Skip to content

Commit 2fe3499

Browse files
TravisEz13adityapatwardhan
TravisEz13
and
adityapatwardhan
authored
Sign the MSIX files for the store (PowerShell#12582)
Co-authored-by: Aditya Patwardhan <adityap@microsoft.com>
1 parent b80375f commit 2fe3499

9 files changed

Lines changed: 43 additions & 13 deletions

File tree

‎.vsts-ci/linux.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ trigger:
1111
include:
1212
- '*'
1313
exclude:
14-
- /tools/releaseBuild/**/*
1514
- /.vsts-ci/misc-analysis.yml
1615
- /.github/ISSUE_TEMPLATE/*
1716
- /.dependabot/config.yml
@@ -25,7 +24,8 @@ pr:
2524
include:
2625
- '*'
2726
exclude:
28-
- /tools/releaseBuild/**/*
27+
- tools/releaseBuild/*
28+
- tools/releaseBuild/azureDevOps/templates/*
2929
- /.vsts-ci/misc-analysis.yml
3030
- /.github/ISSUE_TEMPLATE/*
3131
- /.dependabot/config.yml

‎.vsts-ci/mac.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,11 @@ pr:
2525
include:
2626
- '*'
2727
exclude:
28-
- /tools/releaseBuild/**/*
2928
- /.vsts-ci/misc-analysis.yml
3029
- /.github/ISSUE_TEMPLATE/*
3130
- /.dependabot/config.yml
31+
- tools/releaseBuild/*
32+
- tools/releaseBuild/azureDevOps/templates/*
3233

3334
variables:
3435
DOTNET_CLI_TELEMETRY_OPTOUT: 1

‎.vsts-ci/windows.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ pr:
2727
- /.vsts-ci/misc-analysis.yml
2828
- /.github/ISSUE_TEMPLATE/*
2929
- /.dependabot/config.yml
30+
- tools/releaseBuild/*
31+
- tools/releaseBuild/azureDevOps/templates/*
3032

3133
variables:
3234
GIT_CONFIG_PARAMETERS: "'core.autocrlf=false'"

‎assets/AppxManifest.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
xmlns:desktop6="http://schemas.microsoft.com/appx/manifest/desktop/windows10/6"
1010
xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities">
1111

12-
<Identity Name="Microsoft.$PRODUCTNAME$" ProcessorArchitecture="$ARCH$" Publisher="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" Version="$VERSION$" />
12+
<Identity Name="Microsoft.$PRODUCTNAME$" ProcessorArchitecture="$ARCH$" Publisher="$PUBLISHER$" Version="$VERSION$" />
1313

1414
<Properties>
1515
<DisplayName>$DISPLAYNAME$</DisplayName>

‎tools/packaging/packaging.psm1‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3183,9 +3183,18 @@ function New-MSIXPackage
31833183

31843184
Write-Verbose "Version: $productversion" -Verbose
31853185

3186+
$isPreview = Test-IsPreview -Version $ProductSemanticVersion
3187+
if ($isPreview) {
3188+
Write-Verbose "Using Preview assets" -Verbose
3189+
}
3190+
31863191
# Appx manifest needs to be in root of source path, but the embedded version needs to be updated
3192+
# cp-459155 is 'CN=Microsoft Windows Store Publisher (Store EKU), O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
3193+
# authenticodeFormer is 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
3194+
$releasePublisher = 'CN=Microsoft Windows Store Publisher (Store EKU), O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
3195+
31873196
$appxManifest = Get-Content "$RepoRoot\assets\AppxManifest.xml" -Raw
3188-
$appxManifest = $appxManifest.Replace('$VERSION$', $ProductVersion).Replace('$ARCH$', $Architecture).Replace('$PRODUCTNAME$', $productName).Replace('$DISPLAYNAME$', $displayName)
3197+
$appxManifest = $appxManifest.Replace('$VERSION$', $ProductVersion).Replace('$ARCH$', $Architecture).Replace('$PRODUCTNAME$', $productName).Replace('$DISPLAYNAME$', $displayName).Replace('$PUBLISHER$', $releasePublisher)
31893198
Set-Content -Path "$ProductSourcePath\AppxManifest.xml" -Value $appxManifest -Force
31903199
# Necessary image assets need to be in source assets folder
31913200
$assets = @(
@@ -3200,11 +3209,6 @@ function New-MSIXPackage
32003209
$null = New-Item -ItemType Directory -Path "$ProductSourcePath\assets"
32013210
}
32023211

3203-
$isPreview = Test-IsPreview -Version $ProductSemanticVersion
3204-
if ($isPreview) {
3205-
Write-Verbose "Using Preview assets" -Verbose
3206-
}
3207-
32083212
$assets | ForEach-Object {
32093213
if ($isPreview) {
32103214
Copy-Item -Path "$RepoRoot\assets\$_-Preview.png" -Destination "$ProductSourcePath\assets\$_.png"

‎tools/releaseBuild/azureDevOps/templates/upload.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,5 +61,5 @@ steps:
6161
azureSubscription: '$(AzureFileCopySubscription)'
6262
Destination: AzureBlob
6363
storage: '$(StorageAccount)'
64-
ContainerName: '$(AzureVersion)'
64+
ContainerName: '$(AzureVersion)-private'
6565
condition: and(succeeded(), eq('${{ parameters.msix }}', 'yes'), eq(variables['SHOULD_SIGN'], 'true'))

‎tools/releaseBuild/azureDevOps/templates/windows-package-signing.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,16 @@ jobs:
3838
$authenticodefiles = @(
3939
"$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x64.msi"
4040
"$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x86.msi"
41+
)
42+
43+
$msixFiles = @(
4144
"$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x86.msix"
4245
"$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-x64.msix"
4346
"$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm32.msix"
4447
"$(System.ArtifactsDirectory)\signed\PowerShell-$(Version)-win-arm64.msix"
4548
)
46-
tools/releaseBuild/generatePackgeSigning.ps1 -AuthenticodeFiles $authenticodeFiles -path "$(System.ArtifactsDirectory)\package.xml"
49+
50+
tools/releaseBuild/generatePackgeSigning.ps1 -AuthenticodeFiles $authenticodeFiles -path "$(System.ArtifactsDirectory)\package.xml" -MsixCertType $env:MSIX_TYPE -MsixFiles $msixFiles
4751
displayName: 'Generate Package Signing Xml'
4852
4953
- powershell: |

‎tools/releaseBuild/generatePackgeSigning.ps1‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,18 @@ param(
88
[string[]] $NuPkgFiles,
99
[string[]] $MacDeveloperFiles,
1010
[string[]] $LinuxFiles,
11-
[string[]] $ThirdPartyFiles
11+
[string[]] $ThirdPartyFiles,
12+
[string[]] $MsixFiles,
13+
[ValidateSet('release','preview')]
14+
[string] $MsixCertType = 'preview'
1215
)
1316

1417
if ((!$AuthenticodeDualFiles -or $AuthenticodeDualFiles.Count -eq 0) -and
1518
(!$AuthenticodeFiles -or $AuthenticodeFiles.Count -eq 0) -and
1619
(!$NuPkgFiles -or $NuPkgFiles.Count -eq 0) -and
1720
(!$MacDeveloperFiles -or $MacDeveloperFiles.Count -eq 0) -and
1821
(!$LinuxFiles -or $LinuxFiles.Count -eq 0) -and
22+
(!$MsixFiles -or $MsixFiles.Count -eq 0) -and
1923
(!$ThirdPartyFiles -or $ThirdPartyFiles.Count -eq 0))
2024
{
2125
throw "At least one file must be specified"
@@ -95,6 +99,14 @@ foreach ($file in $ThirdPartyFiles) {
9599
New-FileElement -File $file -SignType 'ThirdParty' -XmlDoc $signingXml -Job $job
96100
}
97101

102+
foreach ($file in $MsixFiles) {
103+
# 'CP-459155' signs for the store only
104+
# AuthenticodeFormer works only for sideloading
105+
# ----------------------------------------------
106+
# update releasePublisher in packaging.psm1 when this is changed
107+
New-FileElement -File $file -SignType 'CP-459155' -XmlDoc $signingXml -Job $job
108+
}
109+
98110
$signingXml.Save($path)
99111
$updateScriptPath = Join-Path -Path $PSScriptRoot -ChildPath 'updateSigning.ps1'
100112
& $updateScriptPath -SigningXmlPath $path

‎tools/releaseBuild/setReleaseTag.ps1‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,13 +58,16 @@ function New-BuildInfoJson {
5858
$branchOnly = $Branch -replace '^refs/heads/';
5959
$branchOnly = $branchOnly -replace '[_\-]'
6060

61+
$msixType = 'preview'
62+
6163
$isDaily = $false
6264

6365
if($ReleaseTag -eq 'fromBranch' -or !$ReleaseTag)
6466
{
6567
# Branch is named release-<semver>
6668
if($Branch -match '^.*(release[-/])')
6769
{
70+
$msixType = 'release'
6871
Write-Verbose "release branch:" -Verbose
6972
$releaseTag = $Branch -replace '^.*(release[-/])'
7073
$vstsCommandString = "vso[task.setvariable variable=$Variable]$releaseTag"
@@ -127,4 +130,8 @@ $vstsCommandString = "vso[task.setvariable variable=IS_DAILY]$($isDaily.ToString
127130
Write-Verbose -Message "$vstsCommandString" -Verbose
128131
Write-Host -Object "##$vstsCommandString"
129132

133+
$vstsCommandString = "vso[task.setvariable variable=MSIX_TYPE]$msixType"
134+
Write-Verbose -Message "$vstsCommandString" -Verbose
135+
Write-Host -Object "##$vstsCommandString"
136+
130137
Write-Output $releaseTag

0 commit comments

Comments
 (0)