Skip to content

Commit 19f7118

Browse files
wtgodbeViktorHofer
wtgodbe
and
ViktorHofer
authored
Make signing less custom (#61022)
* Make signing less custom * Don't upload checksums for wixpacks * Fix checksum for wixpacks * Add more checksums * Add more checksums * Update eng/Signing.props Co-authored-by: Viktor Hofer <[email protected]> * Update eng/Signing.props * Update eng/Signing.props * Update eng/Signing.props * Sign .js files * Set sign info for .msi's --------- Co-authored-by: Viktor Hofer <[email protected]>
1 parent 8e5493e commit 19f7118

File tree

2 files changed

+35
-76
lines changed

2 files changed

+35
-76
lines changed

‎eng/Publishing.props

-25
Original file line numberDiff line numberDiff line change
@@ -30,31 +30,6 @@
3030
<ItemGroup>
3131
<!-- Include our "loose" PDBs when publishing symbols. -->
3232
<FilesToPublishToSymbolServer Include="$(ArtifactsDir)symbols\**\*.pdb" />
33-
34-
<!-- Prepare for _PublishInstallersAndChecksums target. -->
35-
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.jar" UploadPathSegment="jar/" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
36-
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.pom" UploadPathSegment="jar/" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
37-
<!-- All builds produce npm assets - only publish them once -->
38-
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.tgz" UploadPathSegment="npm/" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
39-
<_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.version" UploadPathSegment="Runtime/" Condition="'$(PublishInstallerBaseVersion)' == 'true'" />
40-
41-
<!-- The following installers create checksums -->
42-
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.deb" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
43-
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.rpm" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
44-
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.tar.gz" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
45-
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
46-
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
47-
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.zip" Exclude="$(ArtifactsPackagesDir)**\*.wixpack.zip" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
48-
49-
<_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
50-
<_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
51-
<_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.zip" Exclude="$(ArtifactsDir)installers\$(Configuration)\**\*.wixpack.zip" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
52-
53-
<Artifact Include="@(_InstallersToPublish)" Kind="Blob">
54-
<!-- Working around msbuild not being able to negate the result of Contains() outside of targets -->
55-
<IsShipping Condition="$([System.String]::Copy('%(Filename)').ToLowerInvariant().Contains('internal')) == 'True'">false</IsShipping>
56-
<IsShipping Condition="$([System.String]::Copy('%(Filename)').ToLowerInvariant().Contains('internal')) != 'True'">true</IsShipping>
57-
</Artifact>
5833
</ItemGroup>
5934

6035
<Target Name="GetNonStableProductVersion">

‎eng/Signing.props

+35-51
Original file line numberDiff line numberDiff line change
@@ -2,61 +2,15 @@
22
<!-- See https://github.com/dotnet/arcade/blob/master/Documentation/CorePackages/Signing.md for details. -->
33
<Import Project="Common.props" />
44

5-
<ItemGroup>
6-
<!-- Reset Arcade's defaults. -->
7-
<ItemsToSign Remove="@(ItemsToSign)" />
8-
<ItemsToSignPostBuild Remove="@(ItemsToSignPostBuild)" />
9-
<FileExtensionSignInfo Remove="@(FileExtensionSignInfo)" />
10-
</ItemGroup>
11-
125
<PropertyGroup>
136
<!-- Use the dotnet certificate for any remaining defaults (e.g. StrongNameSignInfo) -->
147
<UseDotNetCertificate>true</UseDotNetCertificate>
158
</PropertyGroup>
169

17-
<!-- Files that should be always be signed -->
18-
<ItemGroup Label="Common Files to Sign">
19-
<ItemsToSign Include="$(ArtifactsPackagesDir)**\*.nupkg" />
20-
<ItemsToSign Include="$(ArtifactsPackagesDir)**\*.exe" />
21-
<ItemsToSign Include="$(ArtifactsPackagesDir)**\*.msi" />
22-
<ItemsToSign Include="$(ArtifactsPackagesDir)**\*.jar" />
23-
<ItemsToSign Include="$(ArtifactsPackagesDir)**\*.zip" />
24-
<ItemsToSign Include="$(VisualStudioSetupOutputPath)**\*.vsix" />
25-
<ItemsToSign Include="$(ArtifactsDir)installers\$(Configuration)\**\*.exe" />
26-
<ItemsToSign Include="$(ArtifactsDir)installers\$(Configuration)\**\*.msi" />
27-
<ItemsToSign Include="$(ArtifactsDir)installers\$(Configuration)\**\*.zip" />
28-
<ItemsToSign Remove="$(ArtifactsPackagesDir)**\*symbols.nupkg" />
29-
</ItemGroup>
30-
3110
<ItemGroup Label="File signing information">
32-
<!--
33-
Map file extensions to a code-sign cert.
34-
"None" means don't sign the file itself, but still scan the contents for signable files.
35-
-->
36-
<FileExtensionSignInfo Include=".jar" CertificateName="MicrosoftJARSHA2" />
37-
<FileExtensionSignInfo Include=".ps1;.psd1;.psm1;.psc1" CertificateName="MicrosoftDotNet500" />
38-
<FileExtensionSignInfo Include=".dll;.exe" CertificateName="MicrosoftDotNet500" />
39-
<FileExtensionSignInfo Include=".nupkg" CertificateName="NuGet" />
40-
<FileExtensionSignInfo Include=".vsix" CertificateName="VsixSHA2" />
41-
<FileExtensionSignInfo Include=".zip" CertificateName="None" />
42-
<FileExtensionSignInfo Include=".cab" CertificateName="None" />
11+
<!-- Arcade does not set a default for .msi's -->
4312
<FileExtensionSignInfo Include=".msi" CertificateName="MicrosoftDotNet500" />
4413

45-
<!-- Native .dll's. These don't have a public key token, but are from Microsoft and should be signed. -->
46-
<FileSignInfo Include="aspnetcore.dll" CertificateName="MicrosoftDotNet500" />
47-
<FileSignInfo Include="aspnetcorev2_inprocess.dll" CertificateName="MicrosoftDotNet500" />
48-
<FileSignInfo Include="aspnetcorev2_outofprocess.dll" CertificateName="MicrosoftDotNet500" />
49-
<FileSignInfo Include="aspnetcorev2.dll" CertificateName="MicrosoftDotNet500" />
50-
<FileSignInfo Include="blazor-devserver.exe" CertificateName="MicrosoftDotNet500" />
51-
<FileSignInfo Include="dotnet-dev-certs.exe" CertificateName="MicrosoftDotNet500" />
52-
<FileSignInfo Include="dotnet-sql-cache.exe" CertificateName="MicrosoftDotNet500" />
53-
<FileSignInfo Include="dotnet-user-secrets.exe" CertificateName="MicrosoftDotNet500" />
54-
<FileSignInfo Include="dotnet-watch.exe" CertificateName="MicrosoftDotNet500" />
55-
<FileSignInfo Include="dotnet-openapi.exe" CertificateName="MicrosoftDotNet500" />
56-
<FileSignInfo Include="dotnet-user-jwts.exe" CertificateName="MicrosoftDotNet500" />
57-
<FileSignInfo Include="Microsoft.AspNetCore.Blazor.Build.exe" CertificateName="MicrosoftDotNet500" />
58-
<FileSignInfo Include="sni.dll" CertificateName="MicrosoftDotNet500" />
59-
6014
<!-- Third-party components which should be signed. -->
6115
<FileSignInfo Include="Newtonsoft.Json.dll" CertificateName="3PartySHA2" />
6216
<FileSignInfo Include="AngleSharp.dll" CertificateName="3PartySHA2" />
@@ -72,11 +26,9 @@
7226
</PropertyGroup>
7327

7428
<ItemGroup Label="Code sign exclusions">
75-
<!-- We don't need to code sign .js files because they are not used in Windows Script Host. -->
76-
<FileExtensionSignInfo Include=".js" CertificateName="None" />
7729
<!-- We don't produce font files. We rebundle some for using the web browser, so they do not need to be signed. -->
78-
<FileExtensionSignInfo Include=".otf" CertificateName="None" />
79-
<FileExtensionSignInfo Include=".ttf" CertificateName="None" />
30+
<FileExtensionSignInfo Update=".otf" CertificateName="None" />
31+
<FileExtensionSignInfo Update=".ttf" CertificateName="None" />
8032
<!-- This is a text file which doesn't need to be code signed, even though some .mof files can be signed. -->
8133
<FileSignInfo Include="ancm.mof" CertificateName="None" />
8234
<!-- Exclude the apphost because this is expected to be code-signed by customers after the SDK modifies it. -->
@@ -121,4 +73,36 @@
12173
<FileSignInfo Include="Microsoft.Identity.Client.dll" CertificateName="None" />
12274
</ItemGroup>
12375

76+
<!-- $(InstallersOutputPath), $(SymbolsOutputPath), and $(ChecksumExtensions) are not defined. Root Directory.Build.props is not imported. -->
77+
<ItemGroup>
78+
<!-- Prepare for _PublishInstallersAndChecksums target. -->
79+
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.jar" UploadPathSegment="jar/" ChecksumPath="%(FullPath).sha512" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
80+
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.pom" UploadPathSegment="jar/" ChecksumPath="%(FullPath).sha512" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
81+
<!-- All builds produce npm assets - only publish them once -->
82+
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.tgz" UploadPathSegment="npm/" ChecksumPath="%(FullPath).sha512" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
83+
<_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.version" UploadPathSegment="Runtime/" Condition="'$(PublishInstallerBaseVersion)' == 'true'" />
84+
85+
<!-- The following installers create checksums -->
86+
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.deb" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
87+
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.rpm" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
88+
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.tar.gz" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
89+
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
90+
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
91+
<_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.zip" UploadPathSegment="Runtime/" >
92+
<ChecksumPath Condition="$([System.String]::Copy('%(Filename)%(Extension)').EndsWith('.wixpack.zip')) != 'true'">%(FullPath).sha512</ChecksumPath>
93+
</_InstallersToPublish>
94+
95+
<_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
96+
<_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
97+
<_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.zip" UploadPathSegment="Runtime/" >
98+
<ChecksumPath Condition="$([System.String]::Copy('%(Filename)%(Extension)').EndsWith('.wixpack.zip')) != 'true'">%(FullPath).sha512</ChecksumPath>
99+
</_InstallersToPublish>
100+
101+
<Artifact Include="@(_InstallersToPublish)" Kind="Blob">
102+
<!-- Working around msbuild not being able to negate the result of Contains() outside of targets -->
103+
<IsShipping Condition="$([System.String]::Copy('%(Filename)').ToLowerInvariant().Contains('internal')) == 'True'">false</IsShipping>
104+
<IsShipping Condition="$([System.String]::Copy('%(Filename)').ToLowerInvariant().Contains('internal')) != 'True'">true</IsShipping>
105+
</Artifact>
106+
</ItemGroup>
107+
124108
</Project>

0 commit comments

Comments
 (0)