Skip to content

Commit 5ce7fb7

Browse files
DHowettDHowett
authored
build: move ESRP to a parameterized subtask which takes signingId (microsoft#17216)
This centralized all our ESRP calls in one file, which will make it easier in the future when we are invariable required to change how we call it again.
1 parent b6f5cbe commit 5ce7fb7

File tree

5 files changed

+117
-111
lines changed

5 files changed

+117
-111
lines changed

‎build/pipelines/templates-v2/job-build-package-wpf.yml

Lines changed: 26 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -100,36 +100,32 @@ jobs:
100100
flattenFolders: true
101101

102102
- ${{ if eq(parameters.codeSign, true) }}:
103-
- task: EsrpCodeSigning@5
104-
displayName: Submit *.nupkg to ESRP for code signing
105-
inputs:
106-
ConnectedServiceName: ${{ parameters.signingIdentity.serviceName }}
107-
AppRegistrationClientId: ${{ parameters.signingIdentity.appId }}
108-
AppRegistrationTenantId: ${{ parameters.signingIdentity.tenantId }}
109-
AuthAKVName: ${{ parameters.signingIdentity.akvName }}
110-
AuthCertName: ${{ parameters.signingIdentity.authCertName }}
111-
AuthSignCertName: ${{ parameters.signingIdentity.signCertName }}
112-
FolderPath: $(Build.ArtifactStagingDirectory)/nupkg
113-
Pattern: '*.nupkg'
114-
UseMinimatch: true
115-
signConfigType: inlineSignParams
116-
inlineOperation: >-
117-
[
118-
{
119-
"KeyCode": "CP-401405",
120-
"OperationCode": "NuGetSign",
121-
"Parameters": {},
122-
"ToolName": "sign",
123-
"ToolVersion": "1.0"
124-
},
125-
{
126-
"KeyCode": "CP-401405",
127-
"OperationCode": "NuGetVerify",
128-
"Parameters": {},
129-
"ToolName": "sign",
130-
"ToolVersion": "1.0"
131-
}
132-
]
103+
- template: steps-esrp-signing.yml
104+
parameters:
105+
displayName: Submit *.nupkg to ESRP for code signing
106+
signingIdentity: ${{ parameters.signingIdentity }}
107+
inputs:
108+
FolderPath: $(Build.ArtifactStagingDirectory)/nupkg
109+
Pattern: '*.nupkg'
110+
UseMinimatch: true
111+
signConfigType: inlineSignParams
112+
inlineOperation: >-
113+
[
114+
{
115+
"KeyCode": "CP-401405",
116+
"OperationCode": "NuGetSign",
117+
"Parameters": {},
118+
"ToolName": "sign",
119+
"ToolVersion": "1.0"
120+
},
121+
{
122+
"KeyCode": "CP-401405",
123+
"OperationCode": "NuGetVerify",
124+
"Parameters": {},
125+
"ToolName": "sign",
126+
"ToolVersion": "1.0"
127+
}
128+
]
133129
134130
- ${{ if eq(parameters.generateSbom, true) }}:
135131
- task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0

‎build/pipelines/templates-v2/job-build-project.yml

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -242,18 +242,14 @@ jobs:
242242

243243
# Code-sign everything we just put together.
244244
# We run the signing in Terminal.BinDir, because all of the signing batches are relative to the final architecture/configuration output folder.
245-
- task: EsrpCodeSigning@5
246-
displayName: Submit Signing Request
247-
inputs:
248-
ConnectedServiceName: ${{ parameters.signingIdentity.serviceName }}
249-
AppRegistrationClientId: ${{ parameters.signingIdentity.appId }}
250-
AppRegistrationTenantId: ${{ parameters.signingIdentity.tenantId }}
251-
AuthAKVName: ${{ parameters.signingIdentity.akvName }}
252-
AuthCertName: ${{ parameters.signingIdentity.authCertName }}
253-
AuthSignCertName: ${{ parameters.signingIdentity.signCertName }}
254-
FolderPath: '$(Terminal.BinDir)'
255-
signType: batchSigning
256-
batchSignPolicyFile: '$(Build.SourcesDirectory)/ESRPSigningConfig.json'
245+
- template: steps-esrp-signing.yml
246+
parameters:
247+
displayName: Submit Signing Request
248+
signingIdentity: ${{ parameters.signingIdentity }}
249+
inputs:
250+
FolderPath: '$(Terminal.BinDir)'
251+
signType: batchSigning
252+
batchSignPolicyFile: '$(Build.SourcesDirectory)/ESRPSigningConfig.json'
257253

258254
# We only need to re-pack the MSIX if we actually signed, so this can stay in the codeSign conditional
259255
- ${{ if or(parameters.buildTerminal, parameters.buildEverything) }}:

‎build/pipelines/templates-v2/job-merge-msix-into-bundle.yml

Lines changed: 35 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -97,45 +97,41 @@ jobs:
9797
displayName: Create msixbundle
9898
9999
- ${{ if eq(parameters.codeSign, true) }}:
100-
- task: EsrpCodeSigning@5
101-
displayName: Submit *.msixbundle to ESRP for code signing
102-
inputs:
103-
ConnectedServiceName: ${{ parameters.signingIdentity.serviceName }}
104-
AppRegistrationClientId: ${{ parameters.signingIdentity.appId }}
105-
AppRegistrationTenantId: ${{ parameters.signingIdentity.tenantId }}
106-
AuthAKVName: ${{ parameters.signingIdentity.akvName }}
107-
AuthCertName: ${{ parameters.signingIdentity.authCertName }}
108-
AuthSignCertName: ${{ parameters.signingIdentity.signCertName }}
109-
FolderPath: $(System.ArtifactsDirectory)\bundle
110-
Pattern: $(BundleStemName)*.msixbundle
111-
UseMinimatch: true
112-
signConfigType: inlineSignParams
113-
inlineOperation: >-
114-
[
115-
{
116-
"KeyCode": "Dynamic",
117-
"CertTemplateName": "WINMSAPP1ST",
118-
"CertSubjectName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
119-
"OperationCode": "SigntoolSign",
120-
"Parameters": {
121-
"OpusName": "Microsoft",
122-
"OpusInfo": "http://www.microsoft.com",
123-
"FileDigest": "/fd \"SHA256\"",
124-
"TimeStamp": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
125-
},
126-
"ToolName": "sign",
127-
"ToolVersion": "1.0"
128-
},
129-
{
130-
"KeyCode": "Dynamic",
131-
"CertTemplateName": "WINMSAPP1ST",
132-
"CertSubjectName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
133-
"OperationCode": "SigntoolVerify",
134-
"Parameters": {},
135-
"ToolName": "sign",
136-
"ToolVersion": "1.0"
137-
}
138-
]
100+
- template: steps-esrp-signing.yml
101+
parameters:
102+
displayName: Submit *.msixbundle to ESRP for code signing
103+
signingIdentity: ${{ parameters.signingIdentity }}
104+
inputs:
105+
FolderPath: $(System.ArtifactsDirectory)\bundle
106+
Pattern: $(BundleStemName)*.msixbundle
107+
UseMinimatch: true
108+
signConfigType: inlineSignParams
109+
inlineOperation: >-
110+
[
111+
{
112+
"KeyCode": "Dynamic",
113+
"CertTemplateName": "WINMSAPP1ST",
114+
"CertSubjectName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
115+
"OperationCode": "SigntoolSign",
116+
"Parameters": {
117+
"OpusName": "Microsoft",
118+
"OpusInfo": "http://www.microsoft.com",
119+
"FileDigest": "/fd \"SHA256\"",
120+
"TimeStamp": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
121+
},
122+
"ToolName": "sign",
123+
"ToolVersion": "1.0"
124+
},
125+
{
126+
"KeyCode": "Dynamic",
127+
"CertTemplateName": "WINMSAPP1ST",
128+
"CertSubjectName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
129+
"OperationCode": "SigntoolVerify",
130+
"Parameters": {},
131+
"ToolName": "sign",
132+
"ToolVersion": "1.0"
133+
}
134+
]
139135
140136
- ${{ if eq(parameters.generateSbom, true) }}:
141137
- task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0

‎build/pipelines/templates-v2/job-package-conpty.yml

Lines changed: 26 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -85,36 +85,32 @@ jobs:
8585
versionEnvVar: XES_PACKAGEVERSIONNUMBER
8686

8787
- ${{ if eq(parameters.codeSign, true) }}:
88-
- task: EsrpCodeSigning@5
89-
displayName: Submit *.nupkg to ESRP for code signing
90-
inputs:
91-
ConnectedServiceName: ${{ parameters.signingIdentity.serviceName }}
92-
AppRegistrationClientId: ${{ parameters.signingIdentity.appId }}
93-
AppRegistrationTenantId: ${{ parameters.signingIdentity.tenantId }}
94-
AuthAKVName: ${{ parameters.signingIdentity.akvName }}
95-
AuthCertName: ${{ parameters.signingIdentity.authCertName }}
96-
AuthSignCertName: ${{ parameters.signingIdentity.signCertName }}
97-
FolderPath: $(Build.ArtifactStagingDirectory)/nupkg
98-
Pattern: '*.nupkg'
99-
UseMinimatch: true
100-
signConfigType: inlineSignParams
101-
inlineOperation: >-
102-
[
103-
{
104-
"KeyCode": "CP-401405",
105-
"OperationCode": "NuGetSign",
106-
"Parameters": {},
107-
"ToolName": "sign",
108-
"ToolVersion": "1.0"
109-
},
110-
{
111-
"KeyCode": "CP-401405",
112-
"OperationCode": "NuGetVerify",
113-
"Parameters": {},
114-
"ToolName": "sign",
115-
"ToolVersion": "1.0"
116-
}
117-
]
88+
- template: steps-esrp-signing.yml
89+
parameters:
90+
displayName: Submit *.nupkg to ESRP for code signing
91+
signingIdentity: ${{ parameters.signingIdentity }}
92+
inputs:
93+
FolderPath: $(Build.ArtifactStagingDirectory)/nupkg
94+
Pattern: '*.nupkg'
95+
UseMinimatch: true
96+
signConfigType: inlineSignParams
97+
inlineOperation: >-
98+
[
99+
{
100+
"KeyCode": "CP-401405",
101+
"OperationCode": "NuGetSign",
102+
"Parameters": {},
103+
"ToolName": "sign",
104+
"ToolVersion": "1.0"
105+
},
106+
{
107+
"KeyCode": "CP-401405",
108+
"OperationCode": "NuGetVerify",
109+
"Parameters": {},
110+
"ToolName": "sign",
111+
"ToolVersion": "1.0"
112+
}
113+
]
118114
119115
- ${{ if eq(parameters.generateSbom, true) }}:
120116
- task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0

‎build/pipelines/templates-v2/steps-esrp-signing.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
parameters:
2+
- name: displayName
3+
type: string
4+
default: ESRP Code Signing
5+
- name: inputs
6+
type: object
7+
default: {}
8+
- name: signingIdentity
9+
type: object
10+
default: {}
11+
12+
steps:
13+
- task: EsrpCodeSigning@5
14+
displayName: ${{ parameters.displayName }}
15+
inputs:
16+
ConnectedServiceName: ${{ parameters.signingIdentity.serviceName }}
17+
AppRegistrationClientId: ${{ parameters.signingIdentity.appId }}
18+
AppRegistrationTenantId: ${{ parameters.signingIdentity.tenantId }}
19+
AuthAKVName: ${{ parameters.signingIdentity.akvName }}
20+
AuthCertName: ${{ parameters.signingIdentity.authCertName }}
21+
AuthSignCertName: ${{ parameters.signingIdentity.signCertName }}
22+
${{ insert }}: ${{ parameters.inputs }}

0 commit comments

Comments
 (0)