init-signing-linux.yml

# Installs the MicroBuild signing plugin for ESRP container image signing.
# After installation, MBSIGN_APPFOLDER environment variable points to DDSignFiles.dll location.
parameters:
- name: signType
  type: string
  default: test
  values:
  - test
  - real

- name: condition
  type: string
  default: "true"

- name: microBuildOutputFolder
  type: string
  default: $(Agent.TempDirectory)/MicroBuild

# Name of the pipeline variable to set with the signing docker run options.
# The variable will contain both the MicroBuild plugin volume mount and
# the --env-file flag, ready to pass as extraDockerRunOptions to run-imagebuilder.
- name: dockerRunOptionsVariableName
  type: string

steps:
# Install .NET 8.0 SDK for MicroBuild plugin installation using dotnet-install.sh.
# We avoid UseDotNet@2 because it sets DOTNET_ROOT globally, which breaks PowerShell
# (pwsh) on Azure Linux 3 where pwsh requires the .NET 9.0 runtime from the system
# .NET installation. Instead, we install to an isolated directory and only expose it
# to the MicroBuild task via its env block.
- powershell: >
    $(engDockerToolsPath)/Install-DotNetSdk.ps1
    -InstallPath "${{ parameters.microBuildOutputFolder }}/.dotnet"
    -Channel "8.0"
  displayName: Install .NET SDK for MicroBuild Plugin
  condition: and(succeeded(), ${{ parameters.condition }})

# Create a global.json in the MicroBuild folder that pins to the installed SDK.
# This prevents the repo's global.json from causing SDK resolution failures
# when MicroBuild runs dotnet restore from this directory.
- script: |
    mkdir -p ${{ parameters.microBuildOutputFolder }}
    version=$(${{ parameters.microBuildOutputFolder }}/.dotnet/dotnet --version)
    cat > ${{ parameters.microBuildOutputFolder }}/global.json << EOF
    {
      "sdk": {
        "version": "$version"
      }
    }
    EOF
  displayName: Create global.json for MicroBuild
  condition: and(succeeded(), ${{ parameters.condition }})

- task: MicroBuildSigningPlugin@4
  displayName: Install MicroBuild Signing Plugin
  condition: and(succeeded(), ${{ parameters.condition }})
  inputs:
    version: $(MicroBuildPluginVersion)
    ${{ if eq(parameters.signType, 'test') }}:
      signType: test
    ${{ else }}:
      signType: real
    zipSources: false
    feedSource: $(MicroBuildFeedSource)
    ConnectedServiceName: 'MicroBuild Signing Task (DevDiv)'
    ConnectedPMEServiceName: c24de2a5-cc7a-493d-95e4-8e5ff5cad2bc
    workingDirectory: ${{ parameters.microBuildOutputFolder }}
  env:
    TeamName: $(TeamName)
    MicroBuildOutputFolderOverride: $(Agent.TempDirectory)/MicroBuild
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)
    PATH: ${{ parameters.microBuildOutputFolder }}/.dotnet:$(PATH)

# Configure docker run options for signing.
# Writes an env file with signing variables and sets $(signingDockerRunOptions)
# with both the MicroBuild plugin volume mount and the --env-file flag.
- task: PowerShell@2
  displayName: Configure ImageBuilder Signing Options
  condition: and(succeeded(), ${{ parameters.condition }})
  inputs:
    targetType: 'inline'
    script: |
      # Write the signing env file for docker --env-file.
      # Docker reads this file on the host before creating the container,
      # so no volume mount is needed for the file itself.
      $envFilePath = "$(Agent.TempDirectory)/imagebuilder-signing.env"
      $envFileContent = @(
        # MicroBuild plugin variables for DDSignFiles.dll
        "MBSIGN_APPFOLDER=/microbuild"
        "VSENGESRPSSL"
        "USEESRPCLI"
        "MBSIGN_CONNECTEDSERVICE"

        # Container-local temp/workspace paths (host paths aren't accessible inside the container)
        "MBSIGNTEMPDIR=/tmp/MicroBuildSign"
        "PIPELINE_WORKSPACE=$(Build.ArtifactStagingDirectory)"
        "AGENT_TEMPDIRECTORY=/tmp"

        # Azure DevOps pipeline variables for ESRP bearer token auth (ESRPUtils.GetAccountInfo)
        "SYSTEM_TEAMFOUNDATIONCOLLECTIONURI"
        "BUILD_BUILDID"
        "SYSTEM_TEAMPROJECT"
        "BUILD_SOURCEBRANCH"

        # Azure DevOps pipeline variables for ESRP CLI federated token (ESRPCliDll.GetFederatedTokenData)
        "SYSTEM_JOBID"
        "SYSTEM_PLANID"
        "SYSTEM_TEAMPROJECTID"
        "SYSTEM_HOSTTYPE"
        "SYSTEM_COLLECTIONURI"

        # Azure DevOps pipeline variables for DDSignFilesConfiguration
        "BUILD_DEFINITIONNAME"
        "BUILD_BUILDNUMBER"
      )

      $envFileContent | Set-Content -Path $envFilePath -Encoding utf8NoBOM

      # Compose docker run options for signing:
      # - Volume mount for MicroBuild plugin directory (DDSignFiles.dll and esrpcli.dll)
      # - Env file with signing environment variables
      $signingDockerRunOptions = "-v $env:MBSIGN_APPFOLDER`:/microbuild --env-file `"$envFilePath`""
      Write-Host "signingDockerRunOptions: $signingDockerRunOptions"
      Write-Host "##vso[task.setvariable variable=${{ parameters.dockerRunOptionsVariableName }}]$signingDockerRunOptions"