only the executable file should be granted the execution permission
Comment thread
andyleejordan marked this conversation as resolved.
# Included .NET executable for producing crash dumps
if (Test-Path "$Staging/createdump") {
chmod 755 "$Staging/createdump"
Comment thread
andyleejordan marked this conversation as resolved.
}
}
}

Expand Down Expand Up @@ -1874,6 +1890,12 @@ $(if ($extendedDescription) { $extendedDescription + "`n" })
Start-NativeExecution { chmod 755 $pwshPath }
}

# Included .NET executable for producing crash dumps
$createdumpPath = "$targetPath/createdump"
if (Test-Path $createdumpPath) {
Start-NativeExecution { chmod 755 $createdumpPath }
Comment thread
andyleejordan marked this conversation as resolved.
}

# Calculate md5sums for all files in data directory (excluding symlinks)
$md5sumsFile = Join-Path $debianDir "md5sums"
$md5Content = ""
Expand Down
Loading