Skip to content
This repository was archived by the owner on Aug 29, 2025. It is now read-only.

Commit 8ee8530

Browse files
calebkiagecalebkiage
authored
Add code signing azure pipeline (#145)
* Add signing azure pipeline * Add tag azure variable * Update azure variable declarations * Remove automatic pipeline trigger * Split pipeline into multiple stages * Update pipeline * Update stage name * Update invalid stage names * Fix job dependency * Change download jobs to sequential * Disable source repository checkout * Use single stage * Use artifacts to persist files * Update artifacts * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Remove unused github action * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Remove unused variable * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline * Update pipeline
1 parent 03317b2 commit 8ee8530

File tree

3 files changed

+256
-0
lines changed

3 files changed

+256
-0
lines changed

‎.azure-pipelines/sign-binary.yaml‎

Lines changed: 224 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
# Copyright (c) Microsoft Corporation. All rights reserved.
2+
# Licensed under the MIT License.
3+
4+
name: $(BuildDefinitionName)_$(SourceBranchName)_$(Date:yyyyMMdd)$(Rev:.r)
5+
6+
trigger: none
7+
8+
pool:
9+
name: Azure Pipelines
10+
vmImage: windows-latest
11+
12+
variables:
13+
- name: sourceRepository
14+
value: 'microsoftgraph/msgraph-cli'
15+
- name: repositoryConnection
16+
value: 'GitHub - calebkiage'
17+
- name: zipTemplate
18+
value: msgraph-cli-win-x64-{0}.zip
19+
- name: defaultTag
20+
value: ${{parameters.tag}}
21+
parameters:
22+
- name: tag
23+
displayName: Tag
24+
type: string
25+
default: latest
26+
27+
28+
# download -> scan -> zip -> upload
29+
# -> sign
30+
#
31+
32+
stages:
33+
- stage: download
34+
variables:
35+
currentTag: $[ coalesce(variables.tag, variables.defaultTag) ]
36+
jobs:
37+
- job: version
38+
dependsOn: []
39+
pool:
40+
vmImage: ubuntu-latest
41+
steps:
42+
- checkout: none
43+
- script: |
44+
VERSION_VAR=$(echo $CURRENTTAG | cut -c 2-)
45+
echo "##vso[task.setvariable variable=cliVersionVar]$VERSION_VAR"
46+
condition: startsWith(variables.currentTag, 'v')
47+
- script: echo "##vso[task.setvariable variable=cliVersionVar]$CURRENTTAG"
48+
condition: not(startsWith(variables.currentTag, 'v'))
49+
- script: echo "##vso[task.setvariable variable=cliVersion;isOutput=true]$(cliVersionVar)"
50+
name: setCliVersionStep
51+
- job: download
52+
dependsOn: version
53+
variables:
54+
cliVersionVar: $[ dependencies.version.outputs['setCliVersionStep.cliVersion'] ]
55+
cliArchiveNameVar: $[format(variables.zipTemplate, variables.cliVersionVar)]
56+
pool:
57+
vmImage: ubuntu-latest
58+
steps:
59+
- checkout: none
60+
# Download GitHub Release
61+
# Downloads a GitHub Release from a repository
62+
- script: echo "##vso[task.setvariable variable=cliArchiveName;isOutput=true]$(cliArchiveNameVar)"
63+
name: setArchiveNameStep
64+
- task: DownloadGitHubRelease@0
65+
inputs:
66+
connection: $(repositoryConnection)
67+
userRepository: $(sourceRepository)
68+
defaultVersionType: 'specificTag' # Options: latest, specificVersion, specificTag
69+
version: $(currentTag) # Required when defaultVersionType != Latest
70+
itemPattern: '*-win-x64-*' # Optional
71+
downloadPath: '$(Pipeline.Workspace)'
72+
- script: unzip -j "$(Pipeline.Workspace)/$(setArchiveNameStep.cliArchiveName)" -d $(Pipeline.Workspace)/unzipped
73+
- publish: $(Pipeline.Workspace)/unzipped
74+
artifact: unzipped
75+
76+
77+
- stage: scan
78+
dependsOn: download
79+
variables:
80+
cliArchiveNameVar: $[ stageDependencies.download.download.outputs['setArchiveNameStep.cliArchiveName'] ]
81+
jobs:
82+
- job: scan
83+
steps:
84+
- checkout: none
85+
- download: current
86+
artifact: unzipped
87+
- task: AntiMalware@4
88+
displayName: 'Run MpCmdRun.exe - CLI Executable'
89+
inputs:
90+
FileDirPath: '$(Pipeline.Workspace)/unzipped'
91+
- task: BinSkim@4
92+
displayName: 'Run BinSkim - Product Binaries'
93+
inputs:
94+
InputType: Basic
95+
AnalyzeTargetGlob: '$(Pipeline.Workspace)\unzipped\*.exe'
96+
AnalyzeVerbose: true
97+
AnalyzeHashes: true
98+
AnalyzeEnvironment: false
99+
- task: PublishSecurityAnalysisLogs@3
100+
displayName: 'Publish Security Analysis Logs'
101+
inputs:
102+
ArtifactName: SecurityLogs
103+
104+
- task: PostAnalysis@1
105+
displayName: 'Post Analysis'
106+
inputs:
107+
BinSkim: true
108+
- pwsh: echo "##vso[task.setvariable variable=cliArchiveName;isOutput=true]$(cliArchiveNameVar)"
109+
name: setArchiveNameStep
110+
111+
- stage: sign
112+
dependsOn: download
113+
jobs:
114+
- job: esrpSign
115+
steps:
116+
- checkout: none
117+
- download: current
118+
artifact: unzipped
119+
- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
120+
displayName: 'ESRP CodeSigning'
121+
inputs:
122+
ConnectedServiceName: 'microsoftgraph ESRP CodeSign DLL and NuGet (AKV)'
123+
FolderPath: '$(Pipeline.Workspace)\unzipped'
124+
signConfigType: inlineSignParams
125+
inlineOperation: |
126+
[
127+
{
128+
"keyCode": "CP-230012",
129+
"operationSetCode": "SigntoolSign",
130+
"parameters": [
131+
{
132+
"parameterName": "OpusName",
133+
"parameterValue": "Microsoft"
134+
},
135+
{
136+
"parameterName": "OpusInfo",
137+
"parameterValue": "http://www.microsoft.com"
138+
},
139+
{
140+
"parameterName": "FileDigest",
141+
"parameterValue": "/fd \"SHA256\""
142+
},
143+
{
144+
"parameterName": "PageHash",
145+
"parameterValue": "/NPH"
146+
},
147+
{
148+
"parameterName": "TimeStamp",
149+
"parameterValue": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
150+
}
151+
],
152+
"toolName": "sign",
153+
"toolVersion": "1.0"
154+
},
155+
{
156+
"keyCode": "CP-230012",
157+
"operationSetCode": "SigntoolVerify",
158+
"parameters": [ ],
159+
"toolName": "sign",
160+
"toolVersion": "1.0"
161+
}
162+
]
163+
SessionTimeout: 20
164+
- pwsh: |
165+
$env:NewDir = '$(Pipeline.Workspace)\sign-summary'
166+
New-Item -Path $env:NewDir -ItemType Directory -Force
167+
Get-ChildItem '$(Pipeline.Workspace)\unzipped\*.md' | Foreach-Object { Move-Item -Path $_.FullName -Destination $env:NewDir\$($_.Name) }
168+
- publish: $(Pipeline.Workspace)\sign-summary
169+
artifact: sign-summary
170+
- publish: $(Pipeline.Workspace)\unzipped
171+
artifact: signed-executable
172+
173+
- stage: zip
174+
dependsOn: [scan, sign]
175+
variables:
176+
cliArchiveNameVar: $[ stageDependencies.scan.scan.outputs['setArchiveNameStep.cliArchiveName'] ]
177+
jobs:
178+
- job: zip
179+
pool:
180+
vmImage: ubuntu-latest
181+
steps:
182+
- checkout: none
183+
- download: current
184+
artifact: signed-executable
185+
- task: ArchiveFiles@2
186+
inputs:
187+
rootFolderOrFile: '$(Pipeline.Workspace)/signed-executable'
188+
includeRootFolder: false
189+
archiveType: 'zip' # Options: zip, 7z, tar, wim
190+
#tarCompression: 'gz' # Optional. Options: gz, bz2, xz, none
191+
archiveFile: '$(Pipeline.Workspace)/signed-executable/$(cliArchiveNameVar)'
192+
replaceExistingArchive: true
193+
verbose: true
194+
quiet: false
195+
- publish: $(Pipeline.Workspace)/signed-executable/$(cliArchiveNameVar)
196+
artifact: zipped
197+
- script: echo "##vso[task.setvariable variable=cliArchiveName;isOutput=true]$(cliArchiveNameVar)"
198+
name: setArchiveNameStep
199+
200+
- stage: upload
201+
dependsOn: zip
202+
variables:
203+
cliArchiveName: $[ stageDependencies.zip.zip.outputs['setArchiveNameStep.cliArchiveName'] ]
204+
currentTag: $[ coalesce(variables.tag, variables.defaultTag) ]
205+
isPreRelease: $[ contains(variables.currentTag, 'preview') ]
206+
jobs:
207+
- job: upload
208+
steps:
209+
- checkout: none
210+
- download: current
211+
artifact: zipped
212+
- task: GithubRelease@1
213+
displayName: 'Edit GitHub Release'
214+
inputs:
215+
gitHubConnection: $(repositoryConnection)
216+
repositoryName: $(sourceRepository)
217+
action: edit
218+
isDraft: false
219+
addChangeLog: false
220+
assetUploadMode: replace
221+
releaseNotesSource: inline
222+
assets: $(Pipeline.Workspace)/zipped/**/$(cliArchiveName)
223+
isPreRelease: $(isPreRelease)
224+
tag: $(currentTag)

‎.github/workflows/release-cli.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,3 +57,7 @@ jobs:
5757
gh release upload ${{env.PACKAGE_VERSION}} ${{env.OUTPUT_DIR}}/${{format(env.PACKAGE_ZIP_TEMPLATE, matrix.rid, steps.get-version.outputs.version)}} --clobber
5858
env:
5959
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
60+
- name: Sign binaries
61+
uses: ${{github.repository}}/.github/workflows/sign-binary.yml@${{github.event.inputs.tag || github.ref_name || 'main'}}
62+
with:
63+
tag: ${{github.event.inputs.tag || github.ref_name}}

‎.github/workflows/sign-binary.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Sign Binary
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
tag:
7+
description: 'The tag with binaries to sign'
8+
required: true
9+
type: string
10+
workflow_dispatch:
11+
inputs:
12+
tag:
13+
description: 'The tag with binaries to sign'
14+
required: true
15+
type: string
16+
17+
jobs:
18+
build:
19+
name: Call Azure Pipeline
20+
runs-on: ubuntu-latest
21+
steps:
22+
- name: Azure Pipelines Action
23+
uses: Azure/[email protected]
24+
with:
25+
azure-devops-project-url: https://dev.azure.com/microsoftgraph/Graph%20Developer%20Experiences
26+
azure-pipeline-name: 'Code Signing msgraph-cli'
27+
azure-devops-token: ${{ secrets.AZURE_DEVOPS_TOKEN }}
28+
azure-pipeline-variables: '{"tag": "${{github.event.inputs.tag}}"}'

0 commit comments

Comments
 (0)