fixup! .azure-pipelines/release.yml: add macOS builds

Author: mjcheetham

.azure-pipelines/release.yml

@@ -71,12 +71,16 @@ variables:
     value: '1ESGitClient-NuGet'
   - name: 'esrpConnectionName'
     value: '1ESGitClient-ESRP'
+  - name: 'appleKeyVaultConnectionName'
+    value: '1ESGitClient-AppleKeyVault'
   # ESRP signing variables set in the pipeline settings:
   # - esrpEndpointUrl
   # - esrpClientId
   # - esrpTenantId
   # - esrpAuthAkvName
   # - esrpAuthSignCertName
+  # Apple signing variables set in the pipeline settings:
+  # - appleKeyVaultName
 
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelines
@@ -296,15 +300,63 @@ extends:
                     archiveType: tar
                     tarCompression: gz
                     archiveFile: '$(Build.ArtifactStagingDirectory)/symbols/gcm-${{ dim.runtime }}-$(version)-symbols.tar.gz'
-                # ESRP code signing for macOS requires the files be packaged in a zip file first
+                - task: AzureKeyVault@2
+                  displayName: 'Download developer certificate'
+                  inputs:
+                    azureSubscription: '$(appleKeyVaultConnectionName)'
+                    keyVaultName: '$(appleKeyVaultName)'
+                    secretsFilter: 'mac-developer-certificate,mac-developer-certificate-password,apple-team-id'
                 - task: Bash@3
-                  displayName: 'Prepare payload files for signing'
+                  displayName: 'Import developer certificate'
                   inputs:
                     targetType: inline
                     script: |
-                      mkdir -p $(Build.ArtifactStagingDirectory)/tosign
+                      # Create and unlock a keychain for the developer certificate
+                      security create-keychain -p pwd $(Agent.TempDirectory)/buildagent.keychain
+                      security default-keychain -s $(Agent.TempDirectory)/buildagent.keychain
+                      security unlock-keychain -p pwd $(Agent.TempDirectory)/buildagent.keychain
+
+                      cat $(mac-developer-certificate) | base64 -D > $(Agent.TempDirectory)/cert.p12
+                      cat $(mac-developer-certificate-password) > $(Agent.TempDirectory)/cert.password
+
+                      # Import the developer certificate
+                      security import $(Agent.TempDirectory)/cert.p12 \
+                        -k $(Agent.TempDirectory)/buildagent.keychain \
+                        -P "$(mac-developer-certificate-password)" \
+                        -T /usr/bin/codesign
+
+                      # Clean up the cert file immediately after import
+                      rm $(Agent.TempDirectory)/cert.p12
+
+                      # Set ACLs to allow codesign to access the private key
+                      security set-key-partition-list \
+                        -S apple-tool:,apple:,codesign: \
+                        -s -k pwd \
+                        $(Agent.TempDirectory)/buildagent.keychain
+                - task: Bash@3
+                  displayName: 'Developer sign payload files'
+                  inputs:
+                    targetType: inline
+                    script: |
+                      mkdir -p $(Build.ArtifactStagingDirectory)/tosign/payload
                       cd $(Build.ArtifactStagingDirectory)/payload
-                      zip -rX $(Build.ArtifactStagingDirectory)/tosign/payload.zip ./git-credential-manager *.dylib
+
+                      # Copy the files that need signing
+                      cp -t $(Build.ArtifactStagingDirectory)/tosign/payload ./git-credential-manager *.dylib
+
+                      # Developer sign the files
+                      ./src/osx/Installer.Mac/codesign.sh \
+                        "$(Build.ArtifactStagingDirectory)/tosign/payload" \
+                        "$(apple-team-id)" \
+                        "./src/osx/Installer.Mac/entitlements.xml"
+                # ESRP code signing for macOS requires the files be packaged in a zip file for submission
+                - task: ArchiveFiles@2
+                  displayName: 'Archive files for signing'
+                  inputs:
+                    rootFolderOrFile: '$(Build.ArtifactStagingDirectory)/tosign/payload'
+                    includeRootFolder: false
+                    archiveType: zip
+                    archiveFile: '$(Build.ArtifactStagingDirectory)/tosign/payload.zip'
                 - task: EsrpCodeSigning@5
                   condition: and(succeeded(), eq('${{ parameters.esrp }}', true))
                   displayName: 'Sign payload'