[release/v7.5.7] Fix *nix permissions and use certificate_logical_to_actual#27468
Open
adityapatwardhan wants to merge 3 commits into
Open
[release/v7.5.7] Fix *nix permissions and use certificate_logical_to_actual#27468adityapatwardhan wants to merge 3 commits into
certificate_logical_to_actual#27468adityapatwardhan wants to merge 3 commits into
Conversation
The tarball staging path used `Copy-Item`, which on *nix doesn't preserve the source file mode, so `pwsh` ended up 644 in the `.tar.gz`. The Debian, RPM, and macOS PKG paths explicitly `chmod` everything to 644 and then bump `pwsh` back to 755, which silently demoted `createdump` (the .NET helper that produces crash minidumps) along with it. Now we `chmod 755` both executables in all package staging paths, guarded by `Test-Path` since fxdependent builds don't bundle `createdump`. Also added regression tests which check the permissions of `pwsh` inside the Linux and macOS tarballs before we upload them. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… group The `CP-…` key codes used for ESRP signing are now set from ADO via the `certificate_logical_to_actual` variable group. The templates reference the following variables instead of literal codes: - `$(authenticode_cert_id)` - `$(authenticode_test_cert_id)` - `$(nuget_cert_id)` - `$(apple_cert_id)` - `$(pgp_linux_cert_id)` - `$(pgp_release_cert_id)` `nupkg.yml`, `mac-package-build.yml`, and `linux-package-build.yml` pick up the new group import. `linux-package-build.yml` also now selects the PGP signing profile based on whether `jobName` starts with `mariner`, so `PowerShell-Packages-Stages.yml` no longer threads a `signingProfile` parameter in for the two Mariner jobs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
It's been this way for a couple years which means we've been passing...something else?
certificate_logical_to_actual
Contributor
There was a problem hiding this comment.
Pull request overview
This backport updates packaging and release pipeline behavior for Unix permissions and logical certificate variable usage in the PowerShell release flow.
Changes:
- Restores executable permissions for
pwshandcreatedumpin tarball, Unix, and Debian package creation. - Replaces hardcoded certificate/profile IDs with values from
certificate_logical_to_actual. - Adds macOS Apple signing/notarization steps and tarball permission validation.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
tools/packaging/packaging.psm1 |
Sets executable permissions for Unix package contents. |
.pipelines/templates/windows-hosted-build.yml |
Uses logical NuGet certificate variable for signing. |
.pipelines/templates/stages/PowerShell-Packages-Stages.yml |
Removes hardcoded Mariner signing profile overrides. |
.pipelines/templates/shouldSign.yml |
Uses logical Authenticode certificate variables. |
.pipelines/templates/nupkg.yml |
Adds certificate variable group and uses logical NuGet certificate variable. |
.pipelines/templates/mac.yml |
Adds Apple signing for signed macOS binaries. |
.pipelines/templates/mac-package-build.yml |
Adds certificate variable group, tar permission validation, and package notarization. |
.pipelines/templates/linux-package-build.yml |
Uses logical PGP signing profile variables and validates tarball permissions. |
Comment on lines
200
to
+207
| $pkgPath = Get-ChildItem -Path $(Pipeline.Workspace) -Filter $pkgFilter -Recurse -File | Select-Object -ExpandProperty FullName | ||
| Write-Verbose -Verbose "pkgPath: $pkgPath" | ||
| Copy-Item -Path $pkgPath -Destination '$(ob_outputDirectory)' -Force -Verbose | ||
|
|
||
| if ($pkgPath -like '*.tar.gz') { | ||
| $entry = & tar -tzvf $pkgPath | Where-Object { $_ -match '\spwsh$' } | Select-Object -First 1 | ||
| if ($entry -notmatch '^-..x') { | ||
| throw "pwsh is not executable in $pkgPath : $entry" |
Comment on lines
+159
to
+160
| if ($entry -notmatch '^-..x') { | ||
| throw "pwsh is not executable in $file : $entry" |
|
|
||
| if ($pkgPath -like '*.tar.gz') { | ||
| $entry = & tar -tzvf $pkgPath | Where-Object { $_ -match '\spwsh$' } | Select-Object -First 1 | ||
| if ($entry -notmatch '^-..x') { |
Comment on lines
+795
to
+796
| # Ensure PowerShell executable has correct permissions in tarball | ||
| $pwshInStaging = Join-Path $Staging 'pwsh' |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #27385 to release/v7.5.7
Triggered by @adityapatwardhan on behalf of @andyleejordan
Original CL Label: CL-BuildPackaging
/cc @PowerShell/powershell-maintainers
Impact
REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.
Tooling Impact
Adds appLicensing capability to Appx manifest for improved packaging.
Customer Impact
Regression
REQUIRED: Check exactly one box.
This is not a regression.
Testing
No new tests required; change validated by successful build and Appx manifest inspection.
Risk
REQUIRED: Check exactly one box.
This change only adds a capability to the Appx manifest and does not affect runtime behavior.