Skip to content

Commit f64d715

Browse files
BillyONealBillyONeal
authored
Move signed builds into "Production Management Environment" from Microsoft Corp. (#1693)
1 parent 0f773e6 commit f64d715

File tree

2 files changed

+36
-78
lines changed

2 files changed

+36
-78
lines changed

‎azure-pipelines/signing.yml

Lines changed: 35 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -5,40 +5,14 @@
55
trigger: none
66

77
parameters:
8-
- name: SignTypeOverride
9-
displayName: Signing Type (default is real for the main branch and test otherwise)
10-
type: string
11-
default: default
12-
values:
13-
- default
14-
- test
15-
- real
168
- name: VcpkgBaseVersionOverride
179
displayName: vcpkg Base Version (default is today's date in ISO 8601)
1810
type: string
1911
default: default
20-
- name: PublishTo
21-
displayName: 'Publish To'
22-
type: string
23-
default: 'GitHub and NuGet'
24-
values:
25-
- 'GitHub and NuGet'
26-
- 'NuGet Only'
27-
- 'None'
2812
variables:
2913
- group: vcpkg Terrapin URLs
3014
- name: TeamName
3115
value: vcpkg
32-
# If the user didn't override the signing type, then only real-sign on main.
33-
- ${{ if ne(parameters.SignTypeOverride, 'default') }}:
34-
- name: SignType
35-
value: ${{ parameters.SignTypeOverride }}
36-
- ${{ if and(eq(parameters.SignTypeOverride, 'default'), or(eq(variables['Build.SourceBranchName'], 'main'), startsWith(variables['Build.SourceBranch'], 'refs/tags'))) }}:
37-
- name: SignType
38-
value: real
39-
- ${{ if and(eq(parameters.SignTypeOverride, 'default'), not(or(eq(variables['Build.SourceBranchName'], 'main'), startsWith(variables['Build.SourceBranch'], 'refs/tags')))) }}:
40-
- name: SignType
41-
value: test
4216
resources:
4317
repositories:
4418
- repository: MicroBuildTemplate
@@ -81,7 +55,8 @@ extends:
8155
signing:
8256
enabled: true
8357
feedSource: 'https://devdiv.pkgs.visualstudio.com/DefaultCollection/_packaging/MicroBuildToolset/nuget/v3/index.json'
84-
signType: $(SignType)
58+
signType: 'real'
59+
signWithProd: true
8560
zipSources: false
8661
outputs:
8762
- output: pipelineArtifact
@@ -238,7 +213,7 @@ extends:
238213
dependsOn:
239214
- arch_independent
240215
pool:
241-
name: 'vcpkg-mariner-1espt'
216+
name: 'vcpkg-pme-mariner-2-amd64-1espt-pool'
242217
os: linux
243218
variables:
244219
VCPKG_STANDALONE_BUNDLE_SHA: $[ dependencies.arch_independent.outputs['shas.VCPKG_STANDALONE_BUNDLE_SHA'] ]
@@ -258,22 +233,21 @@ extends:
258233
publishLocation: 'Container'
259234
targetPath: '$(Build.ArtifactStagingDirectory)'
260235
steps:
261-
- bash: |
262-
az login --identity --username 29a4d3e7-c7d5-41c7-b5a0-fee8cf466371
263-
az acr login --name vcpkgdockercontainers
264-
displayName: 'Set up managed identity'
265-
- task: CmdLine@2
236+
- task: AzureCLI@2
266237
displayName: "Build vcpkg in Mariner with Ubuntu 16.04 Libraries"
267238
inputs:
268-
failOnStderr: false
269-
script: |
239+
azureSubscription: 'vcpkg-pme-official-builders'
240+
scriptType: bash
241+
scriptLocation: 'inlineScript'
242+
inlineScript: |
243+
az acr login --name vcpkgpmeofficialbuilders --resource-group vcpkg-tool-official-builds --subscription c0f11a1f-38f5-4908-8698-1aa5df75baf3
270244
mkdir -p "$(Agent.TempDirectory)/build"
271-
docker run --rm --mount "type=bind,source=$(Build.Repository.LocalPath),target=/source,readonly" --mount "type=bind,source=$(Agent.TempDirectory)/build,target=/build" vcpkgdockercontainers.azurecr.io/vcpkg/vcpkg-linux:2024-03-21 sh -c "cmake -G Ninja -DCMAKE_TOOLCHAIN_FILE=/source/azure-pipelines/vcpkg-linux/toolchain.cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF -DVCPKG_DEVELOPMENT_WARNINGS=ON -DVCPKG_WARNINGS_AS_ERRORS=ON -DVCPKG_BUILD_FUZZING=OFF -DVCPKG_EMBED_GIT_SHA=ON -DVCPKG_OFFICIAL_BUILD=ON -DVCPKG_CMAKERC_URL=$(cmakerc-tarball-url) -DVCPKG_FMT_URL=$(fmt-tarball-url) -DVCPKG_STANDALONE_BUNDLE_SHA=$(VCPKG_STANDALONE_BUNDLE_SHA) -DVCPKG_BASE_VERSION=$(VCPKG_BASE_VERSION) -DVCPKG_VERSION=$(Build.SourceVersion) -S /source -B /build 2>&1 && ninja -C /build"
245+
docker run --rm --mount "type=bind,source=$(Build.Repository.LocalPath),target=/source,readonly" --mount "type=bind,source=$(Agent.TempDirectory)/build,target=/build" vcpkgpmeofficialbuilders-c7ajd0chdtfugffn.azurecr.io/vcpkg/vcpkg-build-linux-amd64:2024-03-21 sh -c "cmake -G Ninja -DCMAKE_TOOLCHAIN_FILE=/source/azure-pipelines/vcpkg-linux/toolchain.cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF -DVCPKG_DEVELOPMENT_WARNINGS=ON -DVCPKG_WARNINGS_AS_ERRORS=ON -DVCPKG_BUILD_FUZZING=OFF -DVCPKG_EMBED_GIT_SHA=ON -DVCPKG_OFFICIAL_BUILD=ON -DVCPKG_CMAKERC_URL=$(cmakerc-tarball-url) -DVCPKG_FMT_URL=$(fmt-tarball-url) -DVCPKG_STANDALONE_BUNDLE_SHA=$(VCPKG_STANDALONE_BUNDLE_SHA) -DVCPKG_BASE_VERSION=$(VCPKG_BASE_VERSION) -DVCPKG_VERSION=$(Build.SourceVersion) -S /source -B /build 2>&1 && ninja -C /build"
272246
mv "$(Agent.TempDirectory)/build/vcpkg" "$(Build.ArtifactStagingDirectory)/vcpkg-glibc"
273247
- job: muslc_build
274248
displayName: 'muslc (Alpine) Build'
275249
pool:
276-
name: 'vcpkg-mariner-1espt'
250+
name: 'vcpkg-pme-mariner-2-amd64-1espt-pool'
277251
os: linux
278252
dependsOn:
279253
- arch_independent
@@ -295,24 +269,23 @@ extends:
295269
publishLocation: 'Container'
296270
targetPath: '$(Build.ArtifactStagingDirectory)'
297271
steps:
298-
- bash: |
299-
az login --identity --username 29a4d3e7-c7d5-41c7-b5a0-fee8cf466371
300-
az acr login --name vcpkgdockercontainers
301-
displayName: 'Set up managed identity'
302-
- task: CmdLine@2
272+
- task: AzureCLI@2
303273
displayName: "Build vcpkg in Alpine"
304274
inputs:
305-
failOnStderr: false
306-
script: |
275+
azureSubscription: 'vcpkg-pme-official-builders'
276+
scriptType: bash
277+
scriptLocation: 'inlineScript'
278+
inlineScript: |
279+
az acr login --name vcpkgpmeofficialbuilders --resource-group vcpkg-tool-official-builds --subscription c0f11a1f-38f5-4908-8698-1aa5df75baf3
307280
mkdir -p "$(Agent.TempDirectory)/build"
308-
docker run --rm --mount "type=bind,source=$(Build.Repository.LocalPath),target=/source,readonly" --mount "type=bind,source=$(Agent.TempDirectory)/build,target=/build" vcpkgdockercontainers.azurecr.io/vcpkg/vcpkg-alpine:3.16 sh -c "cmake -G Ninja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF -DVCPKG_DEVELOPMENT_WARNINGS=ON -DVCPKG_WARNINGS_AS_ERRORS=ON -DVCPKG_BUILD_FUZZING=OFF -DVCPKG_EMBED_GIT_SHA=ON -DVCPKG_OFFICIAL_BUILD=ON -DCMAKE_CXX_FLAGS=\"-static -s -static-libgcc -static-libstdc++\" -DVCPKG_CMAKERC_URL=$(cmakerc-tarball-url) -DVCPKG_FMT_URL=$(fmt-tarball-url) -DVCPKG_STANDALONE_BUNDLE_SHA=$(VCPKG_STANDALONE_BUNDLE_SHA) -DVCPKG_BASE_VERSION=$(VCPKG_BASE_VERSION) -DVCPKG_VERSION=$(Build.SourceVersion) -S /source -B /build 2>&1 && ninja -C /build"
281+
docker run --rm --mount "type=bind,source=$(Build.Repository.LocalPath),target=/source,readonly" --mount "type=bind,source=$(Agent.TempDirectory)/build,target=/build" vcpkgpmeofficialbuilders-c7ajd0chdtfugffn.azurecr.io/vcpkg/vcpkg-build-alpine:3.16 sh -c "cmake -G Ninja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF -DVCPKG_DEVELOPMENT_WARNINGS=ON -DVCPKG_WARNINGS_AS_ERRORS=ON -DVCPKG_BUILD_FUZZING=OFF -DVCPKG_EMBED_GIT_SHA=ON -DVCPKG_OFFICIAL_BUILD=ON -DCMAKE_CXX_FLAGS=\"-static -s -static-libgcc -static-libstdc++\" -DVCPKG_CMAKERC_URL=$(cmakerc-tarball-url) -DVCPKG_FMT_URL=$(fmt-tarball-url) -DVCPKG_STANDALONE_BUNDLE_SHA=$(VCPKG_STANDALONE_BUNDLE_SHA) -DVCPKG_BASE_VERSION=$(VCPKG_BASE_VERSION) -DVCPKG_VERSION=$(Build.SourceVersion) -S /source -B /build 2>&1 && ninja -C /build"
309282
mv "$(Agent.TempDirectory)/build/vcpkg" "$(Build.ArtifactStagingDirectory)/vcpkg-muslc"
310283
- job: glibc_arm64_build
311284
displayName: 'glibc Arm64 Build'
312285
dependsOn:
313286
- arch_independent
314287
pool:
315-
name: 'vcpkg-mariner-aarch64-1espt'
288+
name: 'vcpkg-pme-mariner-2-aarch64-1espt-pool'
316289
os: linux
317290
hostArchitecture: Arm64
318291
variables:
@@ -333,17 +306,16 @@ extends:
333306
publishLocation: 'Container'
334307
targetPath: '$(Build.ArtifactStagingDirectory)'
335308
steps:
336-
- bash: |
337-
az login --identity --username 29a4d3e7-c7d5-41c7-b5a0-fee8cf466371
338-
az acr login --name vcpkgdockercontainers
339-
displayName: 'Set up managed identity'
340-
- task: CmdLine@2
309+
- task: AzureCLI@2
341310
displayName: "Run Docker build for arm64 Linux binary"
342311
inputs:
343-
failOnStderr: false
344-
script: |
312+
azureSubscription: 'vcpkg-pme-official-builders'
313+
scriptType: bash
314+
scriptLocation: 'inlineScript'
315+
inlineScript: |
316+
az acr login --name vcpkgpmeofficialbuilders --resource-group vcpkg-tool-official-builds --subscription c0f11a1f-38f5-4908-8698-1aa5df75baf3
345317
mkdir -p "$(Agent.TempDirectory)/build"
346-
docker run --rm --mount "type=bind,source=$(Build.Repository.LocalPath),target=/source,readonly" --mount "type=bind,source=$(Agent.TempDirectory)/build,target=/build" vcpkgdockercontainers.azurecr.io/vcpkg/vcpkg-arm64-linux:2025-03-18 sh -c "cmake -G Ninja -DCMAKE_TOOLCHAIN_FILE=/source/azure-pipelines/vcpkg-arm64/toolchain.cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF -DVCPKG_DEVELOPMENT_WARNINGS=ON -DVCPKG_WARNINGS_AS_ERRORS=ON -DVCPKG_BUILD_FUZZING=OFF -DVCPKG_EMBED_GIT_SHA=ON -DVCPKG_OFFICIAL_BUILD=ON -DVCPKG_CMAKERC_URL=$(cmakerc-tarball-url) -DVCPKG_FMT_URL=$(fmt-tarball-url) -DVCPKG_STANDALONE_BUNDLE_SHA=$(VCPKG_STANDALONE_BUNDLE_SHA) -DVCPKG_BASE_VERSION=$(VCPKG_BASE_VERSION) -DVCPKG_VERSION=$(Build.SourceVersion) -S /source -B /build 2>&1 && ninja -C /build"
318+
docker run --rm --mount "type=bind,source=$(Build.Repository.LocalPath),target=/source,readonly" --mount "type=bind,source=$(Agent.TempDirectory)/build,target=/build" vcpkgpmeofficialbuilders-c7ajd0chdtfugffn.azurecr.io/vcpkg/vcpkg-build-linux-arm64:2025-03-18 sh -c "cmake -G Ninja -DCMAKE_TOOLCHAIN_FILE=/source/azure-pipelines/vcpkg-arm64/toolchain.cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF -DVCPKG_DEVELOPMENT_WARNINGS=ON -DVCPKG_WARNINGS_AS_ERRORS=ON -DVCPKG_BUILD_FUZZING=OFF -DVCPKG_EMBED_GIT_SHA=ON -DVCPKG_OFFICIAL_BUILD=ON -DVCPKG_CMAKERC_URL=$(cmakerc-tarball-url) -DVCPKG_FMT_URL=$(fmt-tarball-url) -DVCPKG_STANDALONE_BUNDLE_SHA=$(VCPKG_STANDALONE_BUNDLE_SHA) -DVCPKG_BASE_VERSION=$(VCPKG_BASE_VERSION) -DVCPKG_VERSION=$(Build.SourceVersion) -S /source -B /build 2>&1 && ninja -C /build"
347319
mv "$(Agent.TempDirectory)/build/vcpkg" "$(Build.ArtifactStagingDirectory)/vcpkg-glibc-arm64"
348320
- job: windows_and_sign
349321
displayName: 'Build Windows binaries and Sign'
@@ -369,7 +341,8 @@ extends:
369341
signing:
370342
enabled: true
371343
feedSource: 'https://devdiv.pkgs.visualstudio.com/DefaultCollection/_packaging/MicroBuildToolset/nuget/v3/index.json'
372-
signType: $(SignType)
344+
signType: 'real'
345+
signWithProd: true
373346
zipSources: false
374347
inputs:
375348
- input: pipelineArtifact
@@ -398,13 +371,11 @@ extends:
398371
targetPath: '$(Build.ArtifactStagingDirectory)/vs-insertion/drop'
399372
artifactName: 'vs-insertion'
400373
publishLocation: 'Container'
401-
condition: ${{ or(eq(parameters.PublishTo, 'GitHub and NuGet'),eq(parameters.PublishTo, 'NuGet Only')) }}
402374
- output: nuget
403375
displayName: 'NuGet publish for VS Insertion'
404376
packageParentPath: '$(Build.ArtifactStagingDirectory)'
405377
packagesToPush: '$(Build.ArtifactStagingDirectory)/vs-insertion/drop/VS.Redist.Vcpkg.amd64.1.0.0-$(VCPKG_FULL_VERSION).nupkg'
406378
publishVstsFeed: '97a41293-2972-4f48-8c0e-05493ae82010'
407-
condition: ${{ and(or(eq(parameters.PublishTo, 'GitHub and NuGet'),eq(parameters.PublishTo, 'NuGet Only')), eq(variables.SignType, 'real')) }}
408379
steps:
409380
- task: CmdLine@2
410381
displayName: "Build vcpkg amd64 with CMake"
@@ -449,25 +420,15 @@ extends:
449420
inputs:
450421
solution: 'azure-pipelines\binary-signing.signproj'
451422
msbuildArguments: '/p:OutDir=$(Build.BinariesDirectory)\ /p:IntermediateOutputPath=$(Build.BinariesDirectory)\'
452-
- task: MicroBuildSignMacFiles@1
453-
displayName: 'Developer Sign Mac Binaries'
454-
condition: and(eq(variables.SignType, 'test'), succeeded())
455-
inputs:
456-
SigningTarget: '$(Build.ArtifactStagingDirectory)\stagingMacOS\vcpkg-macos.zip'
457-
SigningCert: '8005'
458-
SigningPluginSource: 'https://devdiv.pkgs.visualstudio.com/DefaultCollection/_packaging/MicroBuildToolset/nuget/v3/index.json'
459-
SigningPluginVersion: 'latest'
460423
- task: MicroBuildSignMacFiles@1
461424
displayName: 'Sign and Harden Mac Binaries'
462-
condition: and(eq(variables.SignType, 'real'), succeeded())
463425
inputs:
464426
SigningTarget: '$(Build.ArtifactStagingDirectory)\stagingMacOS\vcpkg-macos.zip'
465427
SigningCert: '8025'
466428
SigningPluginSource: 'https://devdiv.pkgs.visualstudio.com/DefaultCollection/_packaging/MicroBuildToolset/nuget/v3/index.json'
467429
SigningPluginVersion: 'latest'
468430
- task: MicroBuildSignMacFiles@1
469431
displayName: 'Notarize Mac Binaries'
470-
condition: and(eq(variables.SignType, 'real'), succeeded())
471432
inputs:
472433
SigningTarget: '$(Build.ArtifactStagingDirectory)\stagingMacOS\vcpkg-macos.zip'
473434
SigningCert: '8020'
@@ -528,8 +489,7 @@ extends:
528489
copy "$(Build.ArtifactStagingDirectory)\drop\tls12-download-arm64.exe" "$(Build.ArtifactStagingDirectory)\symbols\tls12-download-arm64.exe"
529490
copy "$(Build.ArtifactStagingDirectory)\drop\tls12-download-arm64.pdb" "$(Build.ArtifactStagingDirectory)\symbols\tls12-download-arm64.pdb"
530491
- task: CmdLine@2
531-
displayName: 'Add Drop PGP Signatures (real sign only)'
532-
condition: and(eq(variables.SignType, 'real'), succeeded())
492+
displayName: 'Add Drop PGP Signatures'
533493
inputs:
534494
failOnStderr: true
535495
script: |
@@ -562,16 +522,14 @@ extends:
562522
targetType: 'F'
563523
targetArgument: '$(Build.ArtifactStagingDirectory)\drop'
564524
result: 'PoliCheck.xml'
565-
- ${{ if ne(parameters.PublishTo, 'None') }}:
566-
- task: MicroBuildArchiveSymbols@5
567-
displayName: 'Upload Symbols'
568-
inputs:
569-
SymbolsFeatureName: 'vcpkg'
570-
SymbolsProject: 'VS'
571-
SymbolsAgentPath: '$(Build.ArtifactStagingDirectory)\symbols'
525+
- task: MicroBuildArchiveSymbols@5
526+
displayName: 'Upload Symbols'
527+
inputs:
528+
SymbolsFeatureName: 'vcpkg'
529+
SymbolsProject: 'VS'
530+
SymbolsAgentPath: '$(Build.ArtifactStagingDirectory)\symbols'
572531
- job: github_release
573532
displayName: 'Publish GitHub Release'
574-
condition: and(succeeded(), eq(variables.SignType, 'real'), ${{ eq(parameters.PublishTo, 'GitHub and NuGet') }})
575533
dependsOn:
576534
- arch_independent
577535
- windows_and_sign

‎azure-pipelines/vcpkg-alpine/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
FROM vcpkgdockercontainers.azurecr.io/vcpkg/alpine:3.16
1+
FROM vcpkgpmeofficialbuilders-c7ajd0chdtfugffn.azurecr.io/vcpkg/alpine:3.16
22

33
RUN apk add alpine-sdk cmake ninja git curl tar gzip zip

0 commit comments

Comments
 (0)