Skip to content

Commit 7005bb5

Browse files
bewithgauravbewithgaurav
committed
Merged PR 6247: FIX: Build Pipeline - Use OneBranch Signing
#### AI description (iteration 1) #### PR Classification This PR fixes the build pipeline configuration by updating the code signing steps to sign only wheel files for official builds. #### PR Summary The changes update the build pipeline YAML files for Windows, Linux, and macOS to remove unnecessary binary signing steps and enforce signing of only wheel files. This streamlines the code signing process by: - Modifying `build-windows-single-stage.yml` to remove DLL-specific signing parameters. - Adjusting `build-linux-single-stage.yml` to omit non-wheel artifact signing and note that ELF files cannot be signed with Windows SignTool. - Updating `build-macos-single-stage.yml` to remove Mach-O/dylib signing, noting the correctness for PyPI wheel distribution. <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot --> Related work items: #38066
1 parent 9cfb2d7 commit 7005bb5

File tree

3 files changed

+99
-69
lines changed

3 files changed

+99
-69
lines changed

‎OneBranchPipelines/stages/build-linux-single-stage.yml‎

Lines changed: 33 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -191,32 +191,42 @@ stages:
191191
artifact: 'drop_${{ parameters.stageName }}_${{ parameters.jobName }}'
192192
publishLocation: 'pipeline'
193193

194-
# Malware scanning
194+
# General malware scanning (Component Governance + OneBranch AntiMalware)
195195
- template: ../steps/malware-scanning-step.yml@self
196196
parameters:
197197
scanPath: '$(ob_outputDirectory)'
198198
artifactType: 'dll'
199199

200-
# ESRP Code Signing (Official builds only)
200+
# ESRP Malware scanning (Official builds only)
201201
- ${{ if and(eq(parameters.signingEnabled, true), eq(parameters.oneBranchType, 'Official')) }}:
202-
- template: /OneBranchPipelines/steps/compound-esrp-code-signing-step.yml@self
203-
parameters:
204-
appRegistrationClientId: '$(SigningAppRegistrationClientId)'
205-
appRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
206-
artifactType: 'dll'
207-
authAkvName: '$(SigningAuthAkvName)'
208-
authSignCertName: '$(SigningAuthSignCertName)'
209-
esrpClientId: '$(SigningEsrpClientId)'
210-
esrpConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
211-
signPath: '$(ob_outputDirectory)/bindings'
212-
213-
- template: /OneBranchPipelines/steps/compound-esrp-code-signing-step.yml@self
214-
parameters:
215-
appRegistrationClientId: '$(SigningAppRegistrationClientId)'
216-
appRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
217-
artifactType: 'whl'
218-
authAkvName: '$(SigningAuthAkvName)'
219-
authSignCertName: '$(SigningAuthSignCertName)'
220-
esrpClientId: '$(SigningEsrpClientId)'
221-
esrpConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
222-
signPath: '$(ob_outputDirectory)/wheels'
202+
- task: EsrpMalwareScanning@5
203+
displayName: 'ESRP MalwareScanning - Python Wheels'
204+
inputs:
205+
ConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
206+
AppRegistrationClientId: '$(SigningAppRegistrationClientId)'
207+
AppRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
208+
EsrpClientId: '$(SigningEsrpClientId)'
209+
UseMSIAuthentication: true
210+
FolderPath: '$(ob_outputDirectory)/wheels'
211+
Pattern: '*.whl'
212+
CleanupTempStorage: 1
213+
VerboseLogin: 1
214+
215+
# OneBranch Code Signing (Official builds only)
216+
# Note: We only sign wheels on all platforms (Windows, macOS, Linux). The wheel signature cryptographically
217+
# verifies the entire archive contents, making individual binary signing unnecessary. Additionally,
218+
# Linux .so files use ELF format which cannot be signed with Windows SignTool.
219+
#
220+
# References:
221+
# - https://eng.ms/docs/products/onebranch/signing/containerbuildsigning#signing-using-onebranchpipelinesigning-ado-task
222+
# (specifies not to use raw ESRP task for common certificates)
223+
# - https://eng.ms/docs/products/onebranch/signing/containerbuildsigning/availablesigningcpcodesandoperations
224+
# (key code usage - .whl files not explicitly listed, treated as binary archives)
225+
- ${{ if and(eq(parameters.signingEnabled, true), eq(parameters.oneBranchType, 'Official')) }}:
226+
- task: onebranch.pipeline.signing@1
227+
displayName: 'Sign Python Wheels'
228+
inputs:
229+
command: 'sign'
230+
signing_profile: 'external_distribution'
231+
files_to_sign: '**/*.whl'
232+
search_root: '$(ob_outputDirectory)/wheels'

‎OneBranchPipelines/stages/build-macos-single-stage.yml‎

Lines changed: 33 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -133,32 +133,42 @@ stages:
133133
artifact: 'drop_${{ parameters.stageName }}_${{ parameters.jobName }}'
134134
publishLocation: 'pipeline'
135135

136-
# Malware scanning
136+
# General malware scanning (Component Governance + OneBranch AntiMalware)
137137
- template: ../steps/malware-scanning-step.yml@self
138138
parameters:
139139
scanPath: '$(ob_outputDirectory)'
140140
artifactType: 'dll'
141141

142-
# ESRP Code Signing (Official builds only)
142+
# ESRP Malware scanning (Official builds only)
143143
- ${{ if and(eq(parameters.signingEnabled, true), eq(parameters.oneBranchType, 'Official')) }}:
144-
- template: /OneBranchPipelines/steps/compound-esrp-code-signing-step.yml@self
145-
parameters:
146-
appRegistrationClientId: '$(SigningAppRegistrationClientId)'
147-
appRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
148-
artifactType: 'dll'
149-
authAkvName: '$(SigningAuthAkvName)'
150-
authSignCertName: '$(SigningAuthSignCertName)'
151-
esrpClientId: '$(SigningEsrpClientId)'
152-
esrpConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
153-
signPath: '$(ob_outputDirectory)/bindings/macOS'
154-
155-
- template: /OneBranchPipelines/steps/compound-esrp-code-signing-step.yml@self
156-
parameters:
157-
appRegistrationClientId: '$(SigningAppRegistrationClientId)'
158-
appRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
159-
artifactType: 'whl'
160-
authAkvName: '$(SigningAuthAkvName)'
161-
authSignCertName: '$(SigningAuthSignCertName)'
162-
esrpClientId: '$(SigningEsrpClientId)'
163-
esrpConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
164-
signPath: '$(ob_outputDirectory)/wheels'
144+
- task: EsrpMalwareScanning@5
145+
displayName: 'ESRP MalwareScanning - Python Wheels'
146+
inputs:
147+
ConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
148+
AppRegistrationClientId: '$(SigningAppRegistrationClientId)'
149+
AppRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
150+
EsrpClientId: '$(SigningEsrpClientId)'
151+
UseMSIAuthentication: true
152+
FolderPath: '$(ob_outputDirectory)/wheels'
153+
Pattern: '*.whl'
154+
CleanupTempStorage: 1
155+
VerboseLogin: 1
156+
157+
# OneBranch Code Signing (Official builds only)
158+
# Note: We only sign wheels on all platforms (Windows, macOS, Linux). The wheel signature cryptographically
159+
# verifies the entire archive contents, making individual binary signing unnecessary. Additionally,
160+
# macOS .so/.dylib files use Mach-O format which cannot be signed with Windows SignTool.
161+
#
162+
# References:
163+
# - https://eng.ms/docs/products/onebranch/signing/containerbuildsigning#signing-using-onebranchpipelinesigning-ado-task
164+
# (specifies not to use raw ESRP task for common certificates)
165+
# - https://eng.ms/docs/products/onebranch/signing/containerbuildsigning/availablesigningcpcodesandoperations
166+
# (key code usage - .whl files not explicitly listed, treated as binary archives)
167+
- ${{ if and(eq(parameters.signingEnabled, true), eq(parameters.oneBranchType, 'Official')) }}:
168+
- task: onebranch.pipeline.signing@1
169+
displayName: 'Sign Python Wheels'
170+
inputs:
171+
command: 'sign'
172+
signing_profile: 'external_distribution'
173+
files_to_sign: '**/*.whl'
174+
search_root: '$(ob_outputDirectory)/wheels'

‎OneBranchPipelines/stages/build-windows-single-stage.yml‎

Lines changed: 33 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -178,35 +178,45 @@ stages:
178178
artifact: 'drop_${{ parameters.stageName }}_${{ parameters.jobName }}'
179179
publishLocation: 'pipeline'
180180

181-
# Malware scanning
181+
# General malware scanning (Component Governance + OneBranch AntiMalware)
182182
- template: /OneBranchPipelines/steps/malware-scanning-step.yml@self
183183
parameters:
184184
scanPath: '$(ob_outputDirectory)'
185185
artifactType: 'dll'
186186

187-
# ESRP Code Signing for DLLs (only for Official builds)
187+
# ESRP Malware scanning (Official builds only)
188188
- ${{ if and(eq(parameters.signingEnabled, true), eq(parameters.oneBranchType, 'Official')) }}:
189-
- template: /OneBranchPipelines/steps/compound-esrp-code-signing-step.yml@self
190-
parameters:
191-
appRegistrationClientId: '$(SigningAppRegistrationClientId)'
192-
appRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
193-
artifactType: 'dll'
194-
authAkvName: '$(SigningAuthAkvName)'
195-
authSignCertName: '$(SigningAuthSignCertName)'
196-
esrpClientId: '$(SigningEsrpClientId)'
197-
esrpConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
198-
signPath: '$(ob_outputDirectory)\bindings\windows'
199-
200-
- template: /OneBranchPipelines/steps/compound-esrp-code-signing-step.yml@self
201-
parameters:
202-
appRegistrationClientId: '$(SigningAppRegistrationClientId)'
203-
appRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
204-
artifactType: 'whl'
205-
authAkvName: '$(SigningAuthAkvName)'
206-
authSignCertName: '$(SigningAuthSignCertName)'
207-
esrpClientId: '$(SigningEsrpClientId)'
208-
esrpConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
209-
signPath: '$(ob_outputDirectory)\wheels'
189+
- task: EsrpMalwareScanning@5
190+
displayName: 'ESRP MalwareScanning - Python Wheels'
191+
inputs:
192+
ConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
193+
AppRegistrationClientId: '$(SigningAppRegistrationClientId)'
194+
AppRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
195+
EsrpClientId: '$(SigningEsrpClientId)'
196+
UseMSIAuthentication: true
197+
FolderPath: '$(ob_outputDirectory)/wheels'
198+
Pattern: '*.whl'
199+
CleanupTempStorage: 1
200+
VerboseLogin: 1
201+
202+
# OneBranch Code Signing (Official builds only)
203+
# Note: We only sign wheels on all platforms (Windows, macOS, Linux). The wheel signature cryptographically
204+
# verifies the entire archive contents, making individual binary signing unnecessary. This approach is
205+
# correct for PyPI distribution where only wheel signatures are validated.
206+
#
207+
# References:
208+
# - https://eng.ms/docs/products/onebranch/signing/containerbuildsigning#signing-using-onebranchpipelinesigning-ado-task
209+
# (specifies not to use raw ESRP task for common certificates)
210+
# - https://eng.ms/docs/products/onebranch/signing/containerbuildsigning/availablesigningcpcodesandoperations
211+
# (key code usage - .whl files not explicitly listed, treated as binary archives)
212+
- ${{ if and(eq(parameters.signingEnabled, true), eq(parameters.oneBranchType, 'Official')) }}:
213+
- task: onebranch.pipeline.signing@1
214+
displayName: 'Sign Python Wheels'
215+
inputs:
216+
command: 'sign'
217+
signing_profile: 'external_distribution'
218+
files_to_sign: '**/*.whl'
219+
search_root: '$(ob_outputDirectory)/wheels'
210220

211221
# Publish symbols (Windows only)
212222
- ${{ if eq(parameters.oneBranchType, 'Official') }}:

0 commit comments

Comments
 (0)