Skip to content
This repository was archived by the owner on Oct 1, 2024. It is now read-only.

Commit d360641

Browse files
benmcmorranbenmcmorran
committed
Add signing for VSIX, JS, and Windows files
1 parent bf6d9ab commit d360641

File tree

7 files changed

+136
-8
lines changed

7 files changed

+136
-8
lines changed

‎.github/workflows/build.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,9 @@ jobs:
7373

7474
- name: Check for linting errors
7575
run: gulp tslint
76-
- name: Build and pack extension
76+
- name: Build extension
77+
run: gulp build --mode=production
78+
- name: Pack extension
7779
run: vsce package --out vscode-arduino.vsix
7880
- name: Publish extension VSIX as artifact
7981
uses: actions/upload-artifact@v2

‎.vscodeignore

+3-1
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,6 @@ gulpfile.js
1515
*.log
1616
webpack.config.js
1717
node_modules/**
18-
vendor/**
18+
vendor/**
19+
azure-pipelines.yml
20+
build/**

‎azure-pipelines.yml

+79-5
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,16 @@
33

44
name: $(Date:yyyyMMdd)$(Rev:.r).0-$(SourceBranchName)
55

6+
parameters:
7+
- name: SignTypeOverride
8+
displayName: Signing type override
9+
type: string
10+
default: default
11+
values:
12+
- default
13+
- test
14+
- real
15+
616
pr:
717
- master
818
- dev
@@ -19,7 +29,27 @@ trigger:
1929
pool:
2030
name: VSEngSS-MicroBuild2019-1ES
2131

32+
variables:
33+
# MicroBuild requires TeamName to be set.
34+
TeamName: C++ Cross Platform and Cloud
35+
# If the user didn't override the signing type, then only real-sign on master
36+
# or dev.
37+
${{ if ne(parameters.SignTypeOverride, 'default') }}:
38+
SignType: ${{ parameters.SignTypeOverride }}
39+
${{ if and(eq(parameters.SignTypeOverride, 'default'), or(eq(variables['Build.SourceBranchName'], 'master'), eq(variables['Build.SourceBranchName'], 'dev'))) }}:
40+
SignType: real
41+
${{ if and(eq(parameters.SignTypeOverride, 'default'), not(or(eq(variables['Build.SourceBranchName'], 'master'), eq(variables['Build.SourceBranchName'], 'dev')))) }}:
42+
SignType: test
43+
2244
steps:
45+
- task: MicroBuildSigningPlugin@3
46+
displayName: Install MicroBuild Signing
47+
inputs:
48+
signType: $(SignType)
49+
zipSources: false
50+
# MicroBuild signing will always fail on public PRs.
51+
condition: ne(variables['Build.Reason'], 'PullRequest')
52+
2353
# Run these scanners first so that they don't detect issues in dependencies.
2454
# Failures won't break the build until "Check for compliance errors" step.
2555
- task: CredScan@2
@@ -48,15 +78,56 @@ steps:
4878
- script: gulp genAikey
4979
displayName: Use production AI key
5080
condition: and(succeeded(), startsWith(variables['Build.SourceBranch'], 'refs/tags'))
81+
- script: gulp build --mode=production
82+
displayName: Build extension
83+
# Pack the extension now even though it's unsigned so that we ignore files
84+
# from .vscodeignore. This will reduce load on the signing server later and
85+
# ensure we only attempt to sign shipping files.
5186
- script: vsce package --out vscode-arduino.vsix
52-
displayName: Build and pack extension
53-
- publish: vscode-arduino.vsix
54-
artifact: VS Code extension VSIX
55-
displayName: Publish extension VSIX as artifact
87+
displayName: Pack extension
5688

5789
- task: ComponentGovernanceComponentDetection@0
5890
displayName: Detect components
5991

92+
# Extract the VSIX, sign what we can, then pack it back up and publish it.
93+
- task: ExtractFiles@1
94+
displayName: Extract extension for signing
95+
inputs:
96+
archiveFilePatterns: vscode-arduino.vsix
97+
destinationFolder: $(Build.StagingDirectory)\vscode-arduino
98+
- task: NuGetToolInstaller@1
99+
displayName: Install NuGet
100+
- task: NuGetAuthenticate@0
101+
displayName: Authenticate NuGet
102+
- script: nuget restore .\build\SignFiles.proj -PackagesDirectory .\build\packages
103+
displayName: Restore MicroBuild Core
104+
# MicroBuild signing will always fail on public PRs.
105+
condition: ne(variables['Build.Reason'], 'PullRequest')
106+
- task: MSBuild@1
107+
displayName: Sign files
108+
inputs:
109+
solution: .\build\SignFiles.proj
110+
msbuildArguments: /p:SignType=$(SignType)
111+
# MicroBuild signing will always fail on public PRs.
112+
condition: ne(variables['Build.Reason'], 'PullRequest')
113+
- task: ArchiveFiles@2
114+
displayName: Pack signed files
115+
inputs:
116+
rootFolderOrFile: $(Build.StagingDirectory)\vscode-arduino
117+
includeRootFolder: false
118+
archiveType: zip
119+
archiveFile: $(Build.StagingDirectory)\vscode-arduino.vsix
120+
- task: MSBuild@1
121+
displayName: Sign VSIX
122+
inputs:
123+
solution: .\build\SignVsix.proj
124+
msbuildArguments: /p:SignType=$(SignType)
125+
# MicroBuild signing will always fail on public PRs.
126+
condition: ne(variables['Build.Reason'], 'PullRequest')
127+
- publish: $(Build.StagingDirectory)\vscode-arduino.vsix
128+
artifact: VS Code extension VSIX
129+
displayName: Publish extension VSIX as artifact
130+
60131
# Install the Arduino IDE and run tests.
61132
- script: curl -LO https://downloads.arduino.cc/arduino-1.8.19-windows.zip
62133
displayName: Download Arduino IDE
@@ -114,6 +185,9 @@ steps:
114185
action: create
115186
target: $(Build.SourceVersion)
116187
tagSource: auto
117-
assets: $(Build.SourcesDirectory)\vscode-arduino.vsix
188+
assets: $(Build.StagingDirectory)\vscode-arduino.vsix
118189
isPreRelease: $[contains(variables['Build.SourceBranch'], '-rc')]
119190
condition: and(succeeded(), startsWith(variables['Build.SourceBranch'], 'refs/tags'))
191+
192+
- task: MicroBuildCleanup@1
193+
displayName: Clean up MicroBuild

‎build/SignFiles.proj

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="SignFiles" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<Import Project="packages\Microsoft.VisualStudioEng.MicroBuild.Core.0.4.1\build\Microsoft.VisualStudioEng.MicroBuild.Core.props" />
4+
5+
<PropertyGroup>
6+
<BaseOutputDirectory>$(BUILD_STAGINGDIRECTORY)\vscode-arduino\extension</BaseOutputDirectory>
7+
<!-- These properties are required by MicroBuild, which only signs files that are under these paths -->
8+
<IntermediateOutputPath>$(BaseOutputDirectory)</IntermediateOutputPath>
9+
<OutDir>$(BaseOutputDirectory)</OutDir>
10+
</PropertyGroup>
11+
12+
<ItemGroup>
13+
<FilesToSign Include="$(OutDir)\**\*.js" Exclude="$(OutDir)\**\node_modules\**\*.js">
14+
<Authenticode>Microsoft400</Authenticode>
15+
</FilesToSign>
16+
<FilesToSign Include="$(OutDir)\out\serial-monitor-cli\win32\*.exe">
17+
<Authenticode>Microsoft400</Authenticode>
18+
</FilesToSign>
19+
<FilesToSign Include="$(OutDir)\out\serial-monitor-cli\win32\*.dll">
20+
<Authenticode>Microsoft400</Authenticode>
21+
</FilesToSign>
22+
<FilesToSign Include="$(OutDir)\**\node_modules\**\*.js">
23+
<Authenticode>3PartyScriptsSHA2</Authenticode>
24+
</FilesToSign>
25+
</ItemGroup>
26+
27+
<Import Project="packages\Microsoft.VisualStudioEng.MicroBuild.Core.0.4.1\build\Microsoft.VisualStudioEng.MicroBuild.Core.targets" />
28+
</Project>

‎build/SignVsix.proj

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="SignFiles" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<Import Project="packages\Microsoft.VisualStudioEng.MicroBuild.Core.0.4.1\build\Microsoft.VisualStudioEng.MicroBuild.Core.props" />
4+
5+
<PropertyGroup>
6+
<BaseOutputDirectory>$(BUILD_STAGINGDIRECTORY)</BaseOutputDirectory>
7+
<!-- These properties are required by MicroBuild, which only signs files that are under these paths -->
8+
<IntermediateOutputPath>$(BaseOutputDirectory)</IntermediateOutputPath>
9+
<OutDir>$(BaseOutputDirectory)</OutDir>
10+
</PropertyGroup>
11+
12+
<ItemGroup>
13+
<FilesToSign Include="$(OutDir)\vscode-arduino.vsix">
14+
<Authenticode>VsixSHA2</Authenticode>
15+
</FilesToSign>
16+
</ItemGroup>
17+
18+
<Import Project="packages\Microsoft.VisualStudioEng.MicroBuild.Core.0.4.1\build\Microsoft.VisualStudioEng.MicroBuild.Core.targets" />
19+
</Project>

‎build/packages.config

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<packages>
3+
<package id="Microsoft.VisualStudioEng.MicroBuild.Core" version="0.4.1" developmentDependency="true" />
4+
</packages>

‎package.json

-1
Original file line numberDiff line numberDiff line change
@@ -571,7 +571,6 @@
571571
]
572572
},
573573
"scripts": {
574-
"vscode:prepublish": "gulp build --mode=production",
575574
"postinstall": "cd ./src/views && npm install && node ../../node_modules/node-usb-native/scripts/rebuild-serialport.js",
576575
"test": "gulp test"
577576
},

0 commit comments

Comments
 (0)