Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sign almost all the things #870

Merged
merged 15 commits into from
Aug 14, 2024
Merged

Sign almost all the things #870

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
df9d89a
Remove old signing exclusions
lewing Aug 12, 2024
88646c5
Don't sign .py or .js
lewing Aug 12, 2024
0ca26be
Don't sign already signed .ps1 files
lewing Aug 12, 2024
d7516c5
Try a new sig
lewing Aug 13, 2024
349b91c
Fix definition
lewing Aug 13, 2024
dc22482
Work around other issues
lewing Aug 13, 2024
2804aac
Remove the resolve/test directory
lewing Aug 13, 2024
25aec1c
Remove the resolve/test directory
lewing Aug 13, 2024
e839734
fix the path
lewing Aug 13, 2024
f2d292b
skip eggs.py too
lewing Aug 14, 2024
1c15da7
Clean up emsdk.proj changes
lewing Aug 14, 2024
f01f246
Add another exclusion
lewing Aug 14, 2024
ae7a5d0
Don't sign js - it makes no sense in this case
lewing Aug 14, 2024
e39fcb0
Update eng/Signing.props
lewing Aug 14, 2024
65c6045
Update eng/Signing.props
lewing Aug 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 1 addition & 4 deletions eng/SignCheckExclusionsFile.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,4 @@
;; Format: https://github.com/dotnet/arcade/blob/397316e195639450b6c76bfeb9823b40bee72d6d/src/SignCheck/Microsoft.SignCheck/Verification/Exclusion.cs#L23-L35
;;
;; This issue tracks a way to implement exclusions via Signing.props and avoid this extra file: https://github.com/dotnet/arcade/issues/2888

*.js;;Can't dual sign .js files, https://github.com/dotnet/runtime/issues/53252
*.ps1;;Can't dual sign .ps1 files, https://github.com/dotnet/runtime/issues/53252
*.exe;*.whl;The .whl files are not supported by ESRP, https://github.com/dotnet/runtime/issues/53252
lewing marked this conversation as resolved.
Show resolved Hide resolved
*.js;;We don't need to code sign .js files because they are not used in Windows Script Host
17 changes: 12 additions & 5 deletions eng/Signing.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,19 @@
<FileExtensionSignInfo Include=".cat" CertificateName="MicrosoftDotNet500" />

<!--
These files can't be dual-signed with 3PartySHA2, don't try to sign them.
Script files need to be signed with 3PartyScriptsSHA2 not the dual-signed certificate.
-->
<FileExtensionSignInfo Update=".py" CertificateName="None" />
<FileExtensionSignInfo Update=".ps1" CertificateName="None" />
<FileExtensionSignInfo Update=".js" CertificateName="None" />
<FileExtensionSignInfo Include=".vbs" CertificateName="None" />
<FileExtensionSignInfo Update=".py" CertificateName="3PartyScriptsSHA2" />
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What happened to the .vbs entry?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are no vbs files anymore

<FileExtensionSignInfo Update=".ps1" CertificateName="3PartyScriptsSHA2" />
<!-- We don't need to code sign .js files because they are not used in Windows Script Host. -->
<FileExtensionSignInfo Include=".js" CertificateName="None" />
lewing marked this conversation as resolved.
Show resolved Hide resolved

<!--
Zero length files should not be signed because it breaks signing/ESRP.
-->
<FileSignInfo Include="__init__.py" CertificateName="None" />
<FileSignInfo Include="eggs.py" CertificateName="None" />
<FileSignInfo Include="Final_Punctuation.js" CertificateName="None" />
lewing marked this conversation as resolved.
Show resolved Hide resolved
</ItemGroup>

<ItemGroup>
Expand Down
2 changes: 1 addition & 1 deletion eng/azure-pipelines.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -362,6 +362,6 @@ extends:
- template: /eng/common/templates-official/post-build/post-build.yml@self
parameters:
enableSourceLinkValidation: false
enableSigningValidation: false
enableSigningValidation: true
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What kind of time does this add to the build?

enableSymbolValidation: false
enableNugetValidation: true
1 change: 1 addition & 0 deletions eng/emsdk.proj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,6 +291,7 @@
<RemoveDir Directories="$(ArtifactsObjDir)upstream\emscripten\node_modules\google-closure-compiler-osx" />
<RemoveDir Directories="$(ArtifactsObjDir)upstream\emscripten\node_modules\google-closure-compiler-windows" />
<RemoveDir Directories="$(ArtifactsObjDir)upstream\emscripten\node_modules\google-closure-compiler-linux" />
<RemoveDir Directories="$(ArtifactsObjDir)upstream\emscripten\node_modules\resolve\test" /> <!-- contains zero length .js files -->
<RemoveDir Directories="$(ArtifactsObjDir)upstream\emscripten\third_party\closure-compiler" />
<RemoveDir Directories="$(ArtifactsObjDir)upstream\emscripten\third_party\jni" />
<RemoveDir Directories="$(ArtifactsObjDir)upstream\emscripten\third_party\ply" />
Expand Down
Loading