Skip to content

Commit bfca336

Browse files
NiklasGustafssonNiklasGustafsson
authored
Code signing with white-lists (#371)
Adding whitelist file to avoid signing bundled binaries.
1 parent f440aa7 commit bfca336

5 files changed

+89
-70
lines changed

‎LICENSE ‎LICENSE.txt

File renamed without changes.

‎azure-pipelines.yml

+81-65
Original file line numberDiff line numberDiff line change
@@ -233,7 +233,7 @@ jobs:
233233
displayName: Publish build packages
234234
artifact: BuildTorchSharpPackages
235235

236-
- publish: SignClient.json
236+
- publish: $(Build.SourcesDirectory)/config
237237
displayName: Publish signing config
238238
artifact: config
239239

@@ -360,13 +360,11 @@ jobs:
360360
artifact: BuildLinuxCUDAPackages
361361

362362
################################################################################
363-
- job: CodeSign
363+
- job: CodeSign_Core
364364
################################################################################
365365
condition: and(ne(variables['system.pullrequest.isfork'], true), eq(variables['build.sourcebranchname'], 'main'))
366366
dependsOn:
367367
- Build_TorchSharp_And_libtorch_cpu_Packages
368-
- Build_libtorch_cuda_win_Packages
369-
- Build_libtorch_cuda_linux_Packages
370368
variables:
371369
- group: SignClient Credentials
372370
pool:
@@ -393,6 +391,7 @@ jobs:
393391
--baseDirectory '$(Pipeline.Workspace)\BuildTorchSharpPackages' `
394392
--input '**/*.nupkg' `
395393
--config '$(Pipeline.Workspace)\config\SignClient.json' `
394+
--filelist '$(Pipeline.Workspace)\config\signedfiles.txt' `
396395
--user '$(SignClientUser)' `
397396
--secret '$(SignClientSecret)' `
398397
--name 'TorchSharp' `
@@ -406,64 +405,89 @@ jobs:
406405
continueOnError: true
407406

408407
- script: rmdir /s /q $(Pipeline.Workspace)\BuildTorchSharpPackages
409-
# displayName: Free up space (TorchSharp packages in workspace)
410-
411-
# - download: current
412-
# displayName: Download Windows CUDA Packages
413-
# artifact: BuildWinCUDAPackages
414-
415-
# - pwsh: |
416-
# .\SignClient 'Sign' `
417-
# --baseDirectory '$(Pipeline.Workspace)\BuildWinCUDAPackages' `
418-
# --input '**/*.nupkg' `
419-
# --config '$(Pipeline.Workspace)\config\SignClient.json' `
420-
# --user '$(SignClientUser)' `
421-
# --secret '$(SignClientSecret)' `
422-
# --name 'TorchSharp' `
423-
# --description 'TorchSharp' `
424-
# --descriptionUrl 'https://github.com/dotnet/TorchSharp'
425-
# displayName: Sign packages
408+
displayName: Free up space (TorchSharp packages in workspace)
409+
410+
################################################################################
411+
- job: CodeSign_Extras
412+
################################################################################
413+
condition: and(ne(variables['system.pullrequest.isfork'], true), eq(variables['build.sourcebranchname'], 'main'), eq(variables['BuildLibTorchPackages'], 'true'))
414+
dependsOn:
415+
- Build_libtorch_cuda_win_Packages
416+
- Build_libtorch_cuda_linux_Packages
417+
variables:
418+
- group: SignClient Credentials
419+
pool:
420+
vmImage: 'windows-2019'
421+
steps:
422+
423+
- task: DotNetCoreCLI@2
424+
inputs:
425+
command: custom
426+
custom: tool
427+
arguments: install --tool-path . SignClient
428+
displayName: Install SignTool tool
429+
430+
- download: current
431+
displayName: Download configuration
432+
artifact: config
433+
434+
- download: current
435+
displayName: Download Windows CUDA Packages
436+
artifact: BuildWinCUDAPackages
437+
438+
- pwsh: |
439+
.\SignClient 'Sign' `
440+
--baseDirectory '$(Pipeline.Workspace)\BuildWinCUDAPackages' `
441+
--input '**/*.nupkg' `
442+
--config '$(Pipeline.Workspace)\config\SignClient.json' `
443+
--filelist '$(Pipeline.Workspace)\config\signedfiles.txt' `
444+
--user '$(SignClientUser)' `
445+
--secret '$(SignClientSecret)' `
446+
--name 'TorchSharp' `
447+
--description 'TorchSharp' `
448+
--descriptionUrl 'https://github.com/dotnet/TorchSharp'
449+
displayName: Sign packages
426450
427-
# - publish: $(Pipeline.Workspace)/BuildWinCUDAPackages
428-
# displayName: Publish Signed Windows CUDA Packages
429-
# artifact: SignedWinCUDAPackages
430-
# continueOnError: true
451+
- publish: $(Pipeline.Workspace)/BuildWinCUDAPackages
452+
displayName: Publish Signed Windows CUDA Packages
453+
artifact: SignedWinCUDAPackages
454+
continueOnError: true
431455

432-
# - script: rmdir /s /q $(Pipeline.Workspace)\BuildWinCUDAPackages
433-
# displayName: Free up space (TorchSharp packages in workspace)
434-
435-
# - download: current
436-
# displayName: Download Linux CUDA Packages
437-
# artifact: BuildLinuxCUDAPackages
438-
439-
# - pwsh: |
440-
# .\SignClient 'Sign' `
441-
# --baseDirectory '$(Pipeline.Workspace)\BuildLinuxCUDAPackages' `
442-
# --input '**/*.nupkg' `
443-
# --config '$(Pipeline.Workspace)\config\SignClient.json' `
444-
# --user '$(SignClientUser)' `
445-
# --secret '$(SignClientSecret)' `
446-
# --name 'TorchSharp' `
447-
# --description 'TorchSharp' `
448-
# --descriptionUrl 'https://github.com/dotnet/TorchSharp'
449-
# displayName: Sign packages
450-
451-
# - publish: $(Pipeline.Workspace)/BuildLinuxCUDAPackages
452-
# displayName: Publish Signed Linux CUDA Packages
453-
# artifact: SignedLinuxCUDAPackages
454-
# continueOnError: true
456+
- script: rmdir /s /q $(Pipeline.Workspace)\BuildWinCUDAPackages
457+
displayName: Free up space (TorchSharp packages in workspace)
458+
459+
- download: current
460+
displayName: Download Linux CUDA Packages
461+
artifact: BuildLinuxCUDAPackages
455462

456-
# - script: rmdir /s /q $(Pipeline.Workspace)\BuildLinuxCUDAPackages
457-
# displayName: Free up space (TorchSharp packages in workspace)
463+
- pwsh: |
464+
.\SignClient 'Sign' `
465+
--baseDirectory '$(Pipeline.Workspace)\BuildLinuxCUDAPackages' `
466+
--input '**/*.nupkg' `
467+
--config '$(Pipeline.Workspace)\config\SignClient.json' `
468+
--filelist '$(Pipeline.Workspace)\config\signedfiles.txt' `
469+
--user '$(SignClientUser)' `
470+
--secret '$(SignClientSecret)' `
471+
--name 'TorchSharp' `
472+
--description 'TorchSharp' `
473+
--descriptionUrl 'https://github.com/dotnet/TorchSharp'
474+
displayName: Sign packages
475+
476+
- publish: $(Pipeline.Workspace)/BuildLinuxCUDAPackages
477+
displayName: Publish Signed Linux CUDA Packages
478+
artifact: SignedLinuxCUDAPackages
479+
continueOnError: true
458480

481+
- script: rmdir /s /q $(Pipeline.Workspace)\BuildLinuxCUDAPackages
482+
displayName: Free up space (TorchSharp packages in workspace)
459483

460484
################################################################################
461485
- job: Push_TorchSharp_And_libtorch_cpu_Packages
462486
################################################################################
463487
condition: and(ne(variables['system.pullrequest.isfork'], true), eq(variables['build.sourcebranchname'], 'main'))
464488
dependsOn:
465489
- Build_TorchSharp_And_libtorch_cpu_Packages
466-
- CodeSign
490+
- CodeSign_Core
467491
variables:
468492
BuildConfig: Release
469493
OfficialBuildId: $(BUILD.BUILDNUMBER)
@@ -537,7 +561,7 @@ jobs:
537561
condition: and(ne(variables['system.pullrequest.isfork'], true), eq(variables['build.sourcebranchname'], 'main'), eq(variables['BuildLibTorchPackages'], 'true'))
538562
dependsOn:
539563
- Build_libtorch_cuda_win_Packages
540-
- CodeSign
564+
- CodeSign_Extras
541565
variables:
542566
BuildConfig: Release
543567
OfficialBuildId: $(BUILD.BUILDNUMBER)
@@ -557,12 +581,8 @@ jobs:
557581
displayName: 'NuGet Authenticate'
558582

559583
- download: current
560-
displayName: Download Windows CUDA Packages
561-
artifact: BuildWinCUDAPackages
562-
563-
# - download: current
564-
# displayName: Download Signed Windows CUDA Packages
565-
# artifact: SignedWinCUDAPackages
584+
displayName: Download Signed Windows CUDA Packages
585+
artifact: SignedWinCUDAPackages
566586

567587
# push the Windows Cuda packages as they are useful even if pushing the huge and messy Linux cuda packages fails
568588
- task: NuGetCommand@2
@@ -626,7 +646,7 @@ jobs:
626646
condition: and(ne(variables['system.pullrequest.isfork'], true), eq(variables['build.sourcebranchname'], 'main'), eq(variables['BuildLibTorchPackages'], 'true'))
627647
dependsOn:
628648
- Build_libtorch_cuda_linux_Packages
629-
- CodeSign
649+
- CodeSign_Extras
630650
variables:
631651
BuildConfig: Release
632652
OfficialBuildId: $(BUILD.BUILDNUMBER)
@@ -648,12 +668,8 @@ jobs:
648668
displayName: 'NuGet Authenticate'
649669

650670
- download: current
651-
displayName: Download Linux CUDA Packages
652-
artifact: BuildLinuxCUDAPackages
653-
654-
# - download: current
655-
# displayName: Download Signed Linux CUDA Packages
656-
# artifact: SignedLinuxCUDAPackages
671+
displayName: Download Signed Linux CUDA Packages
672+
artifact: SignedLinuxCUDAPackages
657673

658674
# push the Linux Cuda packages
659675
- task: NuGetCommand@2

‎SignClient.json ‎config/SignClient.json

File renamed without changes.

‎config/signedfiles.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
**/*.nupkg
2+
**/TorchSharp.dll
3+
**/LibTorchSharp.dll

‎pkg/Directory.Build.props

+5-5
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<PackageProjectUrl>https://github.com/dotnet/TorchSharp</PackageProjectUrl>
1414
<PackageTags>TorchSharp LibTorch PyTorch Torch DL DNN Deep ML Machine Learning Neural Network</PackageTags>
1515
<Copyright>Copyright PyTorch contributors</Copyright>
16-
<Owners>TorchSharp maintainers</Owners>
16+
<Owners>.NET Foundation and Contributors</Owners>
1717
<TargetFramework>netstandard2.0</TargetFramework>
1818
<PackageDescription>TorchSharp makes PyTorch available for .NET users. $(MSBuildProjectName) contains components of the PyTorch LibTorch library version $(LibTorchVersion) redistributed as a NuGet package with added support for TorchSharp.</PackageDescription>
1919
<PackageRequireLicenseAcceptance>true</PackageRequireLicenseAcceptance>
@@ -24,19 +24,19 @@
2424
<Authors>(see main package)</Authors>
2525
<PackageTags></PackageTags>
2626
<Copyright>(see main package)</Copyright>
27-
<Owners>TorchSharp maintainers</Owners>
27+
<Owners>T.NET Foundation and Contributors</Owners>
2828
<PackageDescription>(see main package)</PackageDescription>
2929
<PackageRequireLicenseAcceptance>false</PackageRequireLicenseAcceptance>
3030
</PropertyGroup>
3131

3232
<!-- TorchSharp -->
3333
<PropertyGroup Condition="'$(_IsLibTorchPackage)' != 'true'">
3434
<Authors>TorchSharp contributors</Authors>
35-
<PackageLicenseFile>LICENSE</PackageLicenseFile>
35+
<PackageLicenseFile>LICENSE.txt</PackageLicenseFile>
3636
<PackageProjectUrl>https://github.com/dotnet/TorchSharp</PackageProjectUrl>
3737
<PackageTags>TorchSharp LibTorch PyTorch Torch DL DNN Deep ML Machine Learning Neural Network</PackageTags>
38-
<Copyright>Copyright Microsoft, TorchSharp contributors</Copyright>
39-
<Owners>TorchSharp maintainers</Owners>
38+
<Copyright>Copyright .NET Foundation and Contributors</Copyright>
39+
<Owners>.NET Foundation and Contributors</Owners>
4040
<TargetFramework>netstandard2.0</TargetFramework>
4141
<PackageDescription>TorchSharp makes PyTorch available for .NET users. $(MSBuildProjectName) contains components of the PyTorch LibTorch library version $(LibTorchVersion) redistributed as a NuGet package with added support for TorchSharp.</PackageDescription>
4242
<PackageRequireLicenseAcceptance>true</PackageRequireLicenseAcceptance>

0 commit comments

Comments
 (0)