Skip to content

Commit b81f44a

Browse files
mjcheethammjcheetham
authored
Merge pull request #206 from microsoft/master
Release GCM Core with various fixes and new Windows user-installer
2 parents fe025c1 + ff1043f commit b81f44a

36 files changed

+1529
-436
lines changed

‎.github/run_esrp_signing.py

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
import json
2+
import os
3+
import glob
4+
import pprint
5+
import subprocess
6+
import sys
7+
8+
esrp_tool = os.path.join("esrp", "tools", "EsrpClient.exe")
9+
10+
aad_id = os.environ['AZURE_AAD_ID'].strip()
11+
workspace = os.environ['GITHUB_WORKSPACE'].strip()
12+
13+
source_root_location = os.path.join(workspace, "deb", "Release")
14+
destination_location = os.path.join(workspace)
15+
16+
files = glob.glob(os.path.join(source_root_location, "*.deb"))
17+
18+
print("Found files:")
19+
pprint.pp(files)
20+
21+
if len(files) < 1 or not files[0].endswith(".deb"):
22+
print("Error: cannot find .deb to sign")
23+
exit(1)
24+
25+
file_to_sign = os.path.basename(files[0])
26+
27+
auth_json = {
28+
"Version": "1.0.0",
29+
"AuthenticationType": "AAD_CERT",
30+
"TenantId": "72f988bf-86f1-41af-91ab-2d7cd011db47",
31+
"ClientId": aad_id,
32+
"AuthCert": {
33+
"SubjectName": f"CN={aad_id}.microsoft.com",
34+
"StoreLocation": "LocalMachine",
35+
"StoreName": "My",
36+
},
37+
"RequestSigningCert": {
38+
"SubjectName": f"CN={aad_id}",
39+
"StoreLocation": "LocalMachine",
40+
"StoreName": "My",
41+
}
42+
}
43+
44+
input_json = {
45+
"Version": "1.0.0",
46+
"SignBatches": [
47+
{
48+
"SourceLocationType": "UNC",
49+
"SourceRootDirectory": source_root_location,
50+
"DestinationLocationType": "UNC",
51+
"DestinationRootDirectory": destination_location,
52+
"SignRequestFiles": [
53+
{
54+
"CustomerCorrelationId": "01A7F55F-6CDD-4123-B255-77E6F212CDAD",
55+
"SourceLocation": file_to_sign,
56+
"DestinationLocation": os.path.join("Signed", file_to_sign),
57+
}
58+
],
59+
"SigningInfo": {
60+
"Operations": [
61+
{
62+
"KeyCode": "CP-450779-Pgp",
63+
"OperationCode": "LinuxSign",
64+
"Parameters": {},
65+
"ToolName": "sign",
66+
"ToolVersion": "1.0",
67+
}
68+
]
69+
}
70+
}
71+
]
72+
}
73+
74+
policy_json = {
75+
"Version": "1.0.0",
76+
"Intent": "production release",
77+
"ContentType": "Debian package",
78+
}
79+
80+
configs = [
81+
("auth.json", auth_json),
82+
("input.json", input_json),
83+
("policy.json", policy_json),
84+
]
85+
86+
for filename, data in configs:
87+
with open(filename, 'w') as fp:
88+
json.dump(data, fp)
89+
90+
# Run ESRP Client
91+
esrp_out = "esrp_out.json"
92+
result = subprocess.run(
93+
[esrp_tool, "sign",
94+
"-a", "auth.json",
95+
"-i", "input.json",
96+
"-p", "policy.json",
97+
"-o", esrp_out,
98+
"-l", "Verbose"],
99+
cwd=workspace)
100+
101+
if result.returncode != 0:
102+
print("Failed to run ESRPClient.exe")
103+
sys.exit(1)
104+
105+
if os.path.isfile(esrp_out):
106+
print("ESRP output json:")
107+
with open(esrp_out, 'r') as fp:
108+
pprint.pp(json.load(fp))
109+
110+
signed_file = os.path.join(destination_location, "Signed", file_to_sign)
111+
if os.path.isfile(signed_file):
112+
print(f"Success!\nSigned {signed_file}")

‎.github/workflows/build-installers.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
name: Build-Installers
22

33
on:
4+
workflow_dispatch:
45
push:
56
branches: [ master, release ]
67
pull_request:

‎.github/workflows/build-signed-deb.yml

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
name: "Build Signed Debian Installer"
2+
3+
on:
4+
workflow_dispatch:
5+
release:
6+
types: [released]
7+
8+
jobs:
9+
build:
10+
name: "Build"
11+
runs-on: ubuntu-18.04
12+
steps:
13+
- uses: actions/checkout@v2
14+
with:
15+
fetch-depth: 0 # Indicate full history so Nerdbank.GitVersioning works.
16+
17+
- name: Setup .NET Core
18+
uses: actions/setup-dotnet@v1
19+
with:
20+
dotnet-version: 3.1.302
21+
22+
- name: Install dependencies
23+
run: dotnet restore --force
24+
25+
- name: Build Linux Payloads
26+
run: dotnet build -c Release src/linux/Packaging.Linux/Packaging.Linux.csproj
27+
28+
- name: Upload Installers
29+
uses: actions/upload-artifact@v2
30+
with:
31+
name: LinuxInstallers
32+
path: |
33+
out/linux/Packaging.Linux/deb/Release/*.deb
34+
out/linux/Packaging.Linux/tar/Release/*.tar.gz
35+
36+
sign:
37+
name: 'Sign'
38+
runs-on: windows-latest
39+
needs: build
40+
steps:
41+
- name: setup python
42+
uses: actions/setup-python@v2
43+
with:
44+
python-version: 3.8
45+
46+
- uses: actions/checkout@v2
47+
48+
- name: 'Download Installer Artifact'
49+
uses: actions/download-artifact@v2
50+
with:
51+
name: LinuxInstallers
52+
53+
- uses: Azure/[email protected]
54+
with:
55+
creds: ${{ secrets.AZURE_CREDENTIALS }}
56+
57+
- name: 'Install ESRP Client'
58+
shell: pwsh
59+
env:
60+
AZ_SUB: ${{ secrets.AZURE_SUBSCRIPTION }}
61+
run: |
62+
az storage blob download --subscription "$env:AZ_SUB" --account-name gitcitoolstore -c tools -n microsoft.esrpclient.1.2.47.nupkg -f esrp.zip
63+
Expand-Archive -Path esrp.zip -DestinationPath .\esrp
64+
65+
- name: Install Certs
66+
shell: pwsh
67+
env:
68+
AZ_SUB: ${{ secrets.AZURE_SUBSCRIPTION }}
69+
AZ_VAULT: ${{ secrets.AZURE_VAULT }}
70+
SSL_CERT: ${{ secrets.VAULT_SSL_CERT_NAME }}
71+
ESRP_CERT: ${{ secrets.VAULT_ESRP_CERT_NAME }}
72+
run: |
73+
az keyvault secret download --subscription "$env:AZ_SUB" --vault-name "$env:AZ_VAULT" --name "$env:SSL_CERT" -f out.pfx
74+
certutil -f -importpfx out.pfx
75+
Remove-Item out.pfx
76+
77+
az keyvault secret download --subscription "$env:AZ_SUB" --vault-name "$env:AZ_VAULT" --name "$env:ESRP_CERT" -f out.pfx
78+
certutil -f -importpfx out.pfx
79+
Remove-Item out.pfx
80+
81+
- name: Run ESRP Client
82+
shell: pwsh
83+
env:
84+
AZURE_AAD_ID: ${{ secrets.AZURE_AAD_ID }}
85+
run: |
86+
python .github/run_esrp_signing.py
87+
88+
- name: Upload Installer
89+
uses: actions/upload-artifact@v2
90+
with:
91+
name: DebianInstallerSigned
92+
path: |
93+
Signed/*.deb

‎.github/workflows/continuous-integration.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
name: GCM-Core
22

33
on:
4+
workflow_dispatch:
45
push:
56
branches: [ master, linux ]
67
pull_request:

‎.github/workflows/release-winget.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: "release-winget"
2+
on:
3+
release:
4+
types: [released]
5+
6+
jobs:
7+
release:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Update winget repository
11+
uses: mjcheetham/[email protected]
12+
with:
13+
token: ${{ secrets.WINGET_TOKEN }}
14+
repo: microsoft/winget-pkgs
15+
id: Microsoft.GitCredentialManagerCore
16+
releaseAsset: gcmcore-win-x86-(.*)\.exe
17+
manifestText: |
18+
Id: {{id}}
19+
Version: {{version}}
20+
Name: Git Credential Manager Core
21+
Publisher: Microsoft Corporation
22+
AppMoniker: git-credential-manager-core
23+
Homepage: https://aka.ms/gcmcore
24+
Tags: "gcm, gcmcore, git, credential"
25+
License: Copyright (C) Microsoft Corporation
26+
Description: Secure, cross-platform Git credential storage with authentication to GitHub, Azure Repos, and other popular Git hosting services.
27+
Installers:
28+
- Arch: x86
29+
Url: {{url}}
30+
InstallerType: Inno
31+
Sha256: {{sha256}}
32+
alwaysUsePullRequest: true

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -340,3 +340,7 @@ out/
340340

341341
# dotnet local tools
342342
.tools/
343+
344+
# Signing generated Files
345+
auth.json
346+
input.json

‎README.md

Lines changed: 44 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,36 +6,39 @@ master|[![Build Status](https://mseng.visualstudio.com/AzureDevOps/_apis/build/s
66

77
---
88

9-
[Git Credential Manager Core](https://github.com/Microsoft/Git-Credential-Manager-Core) (GCM Core) is a secure Git credential helper built on [.NET Core](https://microsoft.com/dotnet) that runs on Windows and macOS. Linux support is planned, but not yet scheduled.
9+
[Git Credential Manager Core](https://github.com/microsoft/Git-Credential-Manager-Core) (GCM Core) is a secure Git credential helper built on [.NET Core](https://microsoft.com/dotnet) that runs on Windows and macOS. Linux support is in an early preview.
1010

1111
Compared to Git's [built-in credential helpers]((https://git-scm.com/book/en/v2/Git-Tools-Credential-Storage)) (Windows: wincred, macOS: osxkeychain, Linux: gnome-keyring) which provides single-factor authentication support working on any HTTP-enabled Git repository, GCM Core provides multi-factor authentication support for [Azure DevOps](https://dev.azure.com/), Azure DevOps Server (formerly Team Foundation Server), GitHub, and Bitbucket.
1212

13-
## Public preview
13+
Git Credential Manager Core (GCM Core) replaces the .NET Framework-based [Git Credential Manager for Windows](https://github.com/microsoft/Git-Credential-Manager-for-Windows) (GCM), and the Java-based [Git Credential Manager for Mac and Linux](https://github.com/microsoft/Git-Credential-Manager-for-Mac-and-Linux) (Java GCM), providing a consistent authentication experience across all platforms.
1414

15-
The long-term goal of Git Credential Manager Core (GCM Core) is to converge the .NET Framework-based [Git Credential Manager for Windows](https://github.com/Microsoft/Git-Credential-Manager-for-Windows) (GCM), and the Java-based [Git Credential Manager for Mac and Linux](https://github.com/Microsoft/Git-Credential-Manager-for-Mac-and-Linux) (Java GCM), providing a consistent authentication experience across all platforms.
15+
## Current status
1616

17-
### Current status
17+
Git Credential Manager Core is currently available for macOS and Windows, with Linux support in preview. If the Linux version of GCM Core is insufficient then SSH still remains an option:
1818

19-
Git Credential Manager Core is currently in preview for macOS and Windows. Linux support is planned, but not yet scheduled. For now, we recommend [SSH for authentication to Azure DevOps](https://docs.microsoft.com/en-us/azure/devops/repos/git/use-ssh-keys-to-authenticate?view=azure-devops) for Linux users.
19+
- [Azure DevOps SSH](https://docs.microsoft.com/en-us/azure/devops/repos/git/use-ssh-keys-to-authenticate?view=azure-devops)
20+
- [GitHub SSH](https://help.github.com/en/articles/connecting-to-github-with-ssh)
21+
- [Bitbucket SSH](https://confluence.atlassian.com/bitbucket/ssh-keys-935365775.html)
2022

2123
Feature|Windows|macOS|Linux
2224
-|:-:|:-:|:-:
23-
Installer/uninstaller|&#10003;|&#10003;|
24-
Secure platform credential storage|&#10003;<br/>Windows Credential Manager|&#10003;<br/>macOS Keychain|
25+
Installer/uninstaller|&#10003;|&#10003;|&#10003;\*\*
26+
Secure platform credential storage|&#10003;<br/>Windows<br/>Credential<br/>Manager|&#10003;<br/>macOS Keychain|&#10003;<br/>1. Secret Service<br/>2. `pass`/GPG<br/>3. Plaintext files
2527
Multi-factor authentication support for Azure DevOps|&#10003;|&#10003;|&#10003;\*
2628
Two-factor authentication support for GitHub|&#10003;|&#10003;\*|&#10003;\*
2729
Two-factor authentication support for Bitbucket|&#10003;|&#10003;\*|&#10003;\*
2830
Windows Integrated Authentication (NTLM/Kerberos) support|&#10003;|_N/A_|_N/A_
2931
Basic HTTP authentication support|&#10003;|&#10003;|&#10003;
30-
Proxy support|&#10003;|&#10003;|
32+
Proxy support|&#10003;|&#10003;|&#10003;
3133

3234
**Notes:**
3335

3436
(\*) Currently only supported when using Git from the terminal or command line. A platform-native UI experience is not yet available, but planned.
3537

38+
(\*\*) Debian package offered but not yet available on an official Microsoft feed.
39+
3640
### Planned features
3741

38-
- [ ] Linux support ([#135](https://github.com/microsoft/Git-Credential-Manager-Core/issues/135))
3942
- [ ] macOS/Linux native UI ([#136](https://github.com/microsoft/Git-Credential-Manager-Core/issues/136))
4043

4144
## Download and Install
@@ -51,6 +54,12 @@ brew tap microsoft/git
5154
brew cask install git-credential-manager-core
5255
```
5356

57+
After installing you can stay up-to-date with new releases by running:
58+
59+
```shell
60+
brew upgrade git-credential-manager-core
61+
```
62+
5463
#### Git Credential Manager for Mac and Linux (Java-based GCM)
5564

5665
If you have an existing installation of the 'Java GCM' on macOS and you have installed this using Homebrew, this installation will be unlinked (`brew unlink git-credential-manager`) when GCM Core is installed.
@@ -67,7 +76,7 @@ brew cask uninstall git-credential-manager-core
6776

6877
### macOS Package
6978

70-
We also provide a [.pkg installer](https://github.com/Microsoft/Git-Credential-Manager-Core/releases/latest) with each release. To install, double-click the installation package and follow the instructions presented.
79+
We also provide a [.pkg installer](https://github.com/microsoft/Git-Credential-Manager-Core/releases/latest) with each release. To install, double-click the installation package and follow the instructions presented.
7180

7281
#### Uninstall
7382

@@ -79,9 +88,33 @@ sudo /usr/local/share/gcm-core/uninstall.sh
7988

8089
---
8190

91+
### Linux Debian package (.deb)
92+
93+
Download the latest [.deb package](https://github.com/microsoft/Git-Credential-Manager-Core/releases/latest), and run the following:
94+
95+
```shell
96+
sudo dpkg -i <path-to-package>
97+
git-credential-manager-core configure
98+
```
99+
100+
Note that Linux distributions [require additional configuration](https://aka.ms/gcmcore-linuxcredstores) to use GCM Core.
101+
102+
---
103+
104+
### Linux tarball (.tar.gz)
105+
106+
Download the latest [tarball](https://github.com/microsoft/Git-Credential-Manager-Core/releases/latest), and run the following:
107+
108+
```shell
109+
tar -xvf <path-to-tarball> -C /usr/local/bin
110+
git-credential-manager-core configure
111+
```
112+
113+
---
114+
82115
### Windows
83116

84-
You can download the [latest installer](https://github.com/Microsoft/Git-Credential-Manager-Core/releases/latest) for Windows. To install, double-click the installation package and follow the instructions presented.
117+
You can download the [latest installer](https://github.com/microsoft/Git-Credential-Manager-Core/releases/latest) for Windows. To install, double-click the installation package and follow the instructions presented.
85118

86119
#### Git Credential Manager for Windows
87120

‎docs/development.md

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,17 @@ The flat binaries can also be found in `out\windows\Payload.Windows\bin\Debug\ne
4141

4242
### Linux
4343

44-
_No information yet._
44+
The two available solution configurations are `LinuxDebug` and `LinuxRelease`.
45+
46+
To build from the command line, run:
47+
48+
```shell
49+
dotnet build -c LinuxDebug
50+
```
51+
52+
You can find a copy of the Debian package (.deb) file in `out/linux/Packaging.Linux/deb/Debug`.
53+
54+
The flat binaries can also be found in `out/linux/Packaging.Linux/payload/Debug`.
4555

4656
## Debugging
4757

0 commit comments

Comments
 (0)