Skip to content

Commit fb5191c

Browse files
daxian-dbwdaxian-dbw
authored
Update the release build to use ESRP signing and unify the compliance job (#1983)
1 parent 7fb13ea commit fb5191c

File tree

4 files changed

+166
-212
lines changed

4 files changed

+166
-212
lines changed

‎.vsts-ci/releaseBuild.yml‎

Lines changed: 165 additions & 120 deletions
Original file line numberDiff line numberDiff line change
@@ -3,130 +3,175 @@ trigger:
33
branches:
44
include:
55
- master
6-
- release*
76

87
variables:
98
DOTNET_CLI_TELEMETRY_OPTOUT: 1
109
POWERSHELL_TELEMETRY_OPTOUT: 1
1110
DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
1211

13-
# Set AzDevOps Agent to clean the machine after the end of the build
1412
resources:
15-
- repo: self
16-
clean: true
17-
18-
jobs:
19-
- job: build_windows
20-
pool: Package ES CodeHub Lab E
21-
22-
# APIScan can take a long time
23-
timeoutInMinutes: 240
24-
25-
steps:
26-
27-
- checkout: self
28-
clean: true
29-
persistCredentials: true
30-
31-
- task: PkgESSetupBuild@10
32-
displayName: 'Initialize build'
33-
inputs:
34-
# Do not create a release share.
35-
# Enabling this will cause failures!
36-
useDfs: false
37-
productName: PSReadLine
38-
# Add branch name to build name (only for non-master)
39-
branchVersion: true
40-
disableWorkspace: true
41-
disableBuildTools: true
42-
disableNugetPack: true
43-
44-
- pwsh: |
45-
function Send-VstsCommand ($vstsCommandString) {
46-
Write-Host ("sending: " + $vstsCommandString)
47-
Write-Host "##$vstsCommandString"
48-
}
49-
Write-Host "PS Version: $($($PSVersionTable.PSVersion))"
50-
$(Build.SourcesDirectory)\build.ps1 -Bootstrap
51-
$(Build.SourcesDirectory)\build.ps1 -Configuration Release -Framework net461 -CheckHelpContent
52-
# Get module version
53-
$psd1Data = Import-PowerShellDataFile -Path $(Build.SourcesDirectory)\bin\Release\PSReadLine\PSReadLine.psd1
54-
$moduleVersion = $psd1Data.ModuleVersion
55-
$prerelease = $psd1Data.PrivateData.PSData.Prerelease
56-
if ($prerelease) { $moduleVersion = "$moduleVersion-$prerelease" }
57-
Send-VstsCommand "vso[task.setvariable variable=ModuleVersion]$moduleVersion"
58-
# Set target folder paths
59-
New-Item -Path $(Build.SourcesDirectory)\bin\Release\NuGetPackage -ItemType Directory > $null
60-
Send-VstsCommand "vso[task.setvariable variable=NuGetPackage]$(Build.SourcesDirectory)\bin\Release\NuGetPackage"
61-
Send-VstsCommand "vso[task.setvariable variable=PSReadLine]$(Build.SourcesDirectory)\bin\Release\PSReadLine"
62-
Send-VstsCommand "vso[task.setvariable variable=Signed]$(Build.SourcesDirectory)\bin\Release\Signed"
63-
displayName: Bootstrap & Build
64-
65-
- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
66-
displayName: 'Component Governance Detection'
67-
inputs:
68-
sourceScanPath: '$(Build.SourcesDirectory)'
69-
snapshotForceEnabled: true
70-
scanType: 'Register'
71-
failOnAlert: true
72-
73-
# Sign the module files
74-
- task: PkgESCodeSign@10
75-
displayName: 'CodeSign - module artifacts'
76-
env:
77-
SYSTEM_ACCESSTOKEN: $(System.AccessToken)
78-
inputs:
79-
signConfigXml: '$(Build.SourcesDirectory)\.vsts-ci\sign-module-files.xml'
80-
inPathRoot: '$(PSReadLine)'
81-
outPathRoot: '$(Signed)'
82-
binVersion: Production
83-
binVersionOverride: ''
84-
85-
# Replace the *.psm1, *.ps1, *.psd1, *.dll files with the signed ones
86-
- pwsh: |
87-
# Show the signed files
88-
Get-ChildItem -Path $(Signed)
89-
Copy-Item -Path $(Signed)\* -Destination $(PSReadLine) -Recurse -Force
90-
displayName: 'Replace unsigned files with signed ones'
91-
92-
# Verify the signatures
93-
- pwsh: |
94-
$HasInvalidFiles = $false
95-
$WrongCert = @{}
96-
Get-ChildItem -Path $(PSReadLine) -Recurse -Include "*.dll","*.ps*1*" | `
97-
Get-AuthenticodeSignature | ForEach-Object {
98-
$_ | Select-Object Path, Status
99-
if ($_.Status -ne 'Valid') { $HasInvalidFiles = $true }
100-
if ($_.SignerCertificate.Subject -notmatch 'CN=Microsoft Corporation.*') {
101-
$WrongCert.Add($_.Path, $_.SignerCertificate.Subject)
102-
}
103-
}
104-
105-
if ($HasInvalidFiles) { throw "Authenticode verification failed. There is one or more invalid files." }
106-
if ($WrongCert.Count -gt 0) {
107-
$WrongCert
108-
throw "Certificate should have the subject starts with 'Microsoft Corporation'"
109-
}
110-
displayName: 'Verify the signed files'
111-
112-
- pwsh: |
113-
try {
114-
$RepoName = "PSRLLocal"
115-
Register-PSRepository -Name $RepoName -SourceLocation $(NuGetPackage) -PublishLocation $(NuGetPackage) -InstallationPolicy Trusted
116-
Publish-Module -Repository $RepoName -Path $(PSReadLine)
117-
} finally {
118-
Unregister-PSRepository -Name $RepoName -ErrorAction SilentlyContinue
119-
}
120-
Get-ChildItem -Path $(NuGetPackage)
121-
displayName: 'Create the NuGet package'
122-
123-
- pwsh: |
124-
Get-ChildItem -Path $(PSReadLine), $(NuGetPackage)
125-
Write-Host "##vso[artifact.upload containerfolder=PSReadLine;artifactname=PSReadLine]$(PSReadLine)"
126-
Write-Host "##vso[artifact.upload containerfolder=NuGetPackage;artifactname=NuGetPackage]$(NuGetPackage)"
127-
displayName: 'Upload artifacts'
128-
129-
- template: templates/compliance.yml
130-
parameters:
131-
configuration: Release
132-
framework: net461
13+
repositories:
14+
- repository: ComplianceRepo
15+
type: github
16+
endpoint: ComplianceGHRepo
17+
name: PowerShell/compliance
18+
19+
stages:
20+
- stage: Build
21+
displayName: Build and Sign
22+
pool:
23+
name: Package ES CodeHub Lab E
24+
jobs:
25+
- job: build_windows
26+
displayName: Build PSReadLine
27+
variables:
28+
- group: ESRP
29+
30+
steps:
31+
32+
- checkout: self
33+
clean: true
34+
persistCredentials: true
35+
36+
- pwsh: |
37+
function Send-VstsCommand ($vstsCommandString) {
38+
Write-Host ("sending: " + $vstsCommandString)
39+
Write-Host "##$vstsCommandString"
40+
}
41+
Write-Host "PS Version: $($($PSVersionTable.PSVersion))"
42+
Set-Location -Path '$(Build.SourcesDirectory)\PSReadLine'
43+
.\build.ps1 -Bootstrap
44+
.\build.ps1 -Configuration Release -Framework net461 -CheckHelpContent
45+
46+
# Set target folder paths
47+
New-Item -Path .\bin\Release\NuGetPackage -ItemType Directory > $null
48+
Send-VstsCommand "vso[task.setvariable variable=NuGetPackage]$(Build.SourcesDirectory)\PSReadLine\bin\Release\NuGetPackage"
49+
Send-VstsCommand "vso[task.setvariable variable=PSReadLine]$(Build.SourcesDirectory)\PSReadLine\bin\Release\PSReadLine"
50+
Send-VstsCommand "vso[task.setvariable variable=Signed]$(Build.SourcesDirectory)\PSReadLine\bin\Release\Signed"
51+
displayName: Bootstrap & Build
52+
53+
- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
54+
displayName: 'Component Governance Detection'
55+
inputs:
56+
sourceScanPath: '$(Build.SourcesDirectory)\PSReadLine'
57+
snapshotForceEnabled: true
58+
scanType: 'Register'
59+
failOnAlert: true
60+
61+
- checkout: ComplianceRepo
62+
63+
# Sign the module files
64+
- template: EsrpSign.yml@ComplianceRepo
65+
parameters:
66+
# the folder which contains the binaries to sign
67+
buildOutputPath: $(PSReadLine)
68+
# the location to put the signed output
69+
signOutputPath: $(Signed)
70+
# the certificate ID to use
71+
certificateId: "CP-230012"
72+
pattern: |
73+
*.psd1
74+
*.psm1
75+
*.ps1
76+
*.ps1xml
77+
**\*.dll
78+
!System.Runtime.InteropServices.RuntimeInformation.dll
79+
useMinimatch: true
80+
81+
# Replace the *.psm1, *.ps1, *.psd1, *.dll files with the signed ones
82+
- pwsh: |
83+
# Show the signed files
84+
Get-ChildItem -Path $(Signed)
85+
Copy-Item -Path $(Signed)\* -Destination $(PSReadLine) -Recurse -Force
86+
displayName: 'Replace unsigned files with signed ones'
87+
88+
# Verify the signatures
89+
- pwsh: |
90+
$HasInvalidFiles = $false
91+
$WrongCert = @{}
92+
Get-ChildItem -Path $(PSReadLine) -Recurse -Include "*.dll","*.ps*1*" | `
93+
Get-AuthenticodeSignature | ForEach-Object {
94+
$_ | Select-Object Path, Status
95+
if ($_.Status -ne 'Valid') { $HasInvalidFiles = $true }
96+
if ($_.SignerCertificate.Subject -notmatch 'CN=Microsoft Corporation.*') {
97+
$WrongCert.Add($_.Path, $_.SignerCertificate.Subject)
98+
}
99+
}
100+
101+
if ($HasInvalidFiles) { throw "Authenticode verification failed. There is one or more invalid files." }
102+
if ($WrongCert.Count -gt 0) {
103+
$WrongCert
104+
throw "Certificate should have the subject starts with 'Microsoft Corporation'"
105+
}
106+
displayName: 'Verify the signed files'
107+
108+
- pwsh: |
109+
try {
110+
$RepoName = "PSRLLocal"
111+
Register-PSRepository -Name $RepoName -SourceLocation $(NuGetPackage) -PublishLocation $(NuGetPackage) -InstallationPolicy Trusted
112+
Publish-Module -Repository $RepoName -Path $(PSReadLine)
113+
} finally {
114+
Unregister-PSRepository -Name $RepoName -ErrorAction SilentlyContinue
115+
}
116+
Get-ChildItem -Path $(NuGetPackage)
117+
displayName: 'Create the NuGet package'
118+
119+
- pwsh: |
120+
Get-ChildItem -Path $(PSReadLine), $(NuGetPackage)
121+
Write-Host "##vso[artifact.upload containerfolder=PSReadLine;artifactname=PSReadLine]$(PSReadLine)"
122+
Write-Host "##vso[artifact.upload containerfolder=NuGetPackage;artifactname=NuGetPackage]$(NuGetPackage)"
123+
displayName: 'Upload artifacts'
124+
125+
- stage: compliance
126+
displayName: Compliance
127+
dependsOn: Build
128+
pool:
129+
name: Package ES CodeHub Lab E
130+
jobs:
131+
- job: Compliance_Job
132+
displayName: PSReadLine Compliance
133+
# APIScan can take a long time
134+
timeoutInMinutes: 240
135+
136+
steps:
137+
- checkout: self
138+
- checkout: ComplianceRepo
139+
- download: current
140+
artifact: PSReadLine
141+
142+
- pwsh: |
143+
Get-ChildItem -Path "$(Pipeline.Workspace)\PSReadLine" -Recurse
144+
displayName: Capture downloaded artifacts
145+
146+
- pwsh: |
147+
function Send-VstsCommand ($vstsCommandString) {
148+
Write-Host ("sending: " + $vstsCommandString)
149+
Write-Host "##$vstsCommandString"
150+
}
151+
152+
# Get module version
153+
$psd1Data = Import-PowerShellDataFile -Path "$(Pipeline.Workspace)\PSReadLine\PSReadLine.psd1"
154+
$moduleVersion = $psd1Data.ModuleVersion
155+
$prerelease = $psd1Data.PrivateData.PSData.Prerelease
156+
if ($prerelease) { $moduleVersion = "$moduleVersion-$prerelease" }
157+
Send-VstsCommand "vso[task.setvariable variable=ModuleVersion]$moduleVersion"
158+
displayName: Get Module Version
159+
160+
- template: assembly-module-compliance.yml@ComplianceRepo
161+
parameters:
162+
# binskim
163+
AnalyzeTarget: '$(Pipeline.Workspace)\PSReadLine\*.dll'
164+
AnalyzeSymPath: 'SRV*'
165+
# component-governance
166+
sourceScanPath: ''
167+
# credscan
168+
suppressionsFile: ''
169+
# TermCheck
170+
optionsRulesDBPath: ''
171+
optionsFTPath: ''
172+
# tsa-upload
173+
codeBaseName: 'PSReadLine_201912'
174+
# apiscan
175+
softwareFolder: '$(Pipeline.Workspace)\PSReadLine'
176+
softwareName: 'PSReadLine'
177+
softwareVersion: '$(ModuleVersion)'

‎.vsts-ci/sign-module-files.xml‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎.vsts-ci/templates/compliance.yml‎

Lines changed: 0 additions & 76 deletions
This file was deleted.

‎tools/helper.psm1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
$MinimalSDKVersion = '5.0.100-rc.2.20479.15'
2+
$MinimalSDKVersion = '5.0.100'
33
$IsWindowsEnv = [System.Environment]::OSVersion.Platform -eq "Win32NT"
44
$RepoRoot = (Resolve-Path "$PSScriptRoot/..").Path
55
$LocalDotnetDirPath = if ($IsWindowsEnv) { "$env:LocalAppData\Microsoft\dotnet" } else { "$env:HOME/.dotnet" }

0 commit comments

Comments
 (0)