Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ci] Use sign-artifacts template for macOS signing #9091

Merged
merged 14 commits into from
Jul 16, 2024
Merged

[ci] Use sign-artifacts template for macOS signing #9091

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
d30ca86
[ci] Use sign-artifacts template for macOS signing
pjcollins Jul 9, 2024
1995068
Use v3, update branch for msbuild/ps1 files
pjcollins Jul 9, 2024
b22188a
Merge remote-tracking branch 'origin/main' into dev/pjc/macsign-template
pjcollins Jul 10, 2024
6938bc9
Warn on unmapped files
pjcollins Jul 10, 2024
a2a252c
Merge remote-tracking branch 'origin/main' into dev/pjc/macsign-template
pjcollins Jul 10, 2024
6b6d8ab
Bump timeout
pjcollins Jul 11, 2024
c14434d
Use dotnet build instead of msbuild
pjcollins Jul 11, 2024
cd16d74
Update timeouts
pjcollins Jul 11, 2024
d074d31
Merge remote-tracking branch 'origin/main' into dev/pjc/macsign-template
pjcollins Jul 15, 2024
dc57554
Update yaml templates branch
pjcollins Jul 15, 2024
4c29fdd
Use signing v3
pjcollins Jul 15, 2024
490a13f
Merge remote-tracking branch 'origin/main' into dev/pjc/macsign-template
pjcollins Jul 15, 2024
b97cb4e
Update signlists, fail on missing files to sign
pjcollins Jul 15, 2024
c0f89f4
Add uploadprefix param
pjcollins Jul 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions build-tools/automation/azure-pipelines.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -468,7 +468,7 @@ extends:
condition: and(eq(dependencies.mac_build.result, 'Succeeded'), eq(dependencies.linux_build.result, 'Succeeded'), eq(variables['MicroBuildSignType'], 'Real'))
jobs:
# Check - "Xamarin.Android (Prepare .NET Release Sign Archives)"
- template: sign-artifacts/jobs/v2.yml@yaml-templates
- template: sign-artifacts/jobs/v3.yml@yaml-templates
parameters:
name: sign_net_mac_win
poolName: $(VSEngMicroBuildPool)
Expand All @@ -477,9 +477,12 @@ extends:
signedArtifactName: nuget-signed
usePipelineArtifactTasks: true
use1ESTemplate: true
uploadPrefix: sign-mac-win
handleUnmappedFiles: fail
timeoutInMinutes: 240

# Check - "Xamarin.Android (Prepare .NET Release Sign Linux Archive)"
- template: sign-artifacts/jobs/v2.yml@yaml-templates
- template: sign-artifacts/jobs/v3.yml@yaml-templates
parameters:
name: sign_net_linux
displayName: Sign Linux Archive
Expand All @@ -489,6 +492,9 @@ extends:
signedArtifactName: nuget-linux-signed
usePipelineArtifactTasks: true
use1ESTemplate: true
uploadPrefix: sign-linux
handleUnmappedFiles: fail
timeoutInMinutes: 120

# Check - "Xamarin.Android (Prepare .NET Release Convert NuGet to MSI)"
- template: nuget-msi-convert/job/v3.yml@yaml-templates
Expand Down
47 changes: 2 additions & 45 deletions build-tools/automation/yaml-templates/commercial-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,58 +66,15 @@ steps:
displayName: CodeQL 3000 Finalize
condition: and(succeededOrFailed(), eq(variables['Codeql.Enabled'], 'true'), eq(variables['Build.SourceBranch'], 'refs/heads/main'))

- template: /build-tools/automation/yaml-templates/install-microbuild-tooling.yaml
parameters:
condition: and(succeeded(), eq(variables['MicroBuildSignType'], 'Real'))

# Restore needs to be executed first or MicroBuild targets won't be imported in time
- task: DotNetCoreCLI@2
displayName: msbuild /t:Restore sign-content.proj
condition: and(succeeded(), eq(variables['MicroBuildSignType'], 'Real'))
inputs:
projects: ${{ parameters.xaSourcePath }}/build-tools/installers/sign-content.proj
arguments: /t:Restore /p:Configuration=$(XA.Build.Configuration) -v:n /bl:${{ parameters.xaSourcePath }}/bin/Build$(XA.Build.Configuration)/restore-sign-content.binlog

- task: DotNetCoreCLI@2
displayName: PKG signing - add entitlements and sign
displayName: macOS signing - add runtime entitlements
condition: and(succeeded(), eq(variables['MicroBuildSignType'], 'Real'))
inputs:
projects: ${{ parameters.xaSourcePath }}/build-tools/installers/sign-content.proj
arguments: >-
/t:AddMachOEntitlements;AddMSBuildFilesUnixSign;AddMSBuildFilesUnixSignAndHarden;Build
/p:Configuration=$(XA.Build.Configuration) -v:n
/p:SignType=$(MicroBuildSignType)
/p:MicroBuildOverridePluginDirectory=$(Build.StagingDirectory)/MicroBuild/Plugins
/t:AddMachOEntitlements /p:Configuration=$(XA.Build.Configuration)
/bl:${{ parameters.xaSourcePath }}/bin/Build$(XA.Build.Configuration)/sign-content.binlog

- task: DotNetCoreCLI@2
displayName: PKG signing - sign binutils libraries
condition: and(succeeded(), eq(variables['MicroBuildSignType'], 'Real'))
inputs:
projects: ${{ parameters.xaSourcePath }}/build-tools/installers/sign-content.proj
arguments: >-
/t:AddBinUtilsFilesUnixSign;Build
/p:Configuration=$(XA.Build.Configuration) -v:n
/p:SignType=$(MicroBuildSignType)
/p:MicroBuildOverridePluginDirectory=$(Build.StagingDirectory)/MicroBuild/Plugins
/bl:${{ parameters.xaSourcePath }}/bin/Build$(XA.Build.Configuration)/sign-bu-lib.binlog

- task: DotNetCoreCLI@2
displayName: PKG signing - sign binutils executables
condition: and(succeeded(), eq(variables['MicroBuildSignType'], 'Real'))
inputs:
projects: ${{ parameters.xaSourcePath }}/build-tools/installers/sign-content.proj
arguments: >-
/t:AddBinUtilsFilesUnixSignAndHarden;Build
/p:Configuration=$(XA.Build.Configuration) -v:n
/p:SignType=$(MicroBuildSignType)
/p:MicroBuildOverridePluginDirectory=$(Build.StagingDirectory)/MicroBuild/Plugins
/bl:${{ parameters.xaSourcePath }}/bin/Build$(XA.Build.Configuration)/sign-bu-ex.binlog

- template: /build-tools/automation/yaml-templates/remove-microbuild-tooling.yaml
parameters:
condition: and(succeededOrFailed(), eq(variables['MicroBuildSignType'], 'Real'))

- script: make create-installers CONFIGURATION=$(XA.Build.Configuration) MSBUILD_ARGS='${{ parameters.makeMSBuildArgs }}'
workingDirectory: ${{ parameters.xaSourcePath }}
displayName: make create-installers
Expand Down
7 changes: 7 additions & 0 deletions build-tools/create-packs/SignList.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,5 +26,12 @@
<FirstParty Include="*.exe" />
<!-- First and third party .jar files use the same Authenticode -->
<FirstParty Include="*.jar" />
<MacDeveloperSign Include="*.dylib" />
<MacDeveloperSignHarden Include="Darwin/aapt2" />
<MacDeveloperSignHarden Include="Darwin/binutils/bin/*as" />
<MacDeveloperSignHarden Include="Darwin/binutils/bin/*ld" />
<MacDeveloperSignHarden Include="Darwin/binutils/bin/llc" />
<MacDeveloperSignHarden Include="Darwin/binutils/bin/llvm-mc" />
<MacDeveloperSignHarden Include="Darwin/binutils/bin/*strip" />
Comment on lines +29 to +35
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Previously, we used an item group like @(_MSBuildFilesUnixSignAndHarden) or @(_BinUtilsFilesUnixSign), is there a chance we might miss a file?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is possible, but we have signing validation steps in place that should catch any file additions that don't have a corresponding signlist update. We could look to partially generate this in the future, though I'd like to try to get this in to help ease all of the signing pain we've been hitting over the last few weeks.

</ItemGroup>
</Project>
104 changes: 2 additions & 102 deletions build-tools/installers/sign-content.proj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@
***********************************************************************************************
sign-content.proj

This project file is used to sign and harden all relevent files included in our legacy .vsix
and .pkg installers. ESRP signing does not yet support passing a runtime entitlements
This project file is used to add runtime entitlements to any file that requires macOS signing
and runtime hardening. ESRP signing does not yet support passing a runtime entitlements
file alongside a file that needs runtime hardening, so we have to apply the entitlements
ourself (using an empty signing identity) before passing these files to ESRP.
***********************************************************************************************
Expand All @@ -12,118 +12,18 @@ ourself (using an empty signing identity) before passing these files to ESRP.

<Import Project="..\..\Configuration.props" />
<Import Project="create-installers.targets" />
<Import Project="$(XamarinAndroidSourcePath)\build-tools\create-packs\SignList.xml" />

<PropertyGroup>
<TargetFramework>netstandard2.0</TargetFramework>
<GenerateDependencyFile>false</GenerateDependencyFile>
<AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
<!-- NOTE: Any file you want to sign must be under either $(OutDir) or $(IntermediateOutputPath). -->
<OutDir Condition=" '$(OutDir)' == '' ">$(MicrosoftAndroidSdkOutDir)</OutDir>
<UnzippedVsixDir>$(OutDir)vsix-unzip\</UnzippedVsixDir>
</PropertyGroup>

<ItemGroup>
<PackageReference Include="Microsoft.VisualStudioEng.MicroBuild.Core" Version="$(MicroBuildCoreVersion)">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
</PackageReference>
</ItemGroup>

<Target Name="AddMachOEntitlements" >
<Exec Command="codesign -vvvv -f -s - -o runtime --entitlements &quot;$(DefaultRuntimeEntitlementsPath)&quot; &quot;%(_MSBuildFilesUnixSignAndHarden.Identity)&quot;" />
<Exec Command="codesign -vvvv -f -s - -o runtime --entitlements &quot;$(DefaultRuntimeEntitlementsPath)&quot; &quot;%(_BinUtilsFilesUnixSignAndHarden.Identity)&quot;" />
</Target>

<Target Name="AddMSBuildFilesUnixSign" >
<ItemGroup>
<FilesToSign Include="@(_MSBuildFilesUnixSign)">
<Authenticode>MacDeveloperVNext</Authenticode>
<Zip>true</Zip>
</FilesToSign>
</ItemGroup>
</Target>

<Target Name="AddMSBuildFilesUnixSignAndHarden" >
<ItemGroup>
<FilesToSign Include="@(_MSBuildFilesUnixSignAndHarden)">
<Authenticode>MacDeveloperVNextHarden</Authenticode>
<Zip>true</Zip>
</FilesToSign>
</ItemGroup>
</Target>

<Target Name="AddBinUtilsFilesUnixSign" >
<ItemGroup>
<FilesToSign Include="@(_BinUtilsFilesUnixSign)">
<Authenticode>MacDeveloperVNext</Authenticode>
<Zip>true</Zip>
</FilesToSign>
</ItemGroup>
</Target>

<Target Name="AddBinUtilsFilesUnixSignAndHarden" >
<ItemGroup>
<FilesToSign Include="@(_BinUtilsFilesUnixSignAndHarden)">
<Authenticode>MacDeveloperVNextHarden</Authenticode>
<Zip>true</Zip>
</FilesToSign>
</ItemGroup>
</Target>

<Target Name="AddVsixContent" >
<RemoveDir Directories="$(UnzippedVsixDir)" />
<MakeDir Directories="$(UnzippedVsixDir)" />
<Unzip
SourceFiles="$(VsixPath)"
DestinationFolder="$(UnzippedVsixDir)"
/>
<CreateItem Include="@(ThirdParty -> '$(UnzippedVsixDir)**\%(Identity)')">
<Output TaskParameter="Include" ItemName="_ThirdPartyAssemblies" />
</CreateItem>
<CreateItem Include="@(Skip -> '$(UnzippedVsixDir)**\%(Identity)')">
<Output TaskParameter="Include" ItemName="_SkipAssemblies" />
</CreateItem>
<!-- Allow full wildcards in @(FirstParty) by removing any explicitly listed @(ThirdParty) and @(Skip) content -->
<CreateItem Include="@(FirstParty -> '$(UnzippedVsixDir)**\%(Identity)')" Exclude="@(_ThirdPartyAssemblies);@(_SkipAssemblies)">
<Output TaskParameter="Include" ItemName="_FirstPartyAssemblies" />
</CreateItem>
<ItemGroup>
<FilesToSign Include="@(_FirstPartyAssemblies)" Condition="%(Extension) == '.dll' or %(Extension) == '.exe'">
<Authenticode>Microsoft400</Authenticode>
</FilesToSign>
<FilesToSign Include="@(_FirstPartyAssemblies)" Condition="%(Extension) == '.jar'">
<Authenticode>MicrosoftJARSHA2</Authenticode>
</FilesToSign>
<FilesToSign Include="@(_ThirdPartyAssemblies)" Condition="%(Extension) == '.dll' or %(Extension) == '.exe'">
<Authenticode>3PartySHA2</Authenticode>
</FilesToSign>
</ItemGroup>
</Target>

<Target Name="ZipVsixContent" >
<Delete Files="$(VsixPath)" />
<ZipDirectory
SourceDirectory="$(UnzippedVsixDir)"
DestinationFile="$(VsixPath)"
/>
</Target>

<Target Name="SignVsix" >
<ItemGroup>
<FilesToSign Include="$(OutDir)\Xamarin.Android.Sdk-*.vsix">
<Authenticode>VsixSHA2</Authenticode>
</FilesToSign>
</ItemGroup>
</Target>

<Target Name="SignPkg" >
<ItemGroup>
<FilesToSign Include="$(OutDir)\xamarin.android-*.pkg">
<Authenticode>MacDeveloperVNext</Authenticode>
<Zip>true</Zip>
</FilesToSign>
</ItemGroup>
</Target>

</Project>
Loading