Skip to content

Commit df7b770

Browse files
bewithgauravbewithgaurav
committed
Merged PR 6248: FIX: Commented ESRP CodeSign Task
Related work items: #38066
1 parent 7005bb5 commit df7b770

File tree

4 files changed

+278
-226
lines changed

4 files changed

+278
-226
lines changed

‎OneBranchPipelines/stages/build-linux-single-stage.yml‎

Lines changed: 27 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -212,21 +212,31 @@ stages:
212212
CleanupTempStorage: 1
213213
VerboseLogin: 1
214214

215-
# OneBranch Code Signing (Official builds only)
216-
# Note: We only sign wheels on all platforms (Windows, macOS, Linux). The wheel signature cryptographically
217-
# verifies the entire archive contents, making individual binary signing unnecessary. Additionally,
218-
# Linux .so files use ELF format which cannot be signed with Windows SignTool.
219-
#
220-
# References:
221-
# - https://eng.ms/docs/products/onebranch/signing/containerbuildsigning#signing-using-onebranchpipelinesigning-ado-task
222-
# (specifies not to use raw ESRP task for common certificates)
223-
# - https://eng.ms/docs/products/onebranch/signing/containerbuildsigning/availablesigningcpcodesandoperations
224-
# (key code usage - .whl files not explicitly listed, treated as binary archives)
225-
- ${{ if and(eq(parameters.signingEnabled, true), eq(parameters.oneBranchType, 'Official')) }}:
226-
- task: onebranch.pipeline.signing@1
227-
displayName: 'Sign Python Wheels'
215+
# ESRP Malware scanning (when signing is enabled)
216+
- ${{ if eq(parameters.signingEnabled, true) }}:
217+
- task: EsrpMalwareScanning@5
218+
displayName: 'ESRP MalwareScanning - Python Wheels'
228219
inputs:
229-
command: 'sign'
230-
signing_profile: 'external_distribution'
231-
files_to_sign: '**/*.whl'
232-
search_root: '$(ob_outputDirectory)/wheels'
220+
ConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
221+
AppRegistrationClientId: '$(SigningAppRegistrationClientId)'
222+
AppRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
223+
EsrpClientId: '$(SigningEsrpClientId)'
224+
UseMSIAuthentication: true
225+
FolderPath: '$(ob_outputDirectory)/wheels'
226+
Pattern: '*.whl'
227+
CleanupTempStorage: 1
228+
VerboseLogin: 1
229+
230+
# ESRP Code Signing (DISABLED - wheel files cannot be signed with SignTool)
231+
# See compound-esrp-code-signing-step.yml for detailed explanation of why this doesn't work
232+
# - ${{ if eq(parameters.signingEnabled, true) }}:
233+
# - template: /OneBranchPipelines/steps/compound-esrp-code-signing-step.yml@self
234+
# parameters:
235+
# appRegistrationClientId: '$(SigningAppRegistrationClientId)'
236+
# appRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
237+
# artifactType: 'whl'
238+
# authAkvName: '$(SigningAuthAkvName)'
239+
# authSignCertName: '$(SigningAuthSignCertName)'
240+
# esrpClientId: '$(SigningEsrpClientId)'
241+
# esrpConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
242+
# signPath: '$(ob_outputDirectory)/wheels'

‎OneBranchPipelines/stages/build-macos-single-stage.yml‎

Lines changed: 27 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -154,21 +154,31 @@ stages:
154154
CleanupTempStorage: 1
155155
VerboseLogin: 1
156156

157-
# OneBranch Code Signing (Official builds only)
158-
# Note: We only sign wheels on all platforms (Windows, macOS, Linux). The wheel signature cryptographically
159-
# verifies the entire archive contents, making individual binary signing unnecessary. Additionally,
160-
# macOS .so/.dylib files use Mach-O format which cannot be signed with Windows SignTool.
161-
#
162-
# References:
163-
# - https://eng.ms/docs/products/onebranch/signing/containerbuildsigning#signing-using-onebranchpipelinesigning-ado-task
164-
# (specifies not to use raw ESRP task for common certificates)
165-
# - https://eng.ms/docs/products/onebranch/signing/containerbuildsigning/availablesigningcpcodesandoperations
166-
# (key code usage - .whl files not explicitly listed, treated as binary archives)
167-
- ${{ if and(eq(parameters.signingEnabled, true), eq(parameters.oneBranchType, 'Official')) }}:
168-
- task: onebranch.pipeline.signing@1
169-
displayName: 'Sign Python Wheels'
157+
# ESRP Malware scanning (when signing is enabled)
158+
- ${{ if eq(parameters.signingEnabled, true) }}:
159+
- task: EsrpMalwareScanning@5
160+
displayName: 'ESRP MalwareScanning - Python Wheels'
170161
inputs:
171-
command: 'sign'
172-
signing_profile: 'external_distribution'
173-
files_to_sign: '**/*.whl'
174-
search_root: '$(ob_outputDirectory)/wheels'
162+
ConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
163+
AppRegistrationClientId: '$(SigningAppRegistrationClientId)'
164+
AppRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
165+
EsrpClientId: '$(SigningEsrpClientId)'
166+
UseMSIAuthentication: true
167+
FolderPath: '$(ob_outputDirectory)/wheels'
168+
Pattern: '*.whl'
169+
CleanupTempStorage: 1
170+
VerboseLogin: 1
171+
172+
# ESRP Code Signing (DISABLED - wheel files cannot be signed with SignTool)
173+
# See compound-esrp-code-signing-step.yml for detailed explanation of why this doesn't work
174+
# - ${{ if eq(parameters.signingEnabled, true) }}:
175+
# - template: /OneBranchPipelines/steps/compound-esrp-code-signing-step.yml@self
176+
# parameters:
177+
# appRegistrationClientId: '$(SigningAppRegistrationClientId)'
178+
# appRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
179+
# artifactType: 'whl'
180+
# authAkvName: '$(SigningAuthAkvName)'
181+
# authSignCertName: '$(SigningAuthSignCertName)'
182+
# esrpClientId: '$(SigningEsrpClientId)'
183+
# esrpConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
184+
# signPath: '$(ob_outputDirectory)/wheels'

‎OneBranchPipelines/stages/build-windows-single-stage.yml‎

Lines changed: 15 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -184,8 +184,8 @@ stages:
184184
scanPath: '$(ob_outputDirectory)'
185185
artifactType: 'dll'
186186

187-
# ESRP Malware scanning (Official builds only)
188-
- ${{ if and(eq(parameters.signingEnabled, true), eq(parameters.oneBranchType, 'Official')) }}:
187+
# ESRP Malware scanning (when signing is enabled)
188+
- ${{ if eq(parameters.signingEnabled, true) }}:
189189
- task: EsrpMalwareScanning@5
190190
displayName: 'ESRP MalwareScanning - Python Wheels'
191191
inputs:
@@ -199,24 +199,19 @@ stages:
199199
CleanupTempStorage: 1
200200
VerboseLogin: 1
201201

202-
# OneBranch Code Signing (Official builds only)
203-
# Note: We only sign wheels on all platforms (Windows, macOS, Linux). The wheel signature cryptographically
204-
# verifies the entire archive contents, making individual binary signing unnecessary. This approach is
205-
# correct for PyPI distribution where only wheel signatures are validated.
206-
#
207-
# References:
208-
# - https://eng.ms/docs/products/onebranch/signing/containerbuildsigning#signing-using-onebranchpipelinesigning-ado-task
209-
# (specifies not to use raw ESRP task for common certificates)
210-
# - https://eng.ms/docs/products/onebranch/signing/containerbuildsigning/availablesigningcpcodesandoperations
211-
# (key code usage - .whl files not explicitly listed, treated as binary archives)
212-
- ${{ if and(eq(parameters.signingEnabled, true), eq(parameters.oneBranchType, 'Official')) }}:
213-
- task: onebranch.pipeline.signing@1
214-
displayName: 'Sign Python Wheels'
215-
inputs:
216-
command: 'sign'
217-
signing_profile: 'external_distribution'
218-
files_to_sign: '**/*.whl'
219-
search_root: '$(ob_outputDirectory)/wheels'
202+
# ESRP Code Signing (DISABLED - wheel files cannot be signed with SignTool)
203+
# See compound-esrp-code-signing-step.yml for detailed explanation of why this doesn't work
204+
# - ${{ if eq(parameters.signingEnabled, true) }}:
205+
# - template: /OneBranchPipelines/steps/compound-esrp-code-signing-step.yml@self
206+
# parameters:
207+
# appRegistrationClientId: '$(SigningAppRegistrationClientId)'
208+
# appRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
209+
# artifactType: 'whl'
210+
# authAkvName: '$(SigningAuthAkvName)'
211+
# authSignCertName: '$(SigningAuthSignCertName)'
212+
# esrpClientId: '$(SigningEsrpClientId)'
213+
# esrpConnectedServiceName: '$(SigningEsrpConnectedServiceName)'
214+
# signPath: '$(ob_outputDirectory)\wheels'
220215

221216
# Publish symbols (Windows only)
222217
- ${{ if eq(parameters.oneBranchType, 'Official') }}:

0 commit comments

Comments
 (0)