Merge pull request #7490 from dibarbet/dev/dibarbet/signing

Add signing support to VSIX

Author: dibarbet

.gitignore

@@ -14,6 +14,8 @@ out
 .razortelemetry/
 .razorDevKit/
 .vscode-test/
+msbuild/signing/signJs/*.log
+msbuild/signing/signVsix/*.log
 dist/
 *.razor.json
 

.vscodeignore

@@ -14,7 +14,7 @@
 .vscode-test/**
 coverage/**
 out/**
-server/**
+msbuild/**
 src/**
 tasks/**
 test/**
@@ -33,6 +33,9 @@ azure-pipelines
 .editorconfig
 .gitignore
 CODEOWNERS
+Directory.Build.props
+global.json
+NuGet.config
 gulpfile.ts
 !install.Lock
 ISSUE_TEMPLATE

Directory.Build.props

@@ -1,5 +1,6 @@
 <Project>
     <PropertyGroup>
+        <RepoRoot>$(MSBuildThisFileDirectory)</RepoRoot>
         <!--
             Defines the lowest supported target framework for the extension.
             Used by server download / integration tests to ensure they run when only this SDK is installed.

server/NuGet.config renamed to NuGet.config

@@ -19,6 +19,13 @@ parameters:
   - prerelease
   - auto
   default: auto
+# Allows the sign type to be set manually for a specific build
+- name: signType
+  values:
+  - test
+  - real
+  - auto
+  default: auto
 
 resources:
   repositories:
@@ -51,3 +58,4 @@ extends:
         versionNumberOverride: ${{ parameters.versionNumberOverride }}
         isOfficial: true
         channel: ${{ parameters.channel }}
+        signType: ${{ parameters.signType }}

azure-pipelines-official.yml

@@ -22,6 +22,7 @@ stages:
 - template: azure-pipelines/build-all.yml
   parameters:
     isOfficial: false
+    signType: test
 
 - stage: Test_Linux_Stage
   displayName: Test Linux

azure-pipelines.yml

@@ -10,13 +10,20 @@ parameters:
   - prerelease
   - auto
   default: auto
+- name: signType
+  values:
+  - test
+  - real
+  - auto
+  default: auto
+
 stages:
 - stage: Build
   displayName: 'Build VSIXs'
   dependsOn: []
   jobs:
-  - job: SetChannelVariable
-    displayName: 'Set Channel Variable'
+  - job: SetRunVariables
+    displayName: 'Set Run Variables'
     pool:
       ${{ if eq(parameters.isOfficial, true) }}:
         name: netcore1espool-internal
@@ -53,8 +60,37 @@ stages:
           Write-Host "Setting pipeline channel variable to Release."
           Write-Host "##vso[task.setvariable variable=channel;isoutput=true]Release"
         }
-      name: passOutput
-      
+      name: passChannel
+      displayName: Set Channel Variable
+
+    - pwsh: |
+        $signType = "test"
+        if ("${{ parameters.isOfficial }}" -ne "true") {
+          Write-Host "Not an official build, test signing"
+          $signType = "test"
+        } elseif ("${{ parameters.signType }}"  -eq "test") {
+          Write-Host "Sign type override set to ${{ parameters.signType }}"
+          $signType = "test"
+        } elseif ("${{ parameters.signType }}"  -eq "real") {
+          Write-Host "Sign type override set to ${{ parameters.signType }}"
+          $signType = "real"
+        } else {
+          Write-Host "Sign type override is ${{ parameters.signType }}, using branch configuration to determine sign type"
+          Write-Host "Detected branch $(Build.SourceBranchName)"
+          if ( ("$(Build.SourceBranchName)" -eq "release") -or ("$(Build.SourceBranchName)" -eq "prerelease")) {
+            Write-Host "Branch is a release branch, using real sign type."
+            $signType = 'real'
+          } else {
+            Write-Host "Branch is test branch, using test sign type."
+            $signType = 'test'
+          }
+        }
+
+        Write-Host "Setting pipeline signType variable to " $signType
+        Write-Host "##vso[task.setvariable variable=signType;isoutput=true]$signType"
+      name: passSignType
+      displayName: Set Sign Type
+
   - template: /azure-pipelines/build.yml@self
     parameters:
       versionNumberOverride: ${{ parameters.versionNumberOverride }}

azure-pipelines/build-all.yml

@@ -13,9 +13,11 @@ jobs:
 - job: 'Build_${{ parameters.platform }}_vsixs'
   pool: ${{ parameters.pool }}
   displayName: 'Build ${{ parameters.platform }} vsixs'
-  dependsOn: SetChannelVariable
+  dependsOn: SetRunVariables
   variables:
-    channel: $[ dependencies.SetChannelVariable.outputs['passOutput.channel'] ]
+    channel: $[ dependencies.SetRunVariables.outputs['passChannel.channel'] ]
+    signType: $[ dependencies.SetRunVariables.outputs['passSignType.signType'] ]
+    teamName: DotNetCore
   steps:
   - checkout: self
     clean: true
@@ -25,6 +27,20 @@ jobs:
   - template: /azure-pipelines/prereqs.yml@self
     parameters:
       versionNumberOverride: ${{ parameters.versionNumberOverride }}
+
+  # If we're in an official build, install the signing plugin
+  - ${{ if eq(parameters.isOfficial, true) }}:
+    - task: MicroBuildSigningPlugin@4
+      displayName: 🔧 Install MicroBuild Signing Plugin
+      inputs:
+        signType: $(signType)
+        zipSources: false
+        feedSource: https://dnceng.pkgs.visualstudio.com/_packaging/MicroBuildToolset/nuget/v3/index.json
+        azureSubscription: 'MicroBuild Signing Task (DevDiv)'
+      env:
+        SignType: $(signType)
+        TeamName: $(teamName)
+
   - pwsh: |
       Write-Host "Building VSIXs for platform ${{ parameters.platform }} and channel $(channel)"
       if ("$(channel)" -eq "Release") {
@@ -33,6 +49,15 @@ jobs:
         gulp vsix:release:package:${{ parameters.platform }} --prerelease
       }
     displayName: 'Build VSIXs'
+    env:
+      SignType: $(signType)
+
+  - ${{ if eq(parameters.isOfficial, true) }}:
+    - script: gulp signVsix
+      condition: succeeded()
+      displayName: 'Sign VSIXs'
+      env:
+        SignType: $(signType)
 
   - ${{ if eq(parameters.isOfficial, true) }}:
     - task: 1ES.PublishBuildArtifacts@1
@@ -41,6 +66,12 @@ jobs:
       inputs:
         PathtoPublish: '$(Build.SourcesDirectory)/vsix'
         ArtifactName: 'VSIX_$(channel)'
+    - task: 1ES.PublishBuildArtifacts@1
+      condition: succeeded()
+      displayName: 'Publish Signing Logs'
+      inputs:
+        PathtoPublish: '$(Build.SourcesDirectory)/out/logs'
+        ArtifactName: '${{ parameters.platform }} Signing Logs'
   - ${{ else }}:
     - task: PublishBuildArtifacts@1
       condition: succeeded()

azure-pipelines/build.yml

@@ -99,6 +99,10 @@ extends:
                     $basePublishArgs += '--azure-credential'
                     $basePublishArgs += '--packagePath'
                     $publishArgs = $basePublishArgs + (Get-ChildItem $publishArtifacts\*.vsix | Sort-Object Name -Descending |% { $_ })
+                    $publishArgs += '--manifestPath'
+                    $publishArgs += (Get-ChildItem $publishArtifacts\*.manifest | Sort-Object Name -Descending |% { $_ })
+                    $publishArgs += '--signaturePath'
+                    $publishArgs += (Get-ChildItem $publishArtifacts\*.signature.p7s | Sort-Object Name -Descending |% { $_ })
 
                     If ("${{ parameters.test }}" -eq "true") {
                       Write-Host "In test mode, command is printed instead of run."

azure-pipelines/release.yml

@@ -0,0 +1,5 @@
+{
+    "msbuild-sdks": {
+      "Microsoft.Build.NoTargets": "3.7.0"
+    }
+}