Add code signing

dotnet · Jun 13, 2020 · bbb8168 · bbb8168
1 parent e19528d
commit bbb8168
Show file tree

Hide file tree

Showing 4 changed files with 31 additions and 0 deletions.
diff --git a/azure-pipelines/SignClient.json b/azure-pipelines/SignClient.json
@@ -0,0 +1,13 @@
+{
+  "SignClient": {
+    "AzureAd": {
+      "AADInstance": "https://login.microsoftonline.com/",
+      "ClientId": "c248d68a-ba6f-4aa9-8a68-71fe872063f8",
+      "TenantId": "16076fdc-fcc1-4a15-b1ca-32c9a255900e"
+    },
+    "Service": {
+      "Url": "https://codesign.dotnetfoundation.org/",
+      "ResourceId": "https://SignService/3c30251f-36f3-490b-a955-520addb85001"
+    }
+  }
+}
diff --git a/azure-pipelines/build.yml b/azure-pipelines/build.yml
@@ -4,6 +4,8 @@ parameters:
 jobs:
 - job: Windows
   pool: ${{ parameters.windowsPool }}
+  variables:
+  - group: pinvoke code signing
   steps:
   - checkout: self
     clean: true

diff --git a/azure-pipelines/dotnet.yml b/azure-pipelines/dotnet.yml
@@ -10,6 +10,21 @@ steps:
 - powershell: .\build.ps1 -Test
   displayName: Test
 
+- pwsh: >
+    dotnet tool install --tool-path obj SignClient
+
+    obj/SignClient sign
+    --baseDirectory '$(System.DefaultWorkingDirectory)/bin/$(BuildConfiguration)/Packages'
+    --input '**/*'
+    --config '$(System.DefaultWorkingDirectory)/azure-pipelines/SignClient.json'
+    --filelist '$(System.DefaultWorkingDirectory)/azure-pipelines/signfiles.txt'
+    --user '$(codesign_username)'
+    --secret '$(codesign_secret)'
+    --name 'PInvoke'
+    --descriptionUrl 'https://github.com/dotnet/pinvoke'
+  displayName: Code sign
+  condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'))
+
 - task: PowerShell@2
   inputs:
     filePath: azure-pipelines/variables/_pipelines.ps1

diff --git a/azure-pipelines/signfiles.txt b/azure-pipelines/signfiles.txt
@@ -0,0 +1 @@
+**/PInvoke.*.dll