Skip to content

ci: fix the Windows sign step on the Build Tools image #46462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dylan-conway merged 2 commits into from
Oct 22, 2026
Merged

ci: fix the Windows sign step on the Build Tools image #46462

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d7e002b
ci: run the Windows sign step through vs-shell.ps1 under pwsh [sign w…
dylan-conway Oct 22, 2026
350558b
ci: check for signtool.exe before the sign script does anything else …
dylan-conway Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .buildkite/ci.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1062,8 +1062,9 @@ function getWindowsSignStep(windowsPlatforms: Platform[], options: PipelineOptio
}),
retry: getRetry(),
cancel_on_build_failing: isMergeQueue(),
// smctl runs signtool.exe, which is only in PATH in a Visual Studio environment.
command: [
`powershell -NoProfile -ExecutionPolicy Bypass -File .buildkite/scripts/sign-windows-artifacts.ps1 ` +
`pwsh -NoProfile -File .\\scripts\\vs-shell.ps1 pwsh -NoProfile -File .\\.buildkite\\scripts\\sign-windows-artifacts.ps1 ` +
`-Artifacts ${artifacts.join(",")} ` +
`-BuildSteps ${buildSteps.join(",")}`,
],
Expand Down
11 changes: 6 additions & 5 deletions .buildkite/scripts/sign-windows-artifacts.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
# with the same name so downstream steps (release, tests) see signed binaries.

param(
# Comma-separated list. powershell.exe -File passes everything as
# Comma-separated list. pwsh -File passes everything as
# literal strings, so [string[]] with "a,b,c" becomes a 1-element array.
[Parameter(Mandatory=$true)]
[string]$Artifacts,
Expand All @@ -25,10 +25,6 @@ $ProgressPreference = "SilentlyContinue"
$ArtifactList = $Artifacts -split ","
$BuildStepList = $BuildSteps -split ","

# smctl shells out to signtool.exe which is only in PATH when the VS dev
# environment is loaded. Dot-source the existing helper to set it up.
. $PSScriptRoot\..\..\scripts\vs-shell.ps1

function Log-Info {
param([string]$Message)
Write-Host "[INFO] $Message" -ForegroundColor Cyan
Expand Down Expand Up @@ -262,6 +258,11 @@ try {
}
Log-Info "Will sign $($ArtifactList.Count) artifacts: $($ArtifactList -join ', ')"

# smctl runs signtool.exe and exits 0 when it cannot.
if (!(Get-Command signtool.exe -ErrorAction SilentlyContinue)) {
throw "signtool.exe is not in PATH. Run this script through scripts/vs-shell.ps1."
}

Ensure-Secrets
Setup-Certificate
$smctl = Install-KeyLocker
Expand Down
5 changes: 5 additions & 0 deletions scripts/vs-shell.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,11 @@ if($env:VSINSTALLDIR -eq $null) {
} finally {
Pop-Location
}

# Launch-VsDevShell.ps1 only prints a message when it fails.
if ($env:VSINSTALLDIR -eq $null) {
throw "Launch-VsDevShell.ps1 did not load the Visual Studio environment."
}
}

if($env:VSCMD_ARG_TGT_ARCH -eq "x86") {
Expand Down
Loading