Update to latest signing infrastructure
Fixes 7546
Rob Mensching committed
Sep 12, 2023 at 14:08 UTC
e570ce580afa981d3cf7750bea1d129309b48a06
5 files changed
+38
-48
.github/workflows/build.yml
+19
-2
@@ -24,6 +24,9 @@ jobs:
24
build:
25
name: Build
26
runs-on: windows-2022
27
+ permissions:
28
+ packages: write
29
+ id-token: write
30
steps:
31
- name: Checkout code
32
uses: actions/checkout@v3
@@ -34,6 +37,11 @@ jobs:
37
# shell: cmd
38
# run: ./src/vs_config.cmd
39
40
+ - name: Install sign tool
41
+ if: (github.ref == 'refs/heads/master')
42
+ shell: cmd
43
+ run: dotnet tool install --tool-path build\.tools sign --version 0.9.1-beta.23356.1
44
+
45
- name: Configure automated logging and crash dumps
46
shell: cmd
47
run: |
@@ -46,13 +54,22 @@ jobs:
54
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\LocalDumps" /t REG_DWORD /v DumpCount /d 10 /f
55
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\LocalDumps" /t REG_DWORD /v DumpType /d 1
56
57
+ - name: 'Az CLI login'
58
+ if: (github.ref == 'refs/heads/master')
59
+ uses: azure/login@v1
60
+ with:
61
+ allow-no-subscriptions: true
62
+ client-id: ${{ secrets.WIX_SIGNING_CLIENTID }}
63
+ tenant-id: ${{ secrets.WIX_SIGNING_TENANTID }}
64
+ subscription-id: ${{ secrets.WIX_SIGNING_SUBSCRIPTIONID }}
65
+
66
- name: Build wix4
67
shell: cmd
68
run: ./src/build_official.cmd
69
env:
70
RuntimeTestsEnabled: true
54
- SigningUser: ${{ github.ref == 'refs/heads/master' && secrets.WIX_SIGNING_USER || '' }}
55
- SigningSecret: ${{ github.ref == 'refs/heads/master' && secrets.WIX_SIGNING_SECRET || '' }}
71
+ SigningVaultUri: ${{ github.ref == 'refs/heads/master' && secrets.WIX_SIGNING_VAULTURI || '' }}
72
+ SigningCertName: ${{ github.ref == 'refs/heads/master' && secrets.WIX_SIGNING_CERTNAME || '' }}
73
74
- name: Validate test results
75
shell: cmd
src/Directory.Build.targets
+17
-25
@@ -4,9 +4,9 @@
4
<Project>
5
<PropertyGroup>
6
<SigningToolFolder>$(ToolsFolder)</SigningToolFolder>
7
- <SigningToolExe>$(SigningToolFolder)\SignClient.exe</SigningToolExe>
8
- <SigningFilelist>$(SigningToolFolder)\empty-filelist.txt</SigningFilelist>
9
- <SigningConfiguration>$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), signing.json))\signing.json</SigningConfiguration>
7
+ <SigningToolExe>$(SigningToolFolder)\sign.exe</SigningToolExe>
8
+ <SigningFilelist>$(MSBuildThisFileDirectory)signing-empty-file-list.txt</SigningFilelist>
9
+ <SigningConfiguration>--description "WiX Toolset" --description-url "https://wixtoolset.org/" --timestamp-url "http://timestamp.digicert.com" --file-list "$(SigningFilelist)" --azure-key-vault-managed-identity true --azure-key-vault-url "$(SigningVaultUri)" --azure-key-vault-certificate "$(SigningCertName)"</SigningConfiguration>
10
</PropertyGroup>
11
12
<PropertyGroup Condition=" '$(IsWixTestSupportProject)'=='true' ">
@@ -113,47 +113,39 @@
113
</ItemGroup>
114
</Target>
115
116
- <Target Name="_GetSignClient"
117
- Condition=" !Exists('$(SigningToolExe)') ">
118
-
119
- <WriteLinesToFile File='$(SigningFilelist)' Lines='do-not-sign-files-in-nupkg' Overwrite='true' />
120
-
121
- <Exec Command='dotnet.exe tool install --tool-path "$(SigningToolFolder)" SignClient' IgnoreExitCode='true' />
122
- </Target>
123
-
124
- <Target Name="SignOutput" DependsOnTargets="_GetSignClient" AfterTargets="AfterBuild"
125
- Condition=" '$(SigningUser)'!='' and '$(SignOutput)'!='false' and
116
+ <Target Name="SignOutput" AfterTargets="AfterBuild"
117
+ Condition=" '$(SigningCertName)'!='' and '$(SignOutput)'!='false' and
118
('$(MSBuildProjectExtension)'=='.csproj' or ('$(MSBuildProjectExtension)'=='.vcxproj' and '$(ConfigurationType)'!='StaticLibrary'))">
119
128
- <Message Importance="high" Text="Signing file: $(TargetPath) using configuration from: $(SigningConfiguration)" />
120
+ <Message Importance="high" Text="Signing file: $(TargetPath)" />
121
130
- <Exec Command='"$(SigningToolExe)" sign -i $(TargetPath) -c "$(SigningConfiguration)" -n "WiX Toolset" -d "WiX Toolset" -u https://wixtoolset.org/ -r "$(SigningUser)" -s "$(SigningSecret)"'
122
+ <Exec Command='"$(SigningToolExe)" code azure-key-vault $(TargetPath) $(SigningConfiguration)'
123
WorkingDirectory="$(MSBuildProjectDirectory)" EchoOff="true" />
124
</Target>
125
134
- <Target Name="SignNupkg" DependsOnTargets="_GetSignClient" AfterTargets="Pack;PackNative"
135
- Condition=" '$(SigningUser)'!='' and '@(NuGetPackOutput)'!='' and '$(SignNupkg)'!='false' ">
126
+ <Target Name="SignNupkg" AfterTargets="Pack;PackNative"
127
+ Condition=" '$(SigningCertName)'!='' and '@(NuGetPackOutput)'!='' and '$(SignNupkg)'!='false' ">
128
<ItemGroup>
129
<SigningNupkgs Include="@(NuGetPackOutput)" Condition=" '%(Extension)'=='.nupkg' " />
130
</ItemGroup>
131
140
- <Message Importance="high" Text="Signing nupkg: @(SigningNupkgs->'%(Identity)') using configuration from: $(SigningConfiguration)" />
132
+ <Message Importance="high" Text="Signing nupkg: @(SigningNupkgs->'%(Identity)')" />
133
142
- <Exec Command='"$(SigningToolExe)" sign -i "@(SigningNupkgs->'%(Identity)')" -c "$(SigningConfiguration)" -f "$(SigningFilelist)" -n "WiX Toolset" -d "WiX Toolset" -u https://wixtoolset.org/ -r "$(SigningUser)" -s "$(SigningSecret)"'
134
+ <Exec Command='"$(SigningToolExe)" code azure-key-vault "@(SigningNupkgs->'%(Identity)')" $(SigningConfiguration)'
135
WorkingDirectory="$(MSBuildProjectDirectory)" EchoOff="true" />
136
</Target>
137
146
- <Target Name="SignBundleEngine" DependsOnTargets="_GetSignClient" Condition=" '$(SigningUser)'!='' and '$(SignOutput)'!='false' ">
147
- <Message Importance="high" Text="Signing bundle engine: @(SignBundleEngine->'%(Identity)') using configuration from: $(SigningConfiguration)" />
138
+ <Target Name="SignBundleEngine" Condition=" '$(SigningCertName)'!='' and '$(SignOutput)'!='false' ">
139
+ <Message Importance="high" Text="Signing bundle engine: @(SignBundleEngine->'%(Identity)')" />
140
149
- <Exec Command='"$(SigningToolExe)" sign -i "@(SignBundleEngine->'%(Identity)')" -c "$(SigningConfiguration)" -f "$(SigningFilelist)" -n "WiX Toolset" -d "WiX Toolset" -u https://wixtoolset.org/ -r "$(SigningUser)" -s "$(SigningSecret)"'
141
+ <Exec Command='"$(SigningToolExe)" code azure-key-vault "@(SignBundleEngine->'%(Identity)')" $(SigningConfiguration)'
142
WorkingDirectory="$(MSBuildProjectDirectory)" EchoOff="true" />
143
</Target>
144
153
- <Target Name="SignBundle" DependsOnTargets="_GetSignClient" Condition=" '$(SigningUser)'!='' and '$(SignOutput)'!='false' ">
154
- <Message Importance="high" Text="Signing bundle: @(SignBundle->'%(Identity)') using configuration from: $(SigningConfiguration)" />
145
+ <Target Name="SignBundle" Condition=" '$(SigningCertName)'!='' and '$(SignOutput)'!='false' ">
146
+ <Message Importance="high" Text="Signing bundle: @(SignBundle->'%(Identity)')" />
147
156
- <Exec Command='"$(SigningToolExe)" sign -i "@(SignBundle->'%(Identity)')" -c "$(SigningConfiguration)" -f "$(SigningFilelist)" -n "WiX Toolset" -d "WiX Toolset" -u https://wixtoolset.org/ -r "$(SigningUser)" -s "$(SigningSecret)"'
148
+ <Exec Command='"$(SigningToolExe)" code azure-key-vault "@(SignBundle->'%(Identity)')" $(SigningConfiguration)'
149
WorkingDirectory="$(MSBuildProjectDirectory)" EchoOff="true" />
150
</Target>
151
src/internal/SetBuildNumber/SetBuildNumber.proj
+1
-8
@@ -22,8 +22,7 @@
22
GitThisAssembly;
23
SetGlobalJson;
24
SetDirectoryPackagesProps;
25
- SetOverallWixVersions;
26
- InstallSigningClient
25
+ SetOverallWixVersions
26
</SetBuildNumbersDependsOn>
27
28
<GlobalJsonPath>$([System.IO.Path]::GetFullPath($(MSBuildThisFileDirectory)..\..\..\global.json))</GlobalJsonPath>
@@ -106,12 +105,6 @@
105
</Target>
106
107
109
- <Target Name="InstallSigningClient"
110
- DependsOnTargets="_GetSignClient"
111
- Condition=" '$(SigningUser)'!='' ">
112
- </Target>
113
-
114
-
108
<Target Name="SetBuildNumbers"
109
DependsOnTargets="$(SetBuildNumbersDependsOn)"
110
BeforeTargets="AfterBuild" />
src/signing-empty-file-list.txt
new
+1
@@ -0,0 +1 @@
1
+this-file-prevents-files-from-being-signed-in-nupkgs
\ No newline at end of file
src/signing.json
deleted
-13
@@ -1,13 +0,0 @@
1
-{
2
- "SignClient": {
3
- "AzureAd": {
4
- "AADInstance": "https://login.microsoftonline.com/",
5
- "ClientId": "c248d68a-ba6f-4aa9-8a68-71fe872063f8",
6
- "TenantId": "16076fdc-fcc1-4a15-b1ca-32c9a255900e"
7
- },
8
- "Service": {
9
- "Url": "https://codesign.dotnetfoundation.org/",
10
- "ResourceId": "https://SignService/3c30251f-36f3-490b-a955-520addb85001"
11
- }
12
- }
13
-}