dotnet · mmitche · Mar 25, 2024 · Mar 25, 2024
diff --git a/azure-pipelines-PR.yml b/azure-pipelines-PR.yml
@@ -20,6 +20,15 @@ variables:
   # Skip Running CI tests
   - name: SkipTests
     value: false
+  # Set Official Build Id
+  - name: OfficialBuildId
+    value: $(Build.BuildNumber)
+  - ${{ if or(startswith(variables['Build.SourceBranch'], 'refs/heads/release/'), startswith(variables['Build.SourceBranch'], 'refs/heads/internal/release/'), eq(variables['Build.Reason'], 'Manual')) }}:
+    - name: PostBuildSign
+      value: false
+  - ${{ else }}:
+    - name: PostBuildSign
+      value: true
 
   # Set the target blob feed for package publish during official and validation builds.
   - name: _DotNetArtifactsCategory
@@ -39,19 +48,16 @@ stages:
   - template: /eng/pipelines/jobs/windows-build-PR.yml
     parameters:
       name: win_x64
-      displayName: win-x64
       targetArchitecture: x64
 
   # Windows x86
   - template: /eng/pipelines/jobs/windows-build-PR.yml
     parameters:
       name: win_x86
-      displayName: win-x86
       targetArchitecture: x86
 
   # Windows arm64
   - template: /eng/pipelines/jobs/windows-build-PR.yml
     parameters:
       name: win_arm64
-      displayName: win-arm64
       targetArchitecture: arm64
diff --git a/azure-pipelines.yml b/azure-pipelines.yml
@@ -14,7 +14,7 @@ variables:
   value: dotnet-core-acquisition
   # Skip Running CI tests
 - name: SkipTests
-  value: true
+  value: false
   # Set Official Build Id
 - name: OfficialBuildId
   value: $(Build.BuildNumber)
@@ -60,44 +60,50 @@ extends:
       - template: /eng/pipelines/jobs/windows-build.yml@self
         parameters:
           name: win_x64
-          displayName: win-x64
           targetArchitecture: x64
 
       # Windows x86
       - template: /eng/pipelines/jobs/windows-build.yml@self
         parameters:
           name: win_x86
-          displayName: win-x86
           targetArchitecture: x86
 
       # Windows arm64
       - template: /eng/pipelines/jobs/windows-build.yml@self
         parameters:
           name: win_arm64
-          displayName: win-arm64
           targetArchitecture: arm64
 
+    - stage: PrepareForPublish
+      displayName: Prepare for Publish
+      dependsOn: Build
+      jobs:
+      # Prep artifacts: sign them and upload pipeline artifacts expected by stages-based publishing.
+      - template: /eng/pipelines/jobs/prepare-signed-artifacts.yml@self
+        parameters:
+          PublishRidAgnosticPackagesFromJobName: win_x64
       # Publish to Build Asset Registry in order to generate the ReleaseConfigs artifact.
       - template: /eng/common/templates-official/job/publish-build-assets.yml@self
         parameters:
           publishUsingPipelines: true
           publishAssetsImmediately: true
-          dependsOn:
-            - win_x64
-            - win_x86
-            - win_arm64
+          dependsOn: PrepareSignedArtifacts
           pool:
             name: NetCore1ESPool-Internal
             demands: ImageOverride -equals windows.vs2022preview.amd64
 
     # Stages-based publishing entry point
     - template: /eng/common/templates-official/post-build/post-build.yml@self
       parameters:
+        publishingInfraVersion: 3
+        validateDependsOn:
+        - PrepareForPublish
         enableSymbolValidation: false
         enableSigningValidation: false
         enableNugetValidation: false
         enableSourceLinkValidation: false
         publishAssetsImmediately: true
+
         SDLValidationParameters:
           enable: false
           params: >-

diff --git a/build.cmd b/build.cmd
@@ -1,2 +1,2 @@
 @echo off
-powershell -ExecutionPolicy ByPass -NoProfile -command "& """%~dp0eng\common\Build.ps1""" -restore -build %*"
+powershell -ExecutionPolicy ByPass -NoProfile -command "& """%~dp0eng\common\Build.ps1""" -restore -build -bl %*"
diff --git a/eng/AfterSigning.targets b/eng/AfterSigning.targets
diff --git a/eng/Publishing.props b/eng/Publishing.props
@@ -2,44 +2,20 @@
 
   <PropertyGroup>
     <ProducesDotNetReleaseShippingAssets>true</ProducesDotNetReleaseShippingAssets>
-    <!-- Don't push rid agnostic nuget packages from other builds than win-x64 when not building inside the VMR. -->
-    <EnableDefaultPublishItems Condition="'$(DotNetBuildRepo)' != 'true' and
-                                          '$(TargetArchitecture)' != 'x64' and
-                                          '$(TargetArchitecture)' != ''">false</EnableDefaultPublishItems>
-    <!-- This avoids creating VS.*.symbols.nupkg packages that are identical to the original package. -->
-    <AutoGenerateSymbolPackages>false</AutoGenerateSymbolPackages>
   </PropertyGroup>
 
-  <Target Name="SetPackageToInclude"
+  <!-- Include installer archives and packages which aren't globbed by default. -->
+  <Target Name="PublishWindowsDesktopInstallers"
           BeforeTargets="BeforePublish"
-          Condition="'$(EnableDefaultPublishItems)' != 'true'">
-    <ItemGroup>
-      <!-- Only include RID specific packages -->
-      <PackageToInclude Include="Microsoft.WindowsDesktop.App.Runtime" />
-      <PackageToInclude Include="VS.Redist.Common.WindowsDesktop" />
-
-      <ExistingSymbolPackages Include="$(ArtifactsShippingPackagesDir)**/%(PackageToInclude.Identity)*.symbols.nupkg" IsShipping="true" />
-      <ExistingSymbolPackages Include="$(ArtifactsNonShippingPackagesDir)**/%(PackageToInclude.Identity)*.symbols.nupkg" IsShipping="false" />
-
-      <PackagesToPublish Include="$(ArtifactsShippingPackagesDir)**/%(PackageToInclude.Identity)*.nupkg" IsShipping="true" />
-      <PackagesToPublish Include="$(ArtifactsNonShippingPackagesDir)**/%(PackageToInclude.Identity)*.nupkg" IsShipping="false" />
-    </ItemGroup>
-  </Target>
-
-  <!-- Retrieve the runtime pack product version.
-       Don't stabilize the package version in order to retrieve the VersionSuffix. -->
-  <Target Name="GetProductVersion">
+          Condition="'$(DotNetBuildRepo)' == 'true'">
+    <!-- Retrieve windows desktop runtime pack product version.
+         Don't stabilize the package version in order to retrieve the VersionSuffix. -->
     <MSBuild Projects="$(RepoRoot)src/windowsdesktop/src/sfx/Microsoft.WindowsDesktop.App.Runtime.sfxproj"
              Targets="ReturnProductVersion"
              Properties="IsShipping=false">
-      <Output TaskParameter="TargetOutputs" PropertyName="RuntimePackProductVersion" />
+      <Output TaskParameter="TargetOutputs" PropertyName="WindowsDesktopRuntimePackProductVersion" />
     </MSBuild>
-  </Target>
 
-  <!-- Include installer archives and packages which aren't globbed by default. -->
-  <Target Name="PublishInstallers"
-          DependsOnTargets="GetProductVersion"
-          BeforeTargets="PublishToAzureDevOpsArtifacts">
     <ItemGroup>
       <InstallerToPublish Include="$(ArtifactsPackagesDir)**\*.zip;
                                    $(ArtifactsPackagesDir)**\*.exe;
@@ -48,36 +24,7 @@
       <ItemsToPushToBlobFeed Include="@(InstallerToPublish)"
                              IsShipping="$([System.String]::Copy('%(RecursiveDir)').StartsWith('Shipping'))"
                              PublishFlatContainer="true"
-                             RelativeBlobPath="WindowsDesktop/$(RuntimePackProductVersion)/%(Filename)%(Extension)" />
-
-      <!-- Include checksums -->
-      <ChecksumToPublish Include="$(ArtifactsPackagesDir)**\*.sha512" />
-      <ItemsToPushToBlobFeed Include="@(ChecksumToPublish)"
-                             IsShipping="false"
-                             PublishFlatContainer="true"
-                             RelativeBlobPath="WindowsDesktop/$(RuntimePackProductVersion)/%(Filename)%(Extension)" />
-    </ItemGroup>
-  </Target>
-
-  <Target Name="GenerateAndPublishProductVersionFiles"
-          DependsOnTargets="GetProductVersion"
-          BeforeTargets="PublishToAzureDevOpsArtifacts">
-    <ItemGroup>
-      <ProductVersionFile Include="$(ArtifactsShippingPackagesDir)productVersion.txt" />
-      <ProductVersionFile Include="$(ArtifactsShippingPackagesDir)windowsdesktop-productVersion.txt" />
-    </ItemGroup>
-
-    <!-- Generate productVersion.txt file containing the product version. -->
-    <WriteLinesToFile File="%(ProductVersionFile.Identity)"
-                      Lines="$(RuntimePackProductVersion)"
-                      Overwrite="true"
-                      Encoding="ASCII" />
-
-    <ItemGroup>
-      <ItemsToPushToBlobFeed Include="@(ProductVersionFile)"
-                             IsShipping="false"
-                             PublishFlatContainer="true"
-                             RelativeBlobPath="WindowsDesktop/$(RuntimePackProductVersion)/%(Filename)%(Extension)" />
+                             RelativeBlobPath="WindowsDesktop/$(WindowsDesktopRuntimePackProductVersion)/%(Filename)%(Extension)" />
     </ItemGroup>
   </Target>
 

diff --git a/eng/Signing.props b/eng/Signing.props
@@ -1,11 +1,40 @@
 <Project>
 
   <PropertyGroup>
+    <!--
+      Windows arm/arm64 jobs don't have MSIs to sign. Keep it simple: allow not finding any matches
+      here and rely on overall signing validation.
+    -->
+    <AllowEmptySignList Condition="'$(SignFinalPackages)' != 'true'">true</AllowEmptySignList>
     <UseDotNetCertificate>true</UseDotNetCertificate>
   </PropertyGroup>
 
   <ItemGroup>
+    <!--
+      Replace the default items to sign with the specific set we want.
+    -->
+    <ItemsToSign Remove="@(ItemsToSign)" />
+    <ItemsToSignPostBuild Remove="@(ItemsToSignPostBuild)" />
+
+    <!-- apphost and comhost template files are not signed, by design. -->
+    <FileSignInfo Include="apphost.exe;comhost.dll" CertificateName="None" />
+
     <FileExtensionSignInfo Include=".msi" CertificateName="MicrosoftDotNet500" />
+    <FileExtensionSignInfo Include=".pkg" CertificateName="8003" />
+    <FileExtensionSignInfo Include=".deb;.rpm" CertificateName="LinuxSign" />
+  </ItemGroup>
+
+  <!-- This repo signs everything, including installers, either right before doing the PushToAzureDevOpsArtifacts,
+       or in post-build. Populate what will get signed the same in both cases -->
+  <ItemGroup Condition="'$(PrepareArtifacts)' == 'true'">
+    <ItemsToSignWithPaths Include="$(DownloadDirectory)**/*.msi" />
+    <ItemsToSignWithPaths Include="$(DownloadDirectory)**/*.exe" />
+    <ItemsToSignWithPaths Include="$(DownloadDirectory)**/*.nupkg" />
+    <ItemsToSignWithPaths Include="$(DownloadDirectory)**/*.zip" />
+
+    <ItemsToSignWithoutPaths Include="@(ItemsToSignWithPaths->'%(Filename)%(Extension)')" />
+    <ItemsToSignPostBuild Include="@(ItemsToSignWithoutPaths->Distinct())" Condition="'$(PostBuildSign)' == 'true'" />
+    <ItemsToSign Include="@(ItemsToSignWithPaths->Distinct())" Condition="'$(PostBuildSign)' != 'true'" />
   </ItemGroup>
 
 </Project>
diff --git a/eng/Versions.props b/eng/Versions.props
@@ -11,8 +11,10 @@
   </PropertyGroup>
   <PropertyGroup>
     <!-- arcade -->
+    <MicrosoftDotNetBuildTasksFeedVersion>9.0.0-beta.24168.1</MicrosoftDotNetBuildTasksFeedVersion>
     <MicrosoftDotNetBuildTasksArchivesVersion>9.0.0-beta.24168.1</MicrosoftDotNetBuildTasksArchivesVersion>
     <MicrosoftDotNetBuildTasksInstallersVersion>9.0.0-beta.24168.1</MicrosoftDotNetBuildTasksInstallersVersion>
+    <MicrosoftDotNetVersionToolsTasksVersion>9.0.0-beta.24168.1</MicrosoftDotNetVersionToolsTasksVersion>
     <!-- corefx -->
     <SystemDataDataSetExtensionsVersion>4.5.0</SystemDataDataSetExtensionsVersion>
     <SystemDataSqlClientVersion>4.8.6</SystemDataSqlClientVersion>

diff --git a/eng/pipelines/jobs/prepare-signed-artifacts-PR.yml b/eng/pipelines/jobs/prepare-signed-artifacts-PR.yml
@@ -0,0 +1,50 @@
+parameters:
+  dependsOn: []
+  PublishRidAgnosticPackagesFromJobName: ''
+
+jobs:
+- job: PrepareSignedArtifacts
+  displayName: Prepare Signed Artifacts
+  dependsOn: ${{ parameters.dependsOn }}
+  pool:
+    name: NetCore1ESPool-Svc-Internal
+    demands: ImageOverride -equals windows.vs2019.amd64
+  # Double the default timeout.
+  timeoutInMinutes: 120
+  workspace:
+    clean: all
+
+  steps:
+  - task: DownloadBuildArtifacts@0
+    displayName: Download IntermediateUnsignedArtifacts
+    inputs:
+      artifactName: IntermediateUnsignedArtifacts
+      downloadPath: $(Build.SourcesDirectory)\artifacts\PackageDownload
+
+  - script: >
+      build.cmd -ci
+      -projects $(Build.SourcesDirectory)\src\publish\prepare-artifacts.proj
+      -c Release
+      /p:PublishRidAgnosticPackagesFromJobName=${{ parameters.PublishRidAgnosticPackagesFromJobName }}
+      /p:SignType=$(SignType)
+      /p:DotNetSignType=$(SignType)
+      /bl:$(Build.SourcesDirectory)\prepare-artifacts.binlog
+    displayName: Prepare artifacts and upload to build
+
+  - task: CopyFiles@2
+    displayName: Copy Files to $(Build.StagingDirectory)\BuildLogs
+    inputs:
+      SourceFolder: '$(Build.SourcesDirectory)'
+      Contents: |
+        **/*.log
+        **/*.binlog
+      TargetFolder: '$(Build.StagingDirectory)\BuildLogs'
+    continueOnError: true
+    condition: succeededOrFailed()
+
+  - task: PublishBuildArtifacts@1
+    displayName: Publish Artifact BuildLogs
+    inputs:
+      PathtoPublish: '$(Build.StagingDirectory)\BuildLogs'
+      ArtifactName: Logs-PrepareSignedArtifacts
+    condition: succeededOrFailed()
diff --git a/eng/pipelines/jobs/prepare-signed-artifacts.yml b/eng/pipelines/jobs/prepare-signed-artifacts.yml
@@ -0,0 +1,55 @@
+parameters:
+  dependsOn: []
+  PublishRidAgnosticPackagesFromJobName: ''
+
+jobs:
+- job: PrepareSignedArtifacts
+  displayName: Prepare Signed Artifacts
+  dependsOn: ${{ parameters.dependsOn }}
+  # Double the default timeout.
+  timeoutInMinutes: 120
+  workspace:
+    clean: all
+
+  templateContext:
+    outputs:
+    - output: pipelineArtifact
+      displayName: 'Publish Artifact BuildLogs'
+      condition: succeededOrFailed()
+      targetPath: '$(Build.StagingDirectory)\BuildLogs'
+      artifactName: Logs-PrepareSignedArtifacts
+  steps:
+  - task: NuGetAuthenticate@1
+  - task: MicroBuildSigningPlugin@2
+    displayName: Install MicroBuild plugin for Signing
+    inputs:
+      signType: $(SignType)
+      zipSources: false
+      feedSource: https://dnceng.pkgs.visualstudio.com/_packaging/MicroBuildToolset/nuget/v3/index.json
+    condition: and(succeeded(), in(variables['SignType'], 'real', 'test'))
+  - task: DownloadBuildArtifacts@0
+    displayName: Download IntermediateUnsignedArtifacts
+    inputs:
+      artifactName: IntermediateUnsignedArtifacts
+      downloadPath: $(Build.SourcesDirectory)\artifacts\PackageDownload
+
+  - script: >
+      build.cmd -ci
+      -projects $(Build.SourcesDirectory)\src\publish\prepare-artifacts.proj
+      -c Release
+      /p:PublishRidAgnosticPackagesFromJobName=${{ parameters.PublishRidAgnosticPackagesFromJobName }}
+      /p:SignType=$(SignType)
+      /p:DotNetSignType=$(SignType)
+      /bl:$(Build.SourcesDirectory)\prepare-artifacts.binlog
+    displayName: Prepare artifacts and upload to build
+
+  - task: CopyFiles@2
+    displayName: Copy Files to $(Build.StagingDirectory)\BuildLogs
+    inputs:
+      SourceFolder: '$(Build.SourcesDirectory)'
+      Contents: |
+        **/*.log
+        **/*.binlog
+      TargetFolder: '$(Build.StagingDirectory)\BuildLogs'
+    continueOnError: true
+    condition: succeededOrFailed()