|
| 1 | +parameters: |
| 2 | +basePath:'' |
| 3 | +timeoutInMinutes:'' |
| 4 | + |
| 5 | +steps: |
| 6 | +-${{ if and(ne(variables['System.TeamProject'], 'public'), ne(variables['Build.Reason'], 'PullRequest'), or(startswith(variables['Build.SourceBranch'], 'refs/heads/release/'), startswith(variables['Build.SourceBranch'], 'refs/heads/internal/release/'))) }}: |
| 7 | + -task:EsrpCodeSigning@1 |
| 8 | +displayName:Sign Diagnostic Binaries |
| 9 | +inputs: |
| 10 | +ConnectedServiceName:'dotnetesrp-diagnostics-dnceng' |
| 11 | +FolderPath:${{ parameters.basePath }} |
| 12 | +Pattern:| |
| 13 | + **/mscordaccore*.dll |
| 14 | + **/mscordbi*.dll |
| 15 | +UseMinimatch:true |
| 16 | +signConfigType:'inlineSignParams' |
| 17 | +inlineOperation:>- |
| 18 | + [ |
| 19 | + { |
| 20 | + "keyCode": "CP-471322", |
| 21 | + "operationCode": "SigntoolSign", |
| 22 | + "parameters": { |
| 23 | + "OpusName": "Microsoft", |
| 24 | + "OpusInfo": "http://www.microsoft.com", |
| 25 | + "PageHash": "/NPH", |
| 26 | + "FileDigest": "/fd sha256", |
| 27 | + "TimeStamp": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256" |
| 28 | + }, |
| 29 | + "toolName": "sign", |
| 30 | + "toolVersion": "1.0" |
| 31 | + }, |
| 32 | + { |
| 33 | + "KeyCode": "CP-471322", |
| 34 | + "OperationCode": "SigntoolVerify", |
| 35 | + "Parameters": {}, |
| 36 | + "ToolName": "sign", |
| 37 | + "ToolVersion": "1.0" |
| 38 | + } |
| 39 | + ] |
| 40 | +SessionTimeout:${{ parameters.timeoutInMinutes }} |
| 41 | +MaxConcurrency:'50' |
| 42 | +MaxRetryAttempts:'5' |
| 43 | + |
| 44 | + -powershell:| |
| 45 | + $filesToSign = $(Get-ChildItem -Recurse ${{ parameters.basePath }} -Include mscordaccore*.dll, mscordbi*.dll) |
| 46 | + foreach ($file in $filesToSign) { |
| 47 | + $signingCert = $(Get-AuthenticodeSignature $file).SignerCertificate |
| 48 | + if ($signingCert -eq $null) |
| 49 | + { |
| 50 | + throw "File $file does not contain a signature." |
| 51 | + } |
| 52 | +
|
| 53 | + if ($signingCert.Subject -ne "CN=.NET DAC, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ` |
| 54 | + -or $signingCert.Issuer -ne "CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US") |
| 55 | + { |
| 56 | + throw "File $file not in expected trust chain." |
| 57 | + } |
| 58 | +
|
| 59 | + $certEKU = $signingCert.Extensions.Where({ $_.Oid.FriendlyName -eq "Enhanced Key Usage" }) | Select -First 1 |
| 60 | +
|
| 61 | + if ($certEKU.EnhancedKeyUsages.Where({ $_.Value -eq "1.3.6.1.4.1.311.84.4.1" }).Count -ne 1) |
| 62 | + { |
| 63 | + throw "Signature for $file does not contain expected EKU." |
| 64 | + } |
| 65 | +
|
| 66 | + Write-Host "$file is correctly signed." |
| 67 | + } |
| 68 | + displayName: Validate diagnostic signatures |