[release/v7.6.2] Fix *nix permissions and use certificate_logical_to_actual#27439
Merged
daxian-dbw merged 4 commits intoMay 13, 2026
Conversation
It's been this way for a couple years which means we've been passing...something else?
Contributor
There was a problem hiding this comment.
Pull request overview
This PR is described as a release backport for *nix tarball permissions and signing certificate abstraction, but the submitted diff only corrects the Linux package template’s signed artifact parameter name.
Changes:
- Renames the default parameter from
signedeDroptosignedDrop.
| parameters: | ||
| unsignedDrop: 'drop_linux_build_linux_x64' | ||
| signedeDrop: 'drop_linux_sign_linux_x64' | ||
| signedDrop: 'drop_linux_sign_linux_x64' |
We still need to apply the template signing so that Guardian tasks pass and so that script files are signed. After doing what's essentially Windows signing, we sign and harden the binaries for macOS. Then we do the same for the PKG installer, and finally notarize it. The ESRP signing service requires a zip of files for Apple signing at all stages. Now that we can use it via the OneBranch signing task we no longer need the service connection or variable group that was trying to set it up. Notarization requires the BundleId from Get-MacOSPackageIdentifierInfo. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… group The `CP-…` key codes used for ESRP signing are now set from ADO via the `certificate_logical_to_actual` variable group. The templates reference the following variables instead of literal codes: - `$(authenticode_cert_id)` - `$(authenticode_test_cert_id)` - `$(nuget_cert_id)` - `$(apple_cert_id)` - `$(pgp_linux_cert_id)` - `$(pgp_release_cert_id)` `nupkg.yml`, `mac-package-build.yml`, and `linux-package-build.yml` pick up the new group import. `linux-package-build.yml` also now selects the PGP signing profile based on whether `jobName` starts with `mariner`, so `PowerShell-Packages-Stages.yml` no longer threads a `signingProfile` parameter in for the two Mariner jobs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The tarball staging path used `Copy-Item`, which on *nix doesn't preserve the source file mode, so `pwsh` ended up 644 in the `.tar.gz`. The Debian, RPM, and macOS PKG paths explicitly `chmod` everything to 644 and then bump `pwsh` back to 755, which silently demoted `createdump` (the .NET helper that produces crash minidumps) along with it. Now we `chmod 755` both executables in all package staging paths, guarded by `Test-Path` since fxdependent builds don't bundle `createdump`. Also added regression tests which check the permissions of `pwsh` inside the Linux and macOS tarballs before we upload them. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
|
Andy's two PRs below were "rebase merged", which is unexpected and caused all commits from those PRs to get into the master branch without squashing. The backport logic assumes squashing merge always, so it only picks up the last commit.
To fix the backporting, I manually cherry-picked all missing commits into this PR, even though the commit ab700d1 actually belongs to #27347. |
9 tasks
andyleejordan
approved these changes
May 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #27385 to release/v7.6.2
Triggered by @daxian-dbw on behalf of @andyleejordan
Original CL Label: CL-BuildPackaging
/cc @PowerShell/powershell-maintainers
Impact
REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.
Tooling Impact
Abstracts signing certificate codes into the
certificate_logical_to_actualvariable group across mac, linux, nupkg, and windows pipeline templates. Fixes tarball packaging to restore executable permissions onpwshandcreatedumpbefore archiving.Customer Impact
Fixes a two-year-old bug (issue #23968) where the
pwshbinary inside Linux/macOS tarballs was not executable. Users downloading the tarball and running./pwshwould get a permission error.Regression
REQUIRED: Check exactly one box.
This is not a regression.
Testing
Regression test added that inspects the tarball contents before upload and throws if
pwshis not executable (-..xpattern). Covers the fix for issue #23968. Signing cert abstraction validated via the original PR pipeline run.Risk
REQUIRED: Check exactly one box.
Adds
chmod 755calls before tarball packaging and a regression test verifying executable bit. Signing cert variables are abstracted via a variable group. No behavioral change to existing packages that already set permissions correctly.