Skip to content

Commit b4341cb

Browse files
mjcheethammjcheetham
committed
release: sign and publish the .NET tool package
The .NET tool was dropped from the release pipeline during the build-system rework, leaving a commented stub that referenced the removed src/shared/DotnetTool scripts. Add a dotnet_tool build job that publishes the framework-dependent IL via build/dntool/publish.sh, ESRP-signs the managed assemblies (SigntoolSign), then packs the signed layout into the .nupkg/.snupkg via build/dntool/pack.sh. Re-enable the NuGet publish job to push the package. Signing is performed by the ESRP service rather than the agent, so the build job runs on the existing Linux pool alongside the other platform builds. Assisted-by: Claude Opus 4.8 Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
1 parent ae8f952 commit b4341cb

1 file changed

Lines changed: 111 additions & 77 deletions

File tree

‎.azure-pipelines/release.yml‎

Lines changed: 111 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -485,55 +485,90 @@ extends:
485485
cp $(Build.SourcesDirectory)/out/package/release/*.tar.gz $(Build.ArtifactStagingDirectory)/_final
486486
487487
#
488-
# .NET Tool build job
488+
# .NET tool build job
489489
#
490-
# - job: dotnet_tool
491-
# displayName: '.NET Tool NuGet Package'
492-
# pool:
493-
# name: GitClientPME-1ESHostedPool-intel-pc
494-
# image: win-x86_64-ado1es
495-
# os: windows
496-
# templateContext:
497-
# outputs:
498-
# - output: pipelineArtifact
499-
# targetPath: '$(Build.ArtifactStagingDirectory)/packages'
500-
# artifactName: 'dotnet-tool'
501-
# steps:
502-
# - checkout: self
503-
# - task: PowerShell@2
504-
# displayName: 'Read version file'
505-
# inputs:
506-
# targetType: inline
507-
# script: |
508-
# $version = (Get-Content .\VERSION) -replace '\.\d+$', ''
509-
# Write-Host "##vso[task.setvariable variable=version;isReadOnly=true]$version"
510-
# - task: UseDotNet@2
511-
# displayName: 'Use .NET 10 SDK'
512-
# inputs:
513-
# packageType: sdk
514-
# version: '10.x'
515-
# - task: NuGetToolInstaller@1
516-
# displayName: 'Install NuGet CLI'
517-
# inputs:
518-
# versionSpec: '>= 6.0'
519-
# - task: PowerShell@2
520-
# displayName: 'Build payload'
521-
# inputs:
522-
# targetType: filePath
523-
# filePath: './src/shared/DotnetTool/layout.ps1'
524-
# arguments: |
525-
# -Configuration Release `
526-
# -Output "$(Build.ArtifactStagingDirectory)/nupkg"
527-
# - task: PowerShell@2
528-
# displayName: 'Create NuGet packages'
529-
# inputs:
530-
# targetType: filePath
531-
# filePath: './src/shared/DotnetTool/pack.ps1'
532-
# arguments: |
533-
# -Configuration Release `
534-
# -Version "$(version)" `
535-
# -PackageRoot "$(Build.ArtifactStagingDirectory)/nupkg" `
536-
# -Output "$(Build.ArtifactStagingDirectory)/packages"
490+
- job: dotnet_tool
491+
displayName: '.NET Tool NuGet Package'
492+
# The tool is portable IL, so this runs on a single (Linux) pool
493+
# rather than per-runtime. ESRP signing is performed by the ESRP
494+
# service, so the agent OS does not constrain the SigntoolSign
495+
# operation; if a Windows agent is ever required, switch the pool and
496+
# run the scripts via git-bash/pwsh.
497+
pool:
498+
name: GitClientPME-1ESHostedPool-intel-pc
499+
image: ubuntu-x86_64-ado1es
500+
os: linux
501+
hostArchitecture: amd64
502+
templateContext:
503+
outputs:
504+
- output: pipelineArtifact
505+
targetPath: '$(Build.ArtifactStagingDirectory)/_final'
506+
artifactName: 'dotnet-tool'
507+
steps:
508+
- checkout: self
509+
- task: UseDotNet@2
510+
displayName: 'Use .NET 10 SDK'
511+
inputs:
512+
packageType: sdk
513+
version: '10.x'
514+
# Publish the tool as portable, framework-dependent IL.
515+
- task: Bash@3
516+
displayName: 'Publish payload'
517+
inputs:
518+
targetType: filePath
519+
filePath: './build/dntool/publish.sh'
520+
arguments: --configuration release
521+
# ESRP-sign (Authenticode) the managed assemblies before packing.
522+
- ${{ if eq(parameters.esrp, true) }}:
523+
# ESRP ADO tasks require .NET, which the Linux pool image does
524+
# not provide by default (the build uses .NET 10 above).
525+
- task: UseDotNet@2
526+
displayName: 'Install .NET for ESRP'
527+
inputs:
528+
packageType: sdk
529+
version: '8.x'
530+
- template: .azure-pipelines/esrp/sign.yml@self
531+
parameters:
532+
displayName: 'Sign payload'
533+
folderPath: '$(Build.SourcesDirectory)/out/publish/dntool/release'
534+
pattern: '**/*.dll'
535+
inlineOperation: |
536+
[
537+
{
538+
"KeyCode": "CP-230012",
539+
"OperationCode": "SigntoolSign",
540+
"ToolName": "sign",
541+
"ToolVersion": "1.0",
542+
"Parameters": {
543+
"OpusName": "Microsoft",
544+
"OpusInfo": "https://www.microsoft.com",
545+
"FileDigest": "/fd SHA256",
546+
"PageHash": "/NPH",
547+
"TimeStamp": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
548+
}
549+
},
550+
{
551+
"KeyCode": "CP-230012",
552+
"OperationCode": "SigntoolVerify",
553+
"ToolName": "sign",
554+
"ToolVersion": "1.0",
555+
"Parameters": {}
556+
}
557+
]
558+
# Pack the signed payload into the .nupkg.
559+
- task: Bash@3
560+
displayName: 'Create NuGet packages'
561+
inputs:
562+
targetType: filePath
563+
filePath: './build/dntool/pack.sh'
564+
arguments: --configuration release
565+
- task: Bash@3
566+
displayName: 'Collect artifacts for publishing'
567+
inputs:
568+
targetType: inline
569+
script: |
570+
mkdir -p $(Build.ArtifactStagingDirectory)/_final
571+
cp $(Build.SourcesDirectory)/out/package/release/*.nupkg $(Build.ArtifactStagingDirectory)/_final
537572
538573
- stage: release
539574
displayName: 'Release'
@@ -623,33 +658,32 @@ extends:
623658
$(Pipeline.Workspace)/assets/linux-arm64/*.deb
624659
$(Pipeline.Workspace)/assets/linux-arm64/*.tar.gz
625660
# $(Pipeline.Workspace)/assets/dotnet-tool/*.nupkg
626-
# $(Pipeline.Workspace)/assets/dotnet-tool/*.snupkg
627661

628-
# - job: nuget
629-
# displayName: 'Publish NuGet package'
630-
# dependsOn: release_validation
631-
# condition: and(succeeded(), eq('${{ parameters.nuget }}', true))
632-
# pool:
633-
# # Run on Windows so the underlying NuGetCommand@2 task can use the
634-
# # native nuget.exe. On Ubuntu 24.04+ the legacy NuGet task fails
635-
# # because Mono is no longer available.
636-
# # See https://aka.ms/nuget-task-mono.
637-
# name: GitClientPME-1ESHostedPool-intel-pc
638-
# image: win-x86_64-ado1es
639-
# os: windows
640-
# variables:
641-
# version: $[dependencies.release_validation.outputs['version.value']]
642-
# templateContext:
643-
# inputs:
644-
# - input: pipelineArtifact
645-
# artifactName: 'dotnet-tool'
646-
# targetPath: $(Pipeline.Workspace)/assets/dotnet-tool
647-
# outputs:
648-
# - output: nuget
649-
# condition: and(succeeded(), eq('${{ parameters.nuget }}', true))
650-
# displayName: 'Publish .NET Tool NuGet package'
651-
# packagesToPush: '$(Pipeline.Workspace)/assets/dotnet-tool/*.nupkg;$(Pipeline.Workspace)/assets/dotnet-tool/*.snupkg'
652-
# packageParentPath: $(Pipeline.Workspace)/assets/dotnet-tool
653-
# nuGetFeedType: external
654-
# publishPackageMetadata: true
655-
# publishFeedCredentials: $(nugetConnectionName)
662+
- job: nuget
663+
displayName: 'Publish NuGet package'
664+
dependsOn: release_validation
665+
condition: and(succeeded(), eq('${{ parameters.nuget }}', true))
666+
pool:
667+
# Run on Windows so the underlying NuGetCommand@2 task can use the
668+
# native nuget.exe. On Ubuntu 24.04+ the legacy NuGet task fails
669+
# because Mono is no longer available.
670+
# See https://aka.ms/nuget-task-mono.
671+
name: GitClientPME-1ESHostedPool-intel-pc
672+
image: win-x86_64-ado1es
673+
os: windows
674+
variables:
675+
version: $[dependencies.release_validation.outputs['version.value']]
676+
templateContext:
677+
inputs:
678+
- input: pipelineArtifact
679+
artifactName: 'dotnet-tool'
680+
targetPath: $(Pipeline.Workspace)/assets/dotnet-tool
681+
outputs:
682+
- output: nuget
683+
condition: and(succeeded(), eq('${{ parameters.nuget }}', true))
684+
displayName: 'Publish .NET Tool NuGet package'
685+
packagesToPush: '$(Pipeline.Workspace)/assets/dotnet-tool/*.nupkg'
686+
packageParentPath: $(Pipeline.Workspace)/assets/dotnet-tool
687+
nuGetFeedType: external
688+
publishPackageMetadata: true
689+
publishFeedCredentials: $(nugetConnectionName)

0 commit comments

Comments
 (0)