Skip to content

Commit d3accb8

Browse files
[3.1] eng | Secure symbols publishing (#2721)
1 parent 21deeef commit d3accb8

File tree

8 files changed

+182
-58
lines changed

8 files changed

+182
-58
lines changed

eng/pipelines/common/templates/jobs/build-signed-akv-package-job.yml

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ parameters:
1717

1818
jobs:
1919
- job: build_signed_akv_package
20+
displayName: 'Build Signed AKV Provider Package'
2021
pool:
2122
type: windows
2223

@@ -63,20 +64,11 @@ jobs:
6364
product: AKV
6465
referenceType: package
6566

66-
# Publish symbols to private server
67+
# Publish symbols to servers
6768
- template: ../steps/publish-symbols-step.yml@self
6869
parameters:
69-
SymAccount: $(PrivateSymAccount)
70-
referenceType: package
71-
symbolsVersion: ${{variables.AKVNuGetPackageVersion }}
72-
product: AKV
73-
publishSymbols: ${{ parameters['PublishSymbols'] }}
74-
75-
# Publish symbols to public server
76-
- template: ../steps/publish-symbols-step.yml@self
77-
parameters:
78-
SymAccount: $(PublicSymAccount)
7970
referenceType: package
8071
symbolsVersion: ${{variables.AKVNuGetPackageVersion }}
8172
product: AKV
8273
publishSymbols: ${{ parameters['PublishSymbols'] }}
74+
symbolsArtifactName: akv_symbols_$(System.TeamProject)_$(Build.Repository.Name)_$(Build.SourceBranchName)_$(NuGetPackageVersion)_$(System.TimelineId)

eng/pipelines/common/templates/jobs/build-signed-package-job.yml

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ parameters:
1717

1818
jobs:
1919
- job: build_signed_package
20+
displayName: 'Build Signed MDS Package'
2021
pool:
2122
type: windows
2223

@@ -51,14 +52,8 @@ jobs:
5152
parameters:
5253
product: MDS
5354

54-
# Publish symbols to private server
55+
# Publish symbols to servers
5556
- template: ../steps/publish-symbols-step.yml@self
5657
parameters:
57-
SymAccount: $(PrivateSymAccount)
58-
publishSymbols: ${{ parameters['PublishSymbols'] }}
59-
60-
# Publish symbols to public server
61-
- template: ../steps/publish-symbols-step.yml@self
62-
parameters:
63-
SymAccount: $(PublicSymAccount)
6458
publishSymbols: ${{ parameters['PublishSymbols'] }}
59+
symbolsArtifactName: mds_symbols_$(System.TeamProject)_$(Build.Repository.Name)_$(Build.SourceBranchName)_$(NuGetPackageVersion)_$(System.TimelineId)

eng/pipelines/common/templates/jobs/run-tests-package-reference-job.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ parameters:
1919

2020
jobs:
2121
- job: run_tests_package_reference
22+
displayName: 'Run tests with package reference'
23+
${{ if ne(parameters.dependsOn, 'empty')}}:
24+
dependsOn: '${{parameters.dependsOn }}'
2225
pool:
2326
type: windows # read more about custom job pool types at https://aka.ms/obpipelines/yaml/jobs
2427
isCustom: true

eng/pipelines/common/templates/jobs/validate-signed-package-job.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,9 @@ parameters:
3939

4040
jobs:
4141
- job: validate_signed_package
42+
displayName: 'Verify signed package'
43+
${{ if ne(parameters.dependsOn, '')}}:
44+
dependsOn: '${{parameters.dependsOn }}'
4245
pool:
4346
type: windows # read more about custom job pool types at https://aka.ms/obpipelines/yaml/jobs
4447
isCustom: true

eng/pipelines/common/templates/steps/esrp-code-signing-step.yml

Lines changed: 39 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,19 +17,37 @@ parameters:
1717
type: string
1818
default: $(artifactDirectory)
1919

20+
- name: appRegistrationClientId
21+
type: string
22+
default: $(appRegistrationClientId)
23+
24+
- name: appRegistrationTenantId
25+
type: string
26+
default: $(appRegistrationTenantId)
27+
2028
steps:
2129
- ${{ if eq(parameters.artifactType, 'dll') }}:
22-
- task: SFP.build-tasks.custom-build-task-2.EsrpMalwareScanning@4
30+
- task: EsrpMalwareScanning@5
2331
displayName: 'ESRP MalwareScanning'
2432
inputs:
25-
ConnectedServiceName: 'SqlClient ESRP Malware Scanning'
33+
ConnectedServiceName: 'ESRP Workload Identity federation service-ADO.Net'
34+
AppRegistrationClientId: '${{parameters.appRegistrationClientId }}'
35+
AppRegistrationTenantId: '${{parameters.appRegistrationTenantId }}'
36+
AuthAKVName: SqlClientDrivers
37+
AuthCertName: 'ESRP-Release-Auth'
2638
FolderPath: '${{parameters.sourceRoot }}'
2739
Pattern: '*.dll'
28-
Region: US
29-
- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@4
40+
CleanupTempStorage: 1
41+
VerboseLogin: 1
42+
- task: EsrpCodeSigning@5
3043
displayName: 'ESRP CodeSigning'
3144
inputs:
32-
ConnectedServiceName: 'SqlClient ESRP Code Signing'
45+
ConnectedServiceName: 'ESRP Workload Identity federation service-ADO.Net'
46+
AppRegistrationClientId: '${{parameters.appRegistrationClientId }}'
47+
AppRegistrationTenantId: '${{parameters.appRegistrationTenantId }}'
48+
AuthAKVName: SqlClientDrivers
49+
AuthCertName: 'ESRP-Release-Auth'
50+
AuthSignCertName: 'ESRP-Release-Sign2'
3351
FolderPath: '${{parameters.sourceRoot }}'
3452
Pattern: '*.dll'
3553
signConfigType: inlineSignParams
@@ -73,17 +91,28 @@ steps:
7391
]
7492
7593
- ${{ if eq(parameters.artifactType, 'pkg') }}:
76-
- task: SFP.build-tasks.custom-build-task-2.EsrpMalwareScanning@4
94+
- task: EsrpMalwareScanning@5
7795
displayName: 'ESRP MalwareScanning Nuget Package'
7896
inputs:
79-
ConnectedServiceName: 'SqlClient ESRP Malware Scanning'
97+
ConnectedServiceName: 'ESRP Workload Identity federation service-ADO.Net'
98+
AppRegistrationClientId: '${{parameters.appRegistrationClientId }}'
99+
AppRegistrationTenantId: '${{parameters.appRegistrationTenantId }}'
100+
AuthAKVName: SqlClientDrivers
101+
AuthCertName: 'ESRP-Release-Auth'
80102
FolderPath: '${{parameters.artifactDirectory }}'
81103
Pattern: '*.nupkg'
82-
Region: US
83-
- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@4
104+
CleanupTempStorage: 1
105+
VerboseLogin: 1
106+
- task: EsrpCodeSigning@5
84107
displayName: 'ESRP CodeSigning Nuget Package'
85108
inputs:
86-
ConnectedServiceName: 'SqlClient ESRP Code Signing'
109+
inputs:
110+
ConnectedServiceName: 'ESRP Workload Identity federation service-ADO.Net'
111+
AppRegistrationClientId: '${{parameters.appRegistrationClientId }}'
112+
AppRegistrationTenantId: '${{parameters.appRegistrationTenantId }}'
113+
AuthAKVName: SqlClientDrivers
114+
AuthCertName: 'ESRP-Release-Auth'
115+
AuthSignCertName: 'ESRP-Release-Sign2'
87116
FolderPath: '${{parameters.artifactDirectory }}'
88117
Pattern: '*.nupkg'
89118
signConfigType: inlineSignParams

eng/pipelines/common/templates/steps/publish-symbols-step.yml

Lines changed: 96 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,14 @@
1-
#################################################################################
2-
# Licensed to the .NET Foundation under one or more agreements. #
3-
# The .NET Foundation licenses this file to you under the MIT license. #
4-
# See the LICENSE file in the project root for more information. #
5-
#################################################################################
1+
####################################################################################
2+
# Licensed to the .NET Foundation under one or more agreements. #
3+
# The .NET Foundation licenses this file to you under the MIT license. #
4+
# See the LICENSE file in the project root for more information. #
5+
# #
6+
# doc: https://www.osgwiki.com/wiki/Symbols_Publishing_Pipeline_to_SymWeb_and_MSDL #
7+
####################################################################################
68
parameters:
79
- name: SymAccount
810
type: string
11+
default: 'SqlClientDrivers'
912

1013
- name: publishSymbols
1114
type: string
@@ -15,6 +18,23 @@ parameters:
1518
type: string
1619
default: '$(NuGetPackageVersion)'
1720

21+
- name: symbolServer
22+
type: string
23+
default: '$(SymbolServer)'
24+
25+
- name: symbolTokenUri
26+
type: string
27+
default: '$(SymbolTokenUri)'
28+
29+
- name: symbolsArtifactName
30+
type: string
31+
32+
- name: publishToServers
33+
type: object
34+
default:
35+
internal: true
36+
public: true
37+
1838
- name: referenceType
1939
default: project
2040
values:
@@ -29,12 +49,12 @@ parameters:
2949

3050
steps:
3151
- powershell: 'Write-Host "##vso[task.setvariable variable=ArtifactServices.Symbol.AccountName;]${{parameters.SymAccount}}"'
32-
displayName: 'Update Symbol.AccountName ${{parameters.SymAccount}}'
52+
displayName: 'Update Symbol.AccountName with ${{parameters.SymAccount}}'
3353
condition: and(succeeded(), ${{ eq(parameters.publishSymbols, 'true') }})
3454

3555
- ${{ if eq(parameters.product, 'MDS') }}:
3656
- task: PublishSymbols@2
37-
displayName: 'Publish symbols path'
57+
displayName: 'Upload symbols to ${{parameters.SymAccount }} org'
3858
inputs:
3959
SymbolsFolder: '$(Build.SourcesDirectory)\artifacts\${{parameters.referenceType }}\bin'
4060
SearchPattern: |
@@ -43,13 +63,16 @@ steps:
4363
IndexSources: false
4464
SymbolServerType: TeamServices
4565
SymbolsMaximumWaitTime: 60
66+
SymbolExpirationInDays: 1825 # 5 years
4667
SymbolsProduct: Microsoft.Data.SqlClient
47-
SymbolsVersion: '{{parameters.symbolsVersion }}'
68+
SymbolsVersion: ${{parameters.symbolsVersion }}
69+
SymbolsArtifactName: ${{parameters.symbolsArtifactName }}
70+
Pat: $(System.AccessToken)
4871
condition: and(succeeded(), ${{ eq(parameters.publishSymbols, 'true') }})
4972

5073
- ${{ if eq(parameters.product, 'AKV') }}:
5174
- task: PublishSymbols@2
52-
displayName: 'Publish symbols path'
75+
displayName: 'Upload symbols to ${{parameters.SymAccount }} org'
5376
inputs:
5477
SymbolsFolder: '$(Build.SourcesDirectory)\artifacts\${{parameters.referenceType }}\bin'
5578
SearchPattern: |
@@ -58,6 +81,69 @@ steps:
5881
IndexSources: false
5982
SymbolServerType: TeamServices
6083
SymbolsMaximumWaitTime: 60
84+
SymbolExpirationInDays: 1825 # 5 years
6185
SymbolsProduct: Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
62-
SymbolsVersion: '{{parameters.symbolsVersion }}'
86+
SymbolsVersion: ${{parameters.symbolsVersion }}
87+
SymbolsArtifactName: ${{parameters.symbolsArtifactName }}
88+
Pat: $(System.AccessToken)
6389
condition: and(succeeded(), ${{ eq(parameters.publishSymbols, 'true') }})
90+
91+
- task: AzureCLI@2
92+
displayName: 'Publish symbols'
93+
condition: and(succeeded(), ${{ eq(parameters.publishSymbols, 'true') }})
94+
inputs:
95+
azureSubscription: 'Symbols publishing Workload Identity federation service-ADO.Net'
96+
scriptType: ps
97+
scriptLocation: inlineScript
98+
inlineScript: |
99+
$publishToInternalServer = "${{parameters.publishToServers.internal }}".ToLower()
100+
$publishToPublicServer = "${{parameters.publishToServers.public }}".ToLower()
101+
102+
echo "Publishing request name: ${{parameters.symbolsArtifactName }}"
103+
echo "Publish to internal server: $publishToInternalServer"
104+
echo "Publish to public server: $publishToPublicServer"
105+
106+
$symbolServer = "${{parameters.symbolServer }}"
107+
$tokenUri = "${{parameters.symbolTokenUri }}"
108+
# Registered project name in the symbol publishing pipeline: https://portal.microsofticm.com/imp/v3/incidents/incident/520844254/summary
109+
$projectName = "Microsoft.Data.SqlClient.SNI"
110+
111+
# Get the access token for the symbol publishing service
112+
$symbolPublishingToken = az account get-access-token --resource $tokenUri --query accessToken -o tsv
113+
114+
echo "> 1.Symbol publishing token acquired."
115+
116+
echo "Registering the request name ..."
117+
$requestName = "${{parameters.symbolsArtifactName }}"
118+
$requestNameRegistrationBody = "{'requestName': '$requestName'}"
119+
Invoke-RestMethod -Method POST -Uri "https://$symbolServer.trafficmanager.net/projects/$projectName/requests" -Headers @{ Authorization = "Bearer $symbolPublishingToken" } -ContentType "application/json" -Body $requestNameRegistrationBody
120+
121+
echo "> 2.Registration of request name succeeded."
122+
123+
echo "Publishing the symbols ..."
124+
$publishSymbolsBody = "{'publishToInternalServer': $publishToInternalServer, 'publishToPublicServer': $publishToPublicServer}"
125+
echo "Publishing symbols request body: $publishSymbolsBody"
126+
Invoke-RestMethod -Method POST -Uri "https://$symbolServer.trafficmanager.net/projects/$projectName/requests/$requestName" -Headers @{ Authorization = "Bearer $symbolPublishingToken" } -ContentType "application/json" -Body $publishSymbolsBody
127+
128+
echo "> 3.Request to publish symbols succeeded."
129+
130+
# The following REST calls are used to check publishing status.
131+
echo "> 4.Checking the status of the request ..."
132+
133+
Invoke-RestMethod -Method GET -Uri "https://$symbolServer.trafficmanager.net/projects/$projectName/requests/$requestName" -Headers @{ Authorization = "Bearer $symbolPublishingToken" } -ContentType "application/json"
134+
135+
echo "Use below tables to interpret the values of xxxServerStatus and xxxServerResult fields from the response."
136+
137+
echo "PublishingStatus"
138+
echo "-----------------"
139+
echo "0 NotRequested; The request has not been requested to publish."
140+
echo "1 Submitted; The request is submitted to be published"
141+
echo "2 Processing; The request is still being processed"
142+
echo "3 Completed; The request has been completed processing. It can be failed or successful. Check PublishingResult to get more details"
143+
144+
echo "PublishingResult"
145+
echo "-----------------"
146+
echo "0 Pending; The request has not completed or has not been requested."
147+
echo "1 Succeeded; The request has published successfully"
148+
echo "2 Failed; The request has failed to publish"
149+
echo "3 Cancelled; The request was cancelled"

0 commit comments

Comments
 (0)