Alternate service connection

Author: zooba

ci/release.yml

@@ -135,6 +135,18 @@ stages:
         displayName: 'Install signing tool and generate files'
         workingDirectory: $(Build.BinariesDirectory)
 
+      - task: AzureCLI@2
+        displayName: 'Azure CLI'
+        inputs:
+          azureSubscription: 'Python Signing'
+          scriptType: 'ps'
+          scriptLocation: 'inlineScript'
+          inlineScript: |
+            "##vso[task.setvariable variable=AZURE_CLIENT_ID;issecret=true]$servicePrincipalId" 
+            "##vso[task.setvariable variable=AZURE_ID_TOKEN;issecret=true]$idToken"
+            "##vso[task.setvariable variable=AZURE_TENANT_ID;issecret=true]$tenantId"
+          addSpnToEnvironment: true
+
     - powershell: |
         python make.py
       displayName: 'Build package'
@@ -145,21 +157,20 @@ stages:
           PYMANAGER_APPX_PUBLISHER: $(TrustedSigningCertificateSubject)
 
     - ${{ if or(eq(parameters.Sign, 'true'), eq(parameters.TestSign, 'true')) }}:
-      - task: AzureCLI@2
+      - powershell: >
+          dir -r *.exe, *.pyd | %{
+          sign code trusted-signing "$_"
+          -fd sha256 -t http://timestamp.acs.microsoft.com -td sha256
+          -tse "$(TrustedSigningUri)" -tsa "$(TrustedSigningAccount)" -tscp "$(TrustedSigningCertificateName)"
+          -d "PyManager $(Build.BuildNumber)"
+          -fl $env:SIGNLIST1
+          }
         displayName: 'Sign binaries'
-        inputs:
-          azureSubscription: 'Python Signing'
-          scriptType: ps
-          scriptLocation: inlineScript
-          inlineScript: |
-            dir -r *.exe, *.pyd | %{
-              sign code trusted-signing "$_" `
-                -fd sha256 -t http://timestamp.acs.microsoft.com -td sha256 `
-                -tse "$(TrustedSigningUri)" -tsa "$(TrustedSigningAccount)" -tscp "$(TrustedSigningCertificateName)" `
-                -d "PyManager $(Build.BuildNumber)" `
-                -fl $env:SIGNLIST1
-            }
-          workingDirectory: $(LAYOUT_DIR)
+        workingDirectory: $(LAYOUT_DIR)
+        env:
+          AZURE_CLIENT_ID: $(AZURE_CLIENT_ID)
+          AZURE_CLIENT_SECRET: $(AZURE_CLIENT_SECRET)
+          AZURE_TENANT_ID: $(AZURE_TENANT_ID)
 
     - powershell: |
         python make-msix.py
@@ -181,21 +192,35 @@ stages:
           PYMANAGER_APPX_PUBLISHER: $(TrustedSigningCertificateSubject)
 
     - ${{ if or(eq(parameters.Sign, 'true'), eq(parameters.TestSign, 'true')) }}:
-      - task: AzureCLI@2
-        displayName: 'Sign packages'
-        inputs:
-          azureSubscription: 'Python Signing'
-          scriptType: ps
-          scriptLocation: inlineScript
-          inlineScript: |
-            dir *.msix, *.msi | %{
-              sign code trusted-signing "$_" `
-                -fd sha256 -t http://timestamp.acs.microsoft.com -td sha256 `
-                -tse "$(TrustedSigningUri)" -tsa "$(TrustedSigningAccount)" -tscp "$(TrustedSigningCertificateName)" `
-                -d "PyManager $(Build.BuildNumber)" `
-                -fl $env:SIGNLIST2
-            }
-          workingDirectory: $(DIST_DIR)
+      - powershell: >
+          dir *.msix | %{
+          sign code trusted-signing "$_"
+          -fd sha256 -t http://timestamp.acs.microsoft.com -td sha256
+          -tse "$(TrustedSigningUri)" -tsa "$(TrustedSigningAccount)" -tscp "$(TrustedSigningCertificateName)"
+          -d "PyManager $(Build.BuildNumber)"
+          -fl $env:SIGNLIST2
+          }
+        displayName: 'Sign MSIX package'
+        workingDirectory: $(DIST_DIR)
+        env:
+          AZURE_CLIENT_ID: $(AZURE_CLIENT_ID)
+          AZURE_CLIENT_SECRET: $(AZURE_CLIENT_SECRET)
+          AZURE_TENANT_ID: $(AZURE_TENANT_ID)
+
+      - powershell: >
+          dir *.msi | %{
+          sign code trusted-signing "$_"
+          -fd sha256 -t http://timestamp.acs.microsoft.com -td sha256
+          -tse "$(TrustedSigningUri)" -tsa "$(TrustedSigningAccount)" -tscp "$(TrustedSigningCertificateName)"
+          -d "PyManager $(Build.BuildNumber)"
+          -fl $env:SIGNLIST3
+          }
+        displayName: 'Sign MSI package'
+        workingDirectory: $(DIST_DIR)
+        env:
+          AZURE_CLIENT_ID: $(AZURE_CLIENT_ID)
+          AZURE_CLIENT_SECRET: $(AZURE_CLIENT_SECRET)
+          AZURE_TENANT_ID: $(AZURE_TENANT_ID)
 
     - ${{ if eq(parameters.TestSign, 'true') }}:
       - powershell: Write-Host "##vso[build.addbuildtag]test-signed"