Skip to content

Commit cc797df

Browse files
nagilsonnagilson
authored
✒️ Enable ESRP Signing on the .VSIX (#1885)
* Add fake MSBuild project to allow signing VSIX and JS * Sign JS * Add step to pipeline * Restrict signing package version * Add scripts to install signing tool locally * only go up 1 directory * fix display name * fix whitespace -__- * add build step for installing microbuild * add sign type parameter * dont produce alpha package in official drop * add sign type parameter to default pipeline * dont publish package in another directory as this causes other issues, instead copy the artifact * acknowledge the existence of a document explaining the release and other maintenance processes this information is more suited for internal repo changes. * change internal stream to a different signing stream * add dotnet public for notargets sdk * reduce to 1 feed * use a different feed * Use dotnet team * use explicit feed source * add feed auth * fix comment * rename unsigned vsix so both can get dropped * use the other type of slash for REN -__- * try to fix path * add packages folder with empty gitignore * figure out dir * fix rename command * Fix rename the 'unsigned' one is actually the signed one * Fix JS File Sign dist is at the root of each but this runs in a segregated folder * produce binlogs and try to fix the path * Publish SDK Extension Logs * fix signing * remove bad slash in path that gets parsed incorrectly * remove \ * fix microbuild to be installed b5 js signing * update gitignore * fix gitignore again * [REVERT THIS] Add a file A.ts to see if files are signed alphabetical or only non minified JS is signed * [REVERT THIS] Add content to js to see if minify changes signing * sign js after webpack maybe we can sign it after the bundle is created and it will still be able to edit the bundle vsix internals? I thought not but perhaps extension.js is getting replaced by the webpack, so lets see if this works. * Revert "[REVERT THIS] Add content to js to see if minify changes signing" This reverts commit ecacc68. * Revert "[REVERT THIS] Add a file A.ts to see if files are signed alphabetical or only non minified JS is signed" This reverts commit 1ab6ea1. * Update name of incorrect task.
1 parent bbd5f88 commit cc797df

25 files changed

+364
-20
lines changed

Diff for: ‎.gitignore

+1-2
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@
33
TestResults/
44
.nuget/
55
.build/
6+
msbuild/signJs/*.log
67
.testPublish/
78
*.sln.ide/
89
_ReSharper.*/
9-
packages/
1010
artifacts/
1111
.build/
1212
PublishProfiles/
@@ -34,7 +34,6 @@ project.lock.json
3434
.build/
3535
.vs/
3636
launchSettings.json
37-
global.json
3837
BenchmarkDotNet.Artifacts/
3938
msbuild.binlog
4039
msbuild.log

Diff for: ‎.vscodeignore

+5-1
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,8 @@ node_modules/**
55
dist/test/**
66
src/**
77
tslint.json
8-
*.vsix
8+
*.vsix
9+
packages/
10+
msbuild/**
11+
global.json
12+
nuget.config

Diff for: ‎1es-azure-pipeline.yml

+6
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,11 @@ parameters:
4545
- name: NetCore1ESPool-Internal
4646
image: 1es-windows-2022
4747
os: windows
48+
- name: SignType
49+
displayName: Sign type
50+
type: string
51+
default: Test
52+
values: [ 'Test', 'Real' ]
4853

4954
extends:
5055
template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
@@ -91,6 +96,7 @@ extends:
9196
image: 1es-windows-2022
9297
os: windows
9398
useOneEngineeringPool: true
99+
SignType: ${{ parameters.SignType }}
94100
- template: pipeline-templates/sbom.yaml@self
95101
parameters:
96102
pool:

Diff for: ‎1pr-azure-pipeline.yml

-6
Original file line numberDiff line numberDiff line change
@@ -54,12 +54,6 @@ stages:
5454
os: windows
5555
useOneEngineeringPool: false
5656
- template: pipeline-templates/lint.yaml
57-
parameters:
58-
pool:
59-
vmImage: windows-latest
60-
os: windows
61-
useOneEngineeringPool: false
62-
- template: pipeline-templates/package-vsix.yaml
6357
parameters:
6458
pool:
6559
vmImage: windows-latest

Diff for: ‎Documentation/release.md

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
See a copy of this file in the `internal-documentation` branch in our internal repository. Or instead, check out our team one note's 'VSCode Extension' --> 'release.md' file for further information.

Diff for: ‎build.ps1

+22-1
Original file line numberDiff line numberDiff line change
@@ -81,4 +81,25 @@ popd
8181
#################### Copy Library Artifacts ####################
8282
& "$(Split-Path $MyInvocation.MyCommand.Path)/mock-webpack.ps1"
8383

84-
Write-Host "Build Succeeded" -ForegroundColor $successColor
84+
Write-Host "Build Succeeded" -ForegroundColor $successColor
85+
86+
#################### Install Signing Tool ####################
87+
88+
try
89+
{
90+
$InstallNuGetPkgScriptPath = ".\signing\Install-NuGetPackage.ps1"
91+
$nugetVerbosity = 'quiet'
92+
if ($Verbose) { $nugetVerbosity = 'normal' }
93+
$MicroBuildPackageSource = 'https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json'
94+
if ($Signing)
95+
{
96+
Write-Host "Installing MicroBuild signing plugin" -ForegroundColor $successColor
97+
Invoke-Expression "& `"$InstallNuGetPkgScriptPath`" MicroBuild.Plugins.Signing -source $MicroBuildPackageSource -Verbosity $nugetVerbosity"
98+
$EnvVars['SignType'] = "Test"
99+
}
100+
101+
& ".\signing\Set-EnvVars.ps1" -Variables $EnvVars -PrependPath $PrependPath | Out-Null
102+
} catch {
103+
Write-Host "Failed to install signing tool" -ForegroundColor $errorColor
104+
Write-Host $_.Exception.Message
105+
}

Diff for: ‎global.json

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"msbuild-sdks": {
3+
"Microsoft.Build.NoTargets": "3.7.0"
4+
}
5+
}

Diff for: ‎msbuild/Directory.Build.props

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<Project>
2+
<PropertyGroup>
3+
<RepoRoot>$(MSBuildThisFileDirectory)../</RepoRoot>
4+
</PropertyGroup>
5+
</Project>

Diff for: ‎msbuild/Directory.Build.rsp

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#------------------------------------------------------------------------------
2+
# This file contains command-line options that MSBuild will process as part of
3+
# every build, unless the "/noautoresponse" switch is specified.
4+
#
5+
# MSBuild processes the options in this file first, before processing the
6+
# options on the command line. As a result, options on the command line can
7+
# override the options in this file. However, depending on the options being
8+
# set, the overriding can also result in conflicts.
9+
#
10+
# NOTE: The "/noautoresponse" switch cannot be specified in this file, nor in
11+
# any response file that is referenced by this file.
12+
#------------------------------------------------------------------------------
13+
/nr:false
14+
/m
15+
/verbosity:minimal
16+
/clp:Summary;ForceNoAlign

Diff for: ‎msbuild/Directory.Packages.props

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<Project>
2+
<!-- https://learn.microsoft.com/nuget/consume-packages/central-package-management -->
3+
<PropertyGroup>
4+
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
5+
<CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
6+
</PropertyGroup>
7+
<ItemGroup>
8+
<GlobalPackageReference Include="Microsoft.VisualStudioEng.MicroBuild.Core" Version="1.0.0" />
9+
</ItemGroup>
10+
</Project>

Diff for: ‎msbuild/signJs/signJs.proj

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<Project Sdk="Microsoft.Build.NoTargets">
2+
<PropertyGroup>
3+
<TargetFramework>netstandard2.0</TargetFramework>
4+
<GenerateAssemblyVersionInfo>false</GenerateAssemblyVersionInfo>
5+
<EnableDefaultSignFiles>false</EnableDefaultSignFiles>
6+
<MicroBuild_DoNotStrongNameSign>true</MicroBuild_DoNotStrongNameSign>
7+
<IsPackable>false</IsPackable>
8+
<OutDir>$(MSBuildProjectDirectory)\$(JSOutputPath)\</OutDir>
9+
<MicroBuild_SigningEnabled>true</MicroBuild_SigningEnabled>
10+
</PropertyGroup>
11+
12+
<PropertyGroup Condition="'$(SignType)' == ''">
13+
<SignType>test</SignType>
14+
</PropertyGroup>
15+
16+
<ItemGroup>
17+
<FilesToSign Include="$(OutDir)*.js">
18+
<Authenticode>MicrosoftSHA2</Authenticode>
19+
</FilesToSign>
20+
</ItemGroup>
21+
</Project>

Diff for: ‎msbuild/signVsix/signVsix.proj

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<Project Sdk="Microsoft.Build.NoTargets">
2+
<PropertyGroup>
3+
<TargetFramework>netstandard2.0</TargetFramework>
4+
<GenerateAssemblyVersionInfo>false</GenerateAssemblyVersionInfo>
5+
<EnableDefaultSignFiles>false</EnableDefaultSignFiles>
6+
<MicroBuild_DoNotStrongNameSign>true</MicroBuild_DoNotStrongNameSign>
7+
<IsPackable>false</IsPackable>
8+
<OutDir>$(RepoRoot)packages\</OutDir>
9+
</PropertyGroup>
10+
<ItemGroup>
11+
<FilesToSign Include="$(OutDir)*.vsix">
12+
<Authenticode>VsixSHA2</Authenticode>
13+
</FilesToSign>
14+
</ItemGroup>
15+
</Project>

Diff for: ‎nuget.config

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<configuration>
3+
<config>
4+
<add key="repositorypath" value="packages" />
5+
</config>
6+
<packageSources>
7+
<!--To inherit the global NuGet package sources remove the <clear/> line below -->
8+
<clear />
9+
<add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" />
10+
</packageSources>
11+
<disabledPackageSources>
12+
<!-- Defend against user or machine level disabling of sources that we list in this file. -->
13+
<clear />
14+
</disabledPackageSources>
15+
</configuration>

Diff for: ‎packages/.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
*
2+
!.gitignore

Diff for: ‎pipeline-templates/build-test.yaml

+7-2
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,15 @@ jobs:
1212
templateContext:
1313
outputs:
1414
- output: pipelineArtifact
15-
displayName: '🌐 Publish Logs'
15+
displayName: '🌐 Publish Install Tool Logs'
1616
condition: always()
1717
targetPath: '$(Build.SourcesDirectory)/vscode-dotnet-runtime-extension/dist/test/functional/logs'
18-
artifactName: '${{ parameters.pool.os }} logs'
18+
artifactName: '${{ parameters.pool.os }} Install Tool logs'
19+
- output: pipelineArtifact
20+
displayName: '👜 Publish SDK Logs'
21+
condition: always()
22+
targetPath: '$(Build.SourcesDirectory)/vscode-dotnet-sdk-extension/dist/test/functional/logs'
23+
artifactName: '${{ parameters.pool.os }} SDK logs'
1924
steps:
2025
- template: install-node.yaml
2126
- ${{ if eq(parameters.pool.os, 'windows') }}:

Diff for: ‎pipeline-templates/package-vsix.yaml

+41-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
parameters:
22
pool: ''
3+
SignType: ''
34

45
jobs:
56
- job: ${{ parameters.pool.os }}_Package
@@ -12,7 +13,7 @@ jobs:
1213
dependsOn:
1314
- ${{ parameters.pool.os }}_Build
1415
- TSLint
15-
condition: succeeded()
16+
condition: and(succeeded(), eq('${{ parameters.useOneEngineeringPool }}', 'true'))
1617
strategy:
1718
matrix:
1819
Runtime:
@@ -34,23 +35,60 @@ jobs:
3435
VERSION=`node -p "require('./package.json').version"`
3536
else
3637
VERSION_NUM=`node -p "require('./package.json').version"`
37-
VERSION="$VERSION_NUM-alpha-$(Build.BuildId)"
38+
VERSION="$VERSION_NUM"
3839
fi
3940
npm version $VERSION --allow-same-version
4041
echo "##vso[task.setvariable variable=version;isOutput=true]$VERSION"
4142
name: GetVersion
4243
displayName: '❓ Get Version'
4344
workingDirectory: $(dir-name)
45+
- task: UseDotNet@2
46+
displayName: 🔮 Use .NET SDK
47+
inputs:
48+
packageType: sdk
49+
useGlobalJson: true
50+
# This is necessary whenever we want to publish/restore to an AzDO private feed
51+
# otherwise it'll complain about accessing a private feed.
52+
- task: NuGetAuthenticate@1
53+
displayName: '🔏 Authenticate to AzDO Feeds'
54+
- task: MicroBuildSigningPlugin@4
55+
displayName: 🔧 Install MicroBuild Signing Plugin
56+
inputs:
57+
signType: ${{ parameters.SignType }}
58+
zipSources: false
59+
feedSource: https://dnceng.pkgs.visualstudio.com/_packaging/MicroBuildToolset/nuget/v3/index.json
60+
env:
61+
SignType: ${{ parameters.SignType }}
62+
TeamName: DotNetCore
4463
- bash: |
4564
npm install rimraf --reg https://registry.npmjs.org/ --verbose
4665
npm install @vscode/vsce@latest -g --reg https://registry.npmjs.org/ --verbose
4766
vsce package -o $(package-name)-$(GetVersion.version).vsix --ignoreFile ../.vscodeignore --yarn
67+
cp $(package-name)-$(GetVersion.version).vsix ../packages/$(package-name)-$(GetVersion.version).vsix
4868
displayName: 📦 Package Artifact
4969
workingDirectory: $(dir-name)
70+
env:
71+
SignType: ${{ parameters.SignType }}
72+
- script: dotnet build msbuild/signVsix -v:normal
73+
displayName: 🖊️ Sign VSIXes
74+
env:
75+
SignType: ${{ parameters.SignType }}
76+
- task: CmdLine@2
77+
displayName: 🤌 Rename Signed VSIX
78+
79+
inputs:
80+
script: rename ".\packages\$(package-name)-$(GetVersion.version).vsix" $(package-name)-$(GetVersion.version)-signed.vsix
5081
- task: CopyFiles@2
5182
displayName: '📩 Copy Artifact'
5283
inputs:
5384
SourceFolder: '$(Build.SourcesDirectory)'
5485
Contents: '**\*.vsix'
5586
TargetFolder: '$(Build.ArtifactStagingDirectory)'
56-
flattenFolders: true
87+
flattenFolders: true
88+
- task: CopyFiles@2
89+
displayName: '🏗️ Copy Binlog'
90+
inputs:
91+
SourceFolder: '$(Build.SourcesDirectory)'
92+
Contents: '**\*.binlog'
93+
TargetFolder: '$(Build.ArtifactStagingDirectory)'
94+
flattenFolders: false

Diff for: ‎sample/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@
104104
]
105105
},
106106
"scripts": {
107-
"vscode:prepublish": "npm install && npm run compile",
107+
"vscode:prepublish": "npm install && npm run compile && dotnet build ../msbuild/signJs --property jsOutputPath=..\\..\\sample\\dist -bl -v:normal",
108108
"compile": "npm run clean && tsc -p ./",
109109
"watch": "npm run clean && tsc -watch -p ./",
110110
"test": "npm run compile && node ./node_modules/vscode/bin/test",

Diff for: ‎signing/Get-NuGetTool.ps1

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<#
2+
.SYNOPSIS
3+
Downloads the NuGet.exe tool and returns the path to it.
4+
.PARAMETER NuGetVersion
5+
The version of the NuGet tool to acquire.
6+
#>
7+
Param(
8+
[Parameter()]
9+
[string]$NuGetVersion='6.4.0'
10+
)
11+
12+
$toolsPath = & "$PSScriptRoot\Get-TempToolsPath.ps1"
13+
$binaryToolsPath = Join-Path $toolsPath $NuGetVersion
14+
if (!(Test-Path $binaryToolsPath)) { $null = mkdir $binaryToolsPath }
15+
$nugetPath = Join-Path $binaryToolsPath nuget.exe
16+
17+
if (!(Test-Path $nugetPath)) {
18+
Write-Host "Downloading nuget.exe $NuGetVersion..." -ForegroundColor Yellow
19+
(New-Object System.Net.WebClient).DownloadFile("https://dist.nuget.org/win-x86-commandline/v$NuGetVersion/NuGet.exe", $nugetPath)
20+
}
21+
22+
return (Resolve-Path $nugetPath).Path

Diff for: ‎signing/Get-TempToolsPath.ps1

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
if ($env:AGENT_TEMPDIRECTORY) {
2+
$path = "$env:AGENT_TEMPDIRECTORY\$env:BUILD_BUILDID"
3+
} elseif ($env:localappdata) {
4+
$path = "$env:localappdata\gitrepos\tools"
5+
} else {
6+
$path = "$PSScriptRoot\..\obj\tools"
7+
}
8+
9+
if (!(Test-Path $path)) {
10+
New-Item -ItemType Directory -Path $Path | Out-Null
11+
}
12+
13+
(Resolve-Path $path).Path

Diff for: ‎signing/Install-NuGetPackage.ps1

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
<#
2+
.SYNOPSIS
3+
Installs a NuGet package.
4+
.PARAMETER PackageID
5+
The Package ID to install.
6+
.PARAMETER Version
7+
The version of the package to install. If unspecified, the latest stable release is installed.
8+
.PARAMETER Source
9+
The package source feed to find the package to install from.
10+
.PARAMETER PackagesDir
11+
The directory to install the package to. By default, it uses the Packages folder at the root of the repo.
12+
.PARAMETER ConfigFile
13+
The nuget.config file to use. By default, it uses :/nuget.config.
14+
.OUTPUTS
15+
System.String. The path to the installed package.
16+
#>
17+
[CmdletBinding(SupportsShouldProcess=$true,ConfirmImpact='Low')]
18+
Param(
19+
[Parameter(Position=1,Mandatory=$true)]
20+
[string]$PackageId,
21+
[Parameter()]
22+
[string]$Version,
23+
[Parameter()]
24+
[string]$Source,
25+
[Parameter()]
26+
[switch]$Prerelease,
27+
[Parameter()]
28+
[string]$PackagesDir="$PSScriptRoot\..\packages",
29+
[Parameter()]
30+
[string]$ConfigFile="$PSScriptRoot\..\nuget.config",
31+
[Parameter()]
32+
[ValidateSet('Quiet','Normal','Detailed')]
33+
[string]$Verbosity='normal'
34+
)
35+
36+
$nugetPath = & "$PSScriptRoot\Get-NuGetTool.ps1"
37+
38+
try {
39+
Write-Verbose "Installing $PackageId..."
40+
$nugetArgs = "Install",$PackageId,"-OutputDirectory",$PackagesDir,'-ConfigFile',$ConfigFile
41+
if ($Version) { $nugetArgs += "-Version",$Version }
42+
if ($Source) { $nugetArgs += "-FallbackSource",$Source }
43+
if ($Prerelease) { $nugetArgs += "-Prerelease" }
44+
$nugetArgs += '-Verbosity',$Verbosity
45+
46+
if ($PSCmdlet.ShouldProcess($PackageId, 'nuget install')) {
47+
$p = Start-Process $nugetPath $nugetArgs -NoNewWindow -Wait -PassThru
48+
if ($p.ExitCode -ne 0) { throw }
49+
}
50+
51+
# Provide the path to the installed package directory to our caller.
52+
Write-Output (Get-ChildItem "$PackagesDir\$PackageId.*")[0].FullName
53+
} finally {
54+
Pop-Location
55+
}

0 commit comments

Comments
 (0)