Skip to content

Commit 1da18ed

Browse files
paulmedynskipaulmedynski
committed
Add assembly signing for Microsoft.SqlServer.Server
Introduce the shared signing-key download step and thread isInternalBuild through the CI core so the SqlServer package is strong-name signed on internal Package-mode builds. - Add eng/pipelines/common/steps/download-assembly-signing-key.yml, which exports driverKeyFile or testKeyFile from ADO secure files. - Adopt that step in the OneBranch build and nightly CI package pipelines, renaming keyFile to driverKeyFile. - Declare isInternalBuild in dotnet-sqlclient-ci-core.yml and set it from the CI package- and project-reference pipelines. - Sign the SqlServer package when isInternalBuild is true and referenceType is not Project.
1 parent 77af6f1 commit 1da18ed

9 files changed

Lines changed: 118 additions & 28 deletions

‎eng/pipelines/ci/package/sqlclient-ci-package-pipeline.yml‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ variables:
8181
value: ${{ eq(variables['System.TeamProject'], 'ADO.Net') }}
8282

8383
# Signing key argument passed to build.proj. On internal builds this references the secure file
84-
# downloaded by DownloadSecureFile@1; on public builds it expands to empty.
84+
# downloaded by download-assembly-signing-key.yml; on public builds it expands to empty.
8585
- name: signingKeyArg
8686
${{ if eq(variables.isInternalBuild, true) }}:
8787
value: -p:SigningKeyPath="$(driverKeyFile.secureFilePath)"
@@ -125,13 +125,9 @@ jobs:
125125
Write-Host 'Done.'
126126
displayName: Clean Packages Directory
127127
128-
# On internal builds, download the strong-name signing key.
128+
# On internal builds, download the assembly signing key.
129129
- ${{ if eq(variables.isInternalBuild, true) }}:
130-
- task: DownloadSecureFile@1
131-
displayName: Download Driver Signing Key
132-
inputs:
133-
secureFile: netfxKeypair.snk
134-
name: driverKeyFile
130+
- template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self
135131

136132
# Run the Pack target via build.proj.
137133
- task: DotNetCoreCLI@2

‎eng/pipelines/common/steps/download-assembly-signing-key.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
################################################################################
2+
# Licensed to the .NET Foundation under one or more agreements. The .NET
3+
# Foundation licenses this file to you under the MIT license. See the LICENSE
4+
# file in the project root for more information.
5+
################################################################################
6+
7+
# Downloads a signing key from ADO secure files.
8+
#
9+
# When isTest is false, downloads the driver signing key and exports it as 'driverKeyFile'. When
10+
# isTest is true, downloads the test signing key and exports it as 'testKeyFile'.
11+
#
12+
# Downstream steps reference the path via:
13+
#
14+
# $(driverKeyFile.secureFilePath) or
15+
# $(testKeyFile.secureFilePath)
16+
17+
parameters:
18+
19+
# When false, download the driver signing key.
20+
# When true, download the test signing key.
21+
- name: isTest
22+
type: boolean
23+
default: false
24+
25+
steps:
26+
27+
- ${{ if eq(parameters.isTest, false) }}:
28+
- task: DownloadSecureFile@1
29+
displayName: Download Driver Signing Key
30+
inputs:
31+
secureFile: netfxKeypair.snk
32+
name: driverKeyFile
33+
34+
- ${{ else }}:
35+
- task: DownloadSecureFile@1
36+
displayName: Download Test Signing Key
37+
inputs:
38+
secureFile: sqlclient-test-key.snk
39+
name: testKeyFile

‎eng/pipelines/dotnet-sqlclient-ci-core.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,12 @@ parameters:
109109
- detailed
110110
- diagnostic
111111

112+
# True when building on the internal ADO.Net project. Internal builds may perform additional or
113+
# different steps, such as assembly signing.
114+
- name: isInternalBuild
115+
type: boolean
116+
default: false
117+
112118
variables:
113119
- template: /eng/pipelines/libraries/ci-build-variables.yml@self
114120

@@ -149,6 +155,8 @@ stages:
149155
buildConfiguration: ${{ parameters.buildConfiguration }}
150156
debug: ${{ parameters.debug }}
151157
dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
158+
referenceType: ${{ parameters.referenceType }}
159+
isInternalBuild: ${{ parameters.isInternalBuild }}
152160

153161
# Build the Logging package, and publish it to the pipeline artifacts
154162
# under the given artifact name. This runs in parallel with the Secrets

‎eng/pipelines/dotnet-sqlclient-ci-package-reference-pipeline.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,3 +178,4 @@ extends:
178178
testJobTimeout: ${{ parameters.testJobTimeout }}
179179
testSets: ${{ parameters.testSets }}
180180
useManagedSNI: ${{ parameters.useManagedSNI }}
181+
isInternalBuild: ${{ eq(variables['System.TeamProject'], 'ADO.Net') }}

‎eng/pipelines/dotnet-sqlclient-ci-project-reference-pipeline.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,3 +178,4 @@ extends:
178178
testJobTimeout: ${{ parameters.testJobTimeout }}
179179
testSets: ${{ parameters.testSets }}
180180
useManagedSNI: ${{ parameters.useManagedSNI }}
181+
isInternalBuild: ${{ eq(variables['System.TeamProject'], 'ADO.Net') }}

‎eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml‎

Lines changed: 44 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,21 @@ parameters:
4949
- detailed
5050
- diagnostic
5151

52+
# The C# project reference type to use when building and packing the packages.
53+
- name: referenceType
54+
type: string
55+
default: Project
56+
values:
57+
# Reference sibling packages as NuGet packages.
58+
- Package
59+
# Reference sibling packages as C# projects.
60+
- Project
61+
62+
# True when building on the internal ADO.Net project.
63+
- name: isInternalBuild
64+
type: boolean
65+
default: false
66+
5267
jobs:
5368

5469
- job: pack_sqlserver_package_job
@@ -94,19 +109,36 @@ jobs:
94109
parameters:
95110
debug: ${{ parameters.debug }}
96111

112+
# Download the assembly signing key for internal Package-mode builds.
113+
- ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}:
114+
- template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self
115+
97116
# Create the NuGet packages.
98-
- task: DotNetCoreCLI@2
99-
displayName: Create NuGet Package
100-
inputs:
101-
command: pack
102-
packagesToPack: $(project)
103-
configurationToPack: ${{ parameters.buildConfiguration }}
104-
packDirectory: $(dotnetPackagesDir)
105-
verbosityToPack: ${{ parameters.dotnetVerbosity }}
106-
# BuildNumber supplies the revision component of FileVersion
107-
# (Major.Minor.Patch.Revision). Without it, FileVersionBuildNumber
108-
# defaults to 0 and the assembly is stamped Major.Minor.Patch.0.
109-
buildProperties: SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }};BuildNumber=$(Build.BuildNumber)
117+
#
118+
# BuildNumber supplies the revision component of FileVersion
119+
# (Major.Minor.Patch.Revision). Without it, FileVersionBuildNumber
120+
# defaults to 0 and the assembly is stamped Major.Minor.Patch.0.
121+
- ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}:
122+
- task: DotNetCoreCLI@2
123+
displayName: Create NuGet Package
124+
inputs:
125+
command: pack
126+
packagesToPack: $(project)
127+
configurationToPack: ${{ parameters.buildConfiguration }}
128+
packDirectory: $(dotnetPackagesDir)
129+
verbosityToPack: ${{ parameters.dotnetVerbosity }}
130+
buildProperties: SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }};BuildNumber=$(Build.BuildNumber);SigningKeyPath=$(driverKeyFile.secureFilePath)
131+
132+
- ${{ else }}:
133+
- task: DotNetCoreCLI@2
134+
displayName: Create NuGet Package
135+
inputs:
136+
command: pack
137+
packagesToPack: $(project)
138+
configurationToPack: ${{ parameters.buildConfiguration }}
139+
packDirectory: $(dotnetPackagesDir)
140+
verbosityToPack: ${{ parameters.dotnetVerbosity }}
141+
buildProperties: SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }};BuildNumber=$(Build.BuildNumber)
110142

111143
- task: PublishPipelineArtifact@1
112144
displayName: Publish Pipeline Artifact

‎eng/pipelines/onebranch/jobs/validate-signed-package-job.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -157,8 +157,8 @@ jobs:
157157
$nugetPackageInstallPath = "${{ variables.nugetPackageInstallPath }}"
158158
echo "nugetPackageInstallPath= $nugetPackageInstallPath"
159159
160-
# Verify strong name signing #####################################
161-
echo "> 1. Verifying strong name signing of DLLs ..."
160+
# Verify strong-name signing ###################################
161+
echo "> 1. Verifying strong-name signing of DLLs ..."
162162
163163
# @TODO: This path seems brittle to VS upgrades, can we make it more flexible?
164164
$snPath = "C:\Program Files (x86)\Microsoft SDKs\Windows\*\bin\NETFX 4.8.1 Tools\sn.exe"

‎eng/pipelines/onebranch/steps/build-buildproj-step.yml‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -57,12 +57,8 @@ parameters:
5757
type: string
5858

5959
steps:
60-
# Download the strong name signing key from secure file storage
61-
- task: DownloadSecureFile@1
62-
displayName: 'Download Signing Key'
63-
inputs:
64-
secureFile: 'netfxKeypair.snk'
65-
name: keyFile
60+
# Download the assembly signing key from secure file storage.
61+
- template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self
6662

6763
- task: DotNetCoreCLI@2
6864
displayName: 'build.proj - Build${{ parameters.packageShortName }}'
@@ -74,7 +70,7 @@ steps:
7470
-p:Configuration=${{ parameters.buildConfiguration }}
7571
-p:ReferenceType=Package
7672
-p:SkipDependencyPack=true
77-
-p:SigningKeyPath="$(keyFile.secureFilePath)"
73+
-p:SigningKeyPath="$(driverKeyFile.secureFilePath)"
7874
-p:BuildNumber="${{ parameters.revision }}"
7975
-p:PackageVersion${{ parameters.versionPropertySuffix }}="${{ parameters.packageVersion }}"
8076
${{ parameters.dependencyArguments }}

‎eng/pipelines/stages/build-sqlserver-package-ci-stage.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,21 @@ parameters:
5959
- detailed
6060
- diagnostic
6161

62+
# The C# project reference type to use when building and packing the packages.
63+
- name: referenceType
64+
type: string
65+
default: Project
66+
values:
67+
# Reference sibling packages as NuGet packages.
68+
- Package
69+
# Reference sibling packages as C# projects.
70+
- Project
71+
72+
# True when building on the internal ADO.Net project.
73+
- name: isInternalBuild
74+
type: boolean
75+
default: false
76+
6277
stages:
6378

6479
- stage: build_sqlserver_package_stage
@@ -83,3 +98,5 @@ stages:
8398
# The version is computed by this stage (see the sqlServerPackageVersion variable above).
8499
sqlServerPackageVersion: $(sqlServerPackageVersion)
85100
dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
101+
referenceType: ${{ parameters.referenceType }}
102+
isInternalBuild: ${{ parameters.isInternalBuild }}

0 commit comments

Comments
 (0)