[release/v7.4.16] Fix executable permissions for pwsh and createdump; Move ESRP key codes into the certificate_logical_to_actual variable group#27442
Closed
adityapatwardhan wants to merge 2 commits into
Conversation
The tarball staging path used `Copy-Item`, which on *nix doesn't preserve the source file mode, so `pwsh` ended up 644 in the `.tar.gz`. The Debian, RPM, and macOS PKG paths explicitly `chmod` everything to 644 and then bump `pwsh` back to 755, which silently demoted `createdump` (the .NET helper that produces crash minidumps) along with it. Now we `chmod 755` both executables in all package staging paths, guarded by `Test-Path` since fxdependent builds don't bundle `createdump`. Also added regression tests which check the permissions of `pwsh` inside the Linux and macOS tarballs before we upload them. Co-authored-by: Copilot <[email protected]>
… group The `CP-…` key codes used for ESRP signing are now set from ADO via the `certificate_logical_to_actual` variable group. The templates reference the following variables instead of literal codes: - `$(authenticode_cert_id)` - `$(authenticode_test_cert_id)` - `$(nuget_cert_id)` - `$(apple_cert_id)` - `$(pgp_linux_cert_id)` - `$(pgp_release_cert_id)` `nupkg.yml`, `mac-package-build.yml`, and `linux-package-build.yml` pick up the new group import. `linux-package-build.yml` also now selects the PGP signing profile based on whether `jobName` starts with `mariner`, so `PowerShell-Packages-Stages.yml` no longer threads a `signingProfile` parameter in for the two Mariner jobs. Co-authored-by: Copilot <[email protected]>
adityapatwardhan
added
the
CL-BuildPackaging
Contributor
There was a problem hiding this comment.
Pull request overview
Backport of #27354 to release/v7.4.16. Restores executable permissions on pwsh/createdump in the tarball, deb, and rpm packaging paths (with regression tests in the macOS/Linux build pipelines), and migrates hard-coded ESRP CP-* cert codes to variables sourced from the certificate_logical_to_actual variable group.
Changes:
- Add
chmod 755forpwshandcreatedumpin the tarball staging, deb postbuild, and rpm packaging code paths. - Replace hard-coded ESRP
CP-*codes with$(nuget_cert_id),$(authenticode_cert_id),$(authenticode_test_cert_id),$(apple_cert_id), and$(pgp_*_cert_id)variables; include thecertificate_logical_to_actualgroup where needed. - Add tarball verification (
tar -tzvf … pwsh) inlinux-package-build.ymlandmac-package-build.yml, plus an Apple Mach-O signing step inmac.yml.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/packaging/packaging.psm1 | Ensure pwsh/createdump are executable for tarball, deb, and rpm packages |
| .pipelines/templates/windows-hosted-build.yml | Use $(nuget_cert_id) instead of hard-coded CP-401405 |
| .pipelines/templates/stages/PowerShell-Packages-Stages.yml | Drop obsolete signingProfile parameters for Mariner builds |
| .pipelines/templates/shouldSign.yml | Use authenticode cert id variables instead of CP-230012/CP-460906 |
| .pipelines/templates/nupkg.yml | Add cert variable group and use $(nuget_cert_id) for nupkg signing |
| .pipelines/templates/mac.yml | Add Apple Mach-O signing step — contains unresolved merge conflict |
| .pipelines/templates/mac-package-build.yml | Use $(apple_cert_id) and verify tarball perms — contains unresolved merge conflict |
| .pipelines/templates/linux-package-build.yml | Select PGP signing profile by job name; verify pwsh executable in tar.gz |
Comment on lines
+179
to
+189
| } | ||
| } | ||
| ] | ||
|
|
||
| - pwsh: | | ||
| $signedDir = "$(ob_outputDirectory)/Signed-$(Runtime)" | ||
| $zipFile = "$(Pipeline.Workspace)/macho-$(BuildArchitecture).zip" | ||
| Expand-Archive -Path $zipFile -DestinationPath $signedDir -Force -Verbose | ||
| displayName: Expand Apple-signed Mach-O binaries into signed output | ||
|
|
||
| >>>>>>> 6bffb1bb5 (Move ESRP key codes into the `certificate_logical_to_actual` variable group) |
Comment on lines
222
to
+258
| @@ -227,6 +235,27 @@ jobs: | |||
| } | |||
| ] | |||
|
|
|||
| - task: onebranch.pipeline.signing@1 | |||
| displayName: 'OneBranch Notarize Package' | |||
| inputs: | |||
| command: 'sign' | |||
| files_to_sign: '**/*-osx-*.zip' | |||
| search_root: '$(Pipeline.Workspace)' | |||
| inline_operation: | | |||
| [ | |||
| { | |||
| "KeyCode": "$(apple_cert_id)", | |||
| "OperationCode": "MacAppNotarize", | |||
| "ToolName": "sign", | |||
| "ToolVersion": "1.0", | |||
| "Parameters": { | |||
| "BundleId": "$(BundleId)" | |||
| } | |||
| } | |||
| ] | |||
| timeoutInMinutes: 120 | |||
|
|
|||
| >>>>>>> 6bffb1bb5 (Move ESRP key codes into the `certificate_logical_to_actual` variable group) | |||
Member
Author
|
this should be backported. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #27354 to release/v7.4.16
Triggered by @adityapatwardhan on behalf of @andyleejordan
Original CL Label: CL-BuildPackaging
/cc @PowerShell/powershell-maintainers
Impact
REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.
Tooling Impact
Updates build and packaging scripts to use new ESRP key variables and correct file permissions for release artifacts.
Customer Impact
Fixes build and signing pipeline issues for macOS and Linux packages, ensuring correct ESRP key usage and executable permissions. Addresses internal build failures and improves release reliability.
Regression
REQUIRED: Check exactly one box.
This is not a regression.
Testing
Validated by running full build and packaging pipelines for macOS and Linux. Regression tests added for permissions. All artifacts verified for correct signing and permissions.
Risk
REQUIRED: Check exactly one box.
Changes are limited to build and packaging scripts, with no impact on product runtime. Verified by internal build/test pipelines.