From a0ab0964d4b8e425cbc3dd375eebf3bdbe5a4d72 Mon Sep 17 00:00:00 2001 From: Matt Mitchell Date: Wed, 14 Oct 2020 10:19:10 -0700 Subject: [PATCH] [release/5.0] Fix some post-build signing issues (#26506) * Fix some post-build signing issues This fixes some post-build signing issues that are present in the aspnetcore repo 1. Add the .msi extension to be signed by Microsoft400 - Msis must be signed. With in-build signing these get handled explicitly by the wixproj infrastructure. When we do post build signing, we must sign these files. 2. Remove the strong name exclusions. These exclusions are incorrect when applied in post-build and unnecessary for in-build signing. Most importantly, the aspnetcore PKT would not end up re-strong named (it doesn't need to be strong name signed by ESRP since it's strong named in-build) because the PKT doesn't match any of the StrongNameSignInfo specified in arcade. The rest of the entries seem to be mostly about optimization. I could not find any performance difference between these entries being present and not. I am not sure whether they actually even apply to any assets. Moreover, when doing post-build signing, they would conflict with the entries in runtime and other places. Verification - I have a tool that I wrote which unpacks every file between two directories and compares the strong name, nuget, and authenticode certs between equivalent files. This is the same tool being used to verify post-build signing. This tool shows no difference in any aspnetcore produced asset. Baseline: https://dev.azure.com/dnceng/internal/_build/results?buildId=836183&view=results Diff: https://dev.azure.com/dnceng/internal/_build/results?buildId=837176&view=results * Do not push VS packages for installers when PostBuildSign == true * Output wix command packages to the installers output path * Don't import microbuild signing targets from wix when PostBuildSign=true * Tweaks: - Don't sign wixpacks when not in post-build signing - Generate a wixpack for both the original msi name (which the wixproj generates) AND the name we use in the final outputs. This is because while these files are the same, signing differentiates the certificate based on the file name, and wixpack lookup is also based on the file names. Aspnetcore and other repos have uses the final outputs (e.g. dotnet-aspnetcore-runtime-123.5..) as well as the internal names (e.g. AspNetCoreSharedFramework_x64.msi). - Don't sign msi's when not post-build signing. * Avoid generating sha512 files for wixpack zips * Don't run xplat code sign jobs if PostBuildSign == true * Change original target names * Conditionalize codesign operations * Add publishing flag for linux x64 and add deb sha512 generation * Do not push the x64 linux runtime archive more than once --- .azure/pipelines/ci.yml | 67 ++++++++++++------- eng/AfterSigning.targets | 3 +- eng/Publishing.props | 15 +++-- eng/Signing.props | 24 ++----- eng/targets/Cpp.Common.targets | 2 +- eng/targets/Wix.Common.targets | 5 +- .../ANCMIISExpressV2/AncmIISExpressV2.wixproj | 4 +- .../ANCMV2/AncmV2.wixproj | 4 +- .../SharedFrameworkLib.wixproj | 10 ++- src/Installers/Windows/Wix.props | 4 +- src/Installers/Windows/Wix.targets | 11 ++- 11 files changed, 84 insertions(+), 65 deletions(-) diff --git a/.azure/pipelines/ci.yml b/.azure/pipelines/ci.yml index 3cbd594ec3..d3d8637c41 100644 --- a/.azure/pipelines/ci.yml +++ b/.azure/pipelines/ci.yml @@ -32,6 +32,8 @@ variables: value: .NETCORE - name: _DotNetValidationArtifactsCategory value: .NETCORE +- name: PostBuildSign + value: false - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: - name: _BuildArgs value: /p:TeamName=$(_TeamName) @@ -349,9 +351,11 @@ stages: includeForks: true - name: MacOS_x64_Packages path: artifacts/packages/ - - template: jobs/codesign-xplat.yml - parameters: - inputName: MacOS_x64 + + - ${{ if ne(variables['PostBuildSign'], 'true') }}: + - template: jobs/codesign-xplat.yml + parameters: + inputName: MacOS_x64 # Build Linux x64 - template: jobs/default-build.yml @@ -369,7 +373,9 @@ stages: --no-build-nodejs --no-build-java -p:OnlyPackPlatformSpecificPackages=true + -p:AssetManifestFileName=aspnetcore-Linux_x64.xml $(_BuildArgs) + $(_PublishArgs) $(_InternalRuntimeDownloadArgs) displayName: Run build.sh - script: | @@ -399,7 +405,7 @@ stages: -p:OnlyPackPlatformSpecificPackages=true \ -p:BuildRuntimeArchive=false \ -p:LinuxInstallerType=rpm \ - -p:AssetManifestFileName=aspnetcore-Linux_x64.xml \ + -p:AssetManifestFileName=aspnetcore-Linux_x64-installers.xml \ $(_BuildArgs) \ $(_PublishArgs) \ $(_InternalRuntimeDownloadArgs) @@ -413,9 +419,11 @@ stages: includeForks: true - name: Linux_x64_Packages path: artifacts/packages/ - - template: jobs/codesign-xplat.yml - parameters: - inputName: Linux_x64 + + - ${{ if ne(variables['PostBuildSign'], 'true') }}: + - template: jobs/codesign-xplat.yml + parameters: + inputName: Linux_x64 # Build Linux ARM - template: jobs/default-build.yml @@ -443,9 +451,11 @@ stages: includeForks: true - name: Linux_arm_Packages path: artifacts/packages/ - - template: jobs/codesign-xplat.yml - parameters: - inputName: Linux_arm + + - ${{ if ne(variables['PostBuildSign'], 'true') }}: + - template: jobs/codesign-xplat.yml + parameters: + inputName: Linux_arm # Build Linux ARM64 - template: jobs/default-build.yml @@ -473,9 +483,11 @@ stages: includeForks: true - name: Linux_arm64_Packages path: artifacts/packages/ - - template: jobs/codesign-xplat.yml - parameters: - inputName: Linux_arm64 + + - ${{ if ne(variables['PostBuildSign'], 'true') }}: + - template: jobs/codesign-xplat.yml + parameters: + inputName: Linux_arm64 # Build Linux Musl x64 - template: jobs/default-build.yml @@ -507,9 +519,11 @@ stages: includeForks: true - name: Linux_musl_x64_Packages path: artifacts/packages/ - - template: jobs/codesign-xplat.yml - parameters: - inputName: Linux_musl_x64 + + - ${{ if ne(variables['PostBuildSign'], 'true') }}: + - template: jobs/codesign-xplat.yml + parameters: + inputName: Linux_musl_x64 # Build Linux Musl ARM64 - template: jobs/default-build.yml @@ -541,9 +555,11 @@ stages: includeForks: true - name: Linux_musl_arm64_Packages path: artifacts/packages/ - - template: jobs/codesign-xplat.yml - parameters: - inputName: Linux_musl_arm64 + + - ${{ if ne(variables['PostBuildSign'], 'true') }}: + - template: jobs/codesign-xplat.yml + parameters: + inputName: Linux_musl_arm64 - ${{ if or(eq(variables['System.TeamProject'], 'public'), in(variables['Build.Reason'], 'PullRequest')) }}: # Test jobs @@ -734,12 +750,13 @@ stages: - Windows_build - Windows_arm_build - Windows_arm64_build - - CodeSign_Xplat_MacOS_x64 - - CodeSign_Xplat_Linux_x64 - - CodeSign_Xplat_Linux_arm - - CodeSign_Xplat_Linux_arm64 - - CodeSign_Xplat_Linux_musl_x64 - - CodeSign_Xplat_Linux_musl_arm64 + - ${{ if ne(variables['PostBuildSign'], 'true') }}: + - CodeSign_Xplat_MacOS_x64 + - CodeSign_Xplat_Linux_x64 + - CodeSign_Xplat_Linux_arm + - CodeSign_Xplat_Linux_arm64 + - CodeSign_Xplat_Linux_musl_x64 + - CodeSign_Xplat_Linux_musl_arm64 # In addition to the dependencies above, ensure the build was successful overall. - Source_Build pool: diff --git a/eng/AfterSigning.targets b/eng/AfterSigning.targets index d9205a0d56..c6a20e53b1 100644 --- a/eng/AfterSigning.targets +++ b/eng/AfterSigning.targets @@ -13,9 +13,10 @@ - + + %(FullPath).sha512 diff --git a/eng/Publishing.props b/eng/Publishing.props index 39c3ea1f4c..3752cf44fd 100644 --- a/eng/Publishing.props +++ b/eng/Publishing.props @@ -50,8 +50,14 @@ - - + + + + <_InstallersToPublish Remove="$(ArtifactsDir)installers\**\*.tar.gz" Condition="'$(BuildRuntimeArchive)' == 'false'" /> + <_ChecksumsToPublish Remove="$(ArtifactsDir)installers\**\*.tar.gz.sha512" Condition="'$(BuildRuntimeArchive)' == 'false'" /> true @@ -60,14 +66,9 @@ true - ShipInstaller=dotnetcli true $(_UploadPathRoot)/%(_InstallersToPublish.UploadPathSegment)/$(_PackageVersion)/%(Filename)%(Extension) - - - - diff --git a/eng/Signing.props b/eng/Signing.props index f35228b20f..8d59587b91 100644 --- a/eng/Signing.props +++ b/eng/Signing.props @@ -5,7 +5,6 @@ - @@ -15,6 +14,7 @@ + - - - - - - - - - - + + + diff --git a/eng/targets/Cpp.Common.targets b/eng/targets/Cpp.Common.targets index f32f3f1821..f0b3a09f11 100644 --- a/eng/targets/Cpp.Common.targets +++ b/eng/targets/Cpp.Common.targets @@ -5,7 +5,7 @@ - + diff --git a/eng/targets/Wix.Common.targets b/eng/targets/Wix.Common.targets index 4c6d15a790..3fdb8af56d 100644 --- a/eng/targets/Wix.Common.targets +++ b/eng/targets/Wix.Common.targets @@ -39,5 +39,8 @@ - + + diff --git a/src/Installers/Windows/AspNetCoreModule-Setup/ANCMIISExpressV2/AncmIISExpressV2.wixproj b/src/Installers/Windows/AspNetCoreModule-Setup/ANCMIISExpressV2/AncmIISExpressV2.wixproj index 5743c4c94c..04f70e784c 100644 --- a/src/Installers/Windows/AspNetCoreModule-Setup/ANCMIISExpressV2/AncmIISExpressV2.wixproj +++ b/src/Installers/Windows/AspNetCoreModule-Setup/ANCMIISExpressV2/AncmIISExpressV2.wixproj @@ -7,7 +7,7 @@ true 17c76489-4c09-4e14-b81c-7a86cd937144 Package - ancm_iis_express_$(Platform)_en_v2 + $(Name)_$(Platform) ICE03 true 2.0 @@ -67,6 +67,6 @@ - $(TargetName)_$(PackageVersion)$(TargetExt) + ancm_iis_express_$(Platform)_en_v2_$(PackageVersion)$(TargetExt) diff --git a/src/Installers/Windows/AspNetCoreModule-Setup/ANCMV2/AncmV2.wixproj b/src/Installers/Windows/AspNetCoreModule-Setup/ANCMV2/AncmV2.wixproj index 40d0692eb8..ecc897c78b 100644 --- a/src/Installers/Windows/AspNetCoreModule-Setup/ANCMV2/AncmV2.wixproj +++ b/src/Installers/Windows/AspNetCoreModule-Setup/ANCMV2/AncmV2.wixproj @@ -7,7 +7,7 @@ true f9bacb48-3bd7-4ec2-ae31-664e8703ec12 Package - aspnetcoremodule_$(Platform)_en_v2 + $(Name)_$(Platform) true 2.0 true @@ -55,6 +55,6 @@ - $(TargetName)_$(PackageVersion)$(TargetExt) + aspnetcoremodule_$(Platform)_en_v2_$(PackageVersion)$(TargetExt) diff --git a/src/Installers/Windows/SharedFrameworkLib/SharedFrameworkLib.wixproj b/src/Installers/Windows/SharedFrameworkLib/SharedFrameworkLib.wixproj index ec1867056b..834b155055 100644 --- a/src/Installers/Windows/SharedFrameworkLib/SharedFrameworkLib.wixproj +++ b/src/Installers/Windows/SharedFrameworkLib/SharedFrameworkLib.wixproj @@ -43,13 +43,19 @@ - + + + + + + diff --git a/src/Installers/Windows/Wix.props b/src/Installers/Windows/Wix.props index b3ad64d7ad..a39ef024cd 100644 --- a/src/Installers/Windows/Wix.props +++ b/src/Installers/Windows/Wix.props @@ -32,8 +32,8 @@ $(ArtifactsObjDir)/WixCommandPackages - - $(ArtifactsNonShippingPackagesDir) + + $(InstallersOutputPath) diff --git a/src/Installers/Windows/Wix.targets b/src/Installers/Windows/Wix.targets index 8c84c8b3e8..07c4e8db73 100644 --- a/src/Installers/Windows/Wix.targets +++ b/src/Installers/Windows/Wix.targets @@ -32,7 +32,7 @@ - + $(NuGetPackageRoot)microsoft.dotnet.build.tasks.installers\$(MicrosoftDotNetBuildTasksInstallersPackageVersion)\tools\netcoreapp2.1\Microsoft.DotNet.Build.Tasks.Installers.dll $(NuGetPackageRoot)microsoft.dotnet.build.tasks.installers\$(MicrosoftDotNetBuildTasksInstallersPackageVersion)\tools\net472\Microsoft.DotNet.Build.Tasks.Installers.dll @@ -89,14 +89,19 @@ - + + + + +