Skip to content

Commit b217961

Browse files
zoobazooba
authored
Streamline signing variables in Windows release build (#294)
Always passes the signing certificate as a template parameter and never as a variable. Also cleans up the other queue time variables we have and updates the list in the main file.
1 parent 17c36be commit b217961

11 files changed

+74
-63
lines changed

‎windows-release/azure-pipelines.yml‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -140,8 +140,14 @@ variables:
140140
SigningDescription: ${{ parameters.SigningDescription }}
141141
PublishARM64: ${{ parameters.DoARM64 }}
142142
# QUEUE TIME VARIABLES
143-
# PyDotOrgUsername: ''
144-
# PyDotOrgServer: ''
143+
# OverrideNugetVersion: ''
144+
# PyManagerIndexFilename: ''
145+
# SkipNugetPublish: ''
146+
# SkipPipTests: ''
147+
# SkipPythonOrgPublish: ''
148+
# SkipSBOM: ''
149+
# SkipTests: ''
150+
# SkipTkTests: ''
145151

146152
trigger: none
147153
pr: none
@@ -193,61 +199,67 @@ stages:
193199
parameters:
194200
BuildToPackage: ${{ parameters.BuildToPackage }}
195201
DoFreethreaded: ${{ parameters.DoFreethreaded }}
202+
SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
196203
- template: stage-layout-symbols.yml
197204
parameters:
198205
BuildToPackage: ${{ parameters.BuildToPackage }}
199206
DoFreethreaded: ${{ parameters.DoFreethreaded }}
207+
SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
200208
- ${{ if eq(parameters.DoEmbed, 'true') }}:
201209
- template: stage-layout-embed.yml
202210
parameters:
203211
BuildToPackage: ${{ parameters.BuildToPackage }}
212+
SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
204213
- ${{ if eq(parameters.DoNuget, 'true') }}:
205214
- template: stage-layout-nuget.yml
206215
parameters:
207216
BuildToPackage: ${{ parameters.BuildToPackage }}
208217
DoFreethreaded: ${{ parameters.DoFreethreaded }}
218+
SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
209219
- ${{ if eq(parameters.DoMSIX, 'true') }}:
210220
- template: stage-layout-msix.yml
211221
parameters:
212222
BuildToPackage: ${{ parameters.BuildToPackage }}
223+
SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
213224
- ${{ if eq(parameters.DoPyManager, 'true') }}:
214225
- template: stage-layout-pymanager.yml
215226
parameters:
216227
BuildToPackage: ${{ parameters.BuildToPackage }}
217228
DoFreethreaded: ${{ parameters.DoFreethreaded }}
218229
DoEmbed: ${{ parameters.DoEmbed }}
230+
SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
219231

220232
- stage: Pack
221233
dependsOn: Layout
222234
displayName: Pack
223235
jobs:
224236
#- ${{ if eq(parameters.DoEmbed, 'true') }}:
225237
# - template: stage-pack-embed.yml
238+
# parameters:
239+
# SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
226240
- ${{ if eq(parameters.DoMSI, 'true') }}:
227241
- template: stage-msi.yml
228242
parameters:
229243
BuildToPackage: ${{ parameters.BuildToPackage }}
230244
DoARM64: ${{ parameters.DoARM64}}
231245
DoFreethreaded: ${{ parameters.DoFreethreaded }}
232-
${{ if and(parameters.SigningCertificate, ne(parameters.SigningCertificate, 'Unsigned')) }}:
233-
SigningCertificate: ${{ parameters.SigningCertificate }}
246+
SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
234247
- ${{ if eq(parameters.DoMSIX, 'true') }}:
235248
- template: stage-pack-msix.yml
236249
parameters:
237-
${{ if and(parameters.SigningCertificate, ne(parameters.SigningCertificate, 'Unsigned')) }}:
238-
SigningCertificate: ${{ parameters.SigningCertificate }}
250+
SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
239251
- ${{ if eq(parameters.DoNuget, 'true') }}:
240252
- template: stage-pack-nuget.yml
241253
parameters:
242254
${{ if eq(parameters.SignNuget, 'true') }}:
243-
${{ if and(parameters.SigningCertificate, ne(parameters.SigningCertificate, 'Unsigned')) }}:
244-
SigningCertificate: ${{ parameters.SigningCertificate }}
255+
SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
245256
DoFreethreaded: ${{ parameters.DoFreethreaded }}
246257
- ${{ if eq(parameters.DoPyManager, 'true') }}:
247258
- template: stage-pack-pymanager.yml
248259
parameters:
249260
DoFreethreaded: ${{ parameters.DoFreethreaded }}
250261
DoEmbed: ${{ parameters.DoEmbed }}
262+
SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
251263

252264
- stage: Test
253265
dependsOn: Pack

‎windows-release/stage-layout-embed.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
parameters:
22
BuildToPackage: current
3+
SigningCertificate: ''
34

45
jobs:
56
- job: Make_Embed_Layout

‎windows-release/stage-layout-full.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
parameters:
22
BuildToPackage: current
33
DoFreethreaded: false
4+
SigningCertificate: ''
45

56
jobs:
67
- job: Make_Layouts
@@ -131,10 +132,10 @@ jobs:
131132
displayName: 'Update TCL_LIBRARY'
132133
condition: and(succeeded(), variables['TclLibrary'])
133134
134-
- powershell: |
135-
copy "$(Pipeline.Workspace)\bin_$(Name)\Activate.ps1" Lib\venv\scripts\common\Activate.ps1 -Force
136-
displayName: 'Copy signed files into sources'
137-
condition: and(succeeded(), variables['SigningCertificate'])
135+
- ${{ if parameters.SigningCertificate }}:
136+
- powershell: |
137+
copy "$(Pipeline.Workspace)\bin_$(Name)\Activate.ps1" Lib\venv\scripts\common\Activate.ps1 -Force
138+
displayName: 'Copy signed files into sources'
138139
139140
- template: ./layout-command.yml
140141
parameters:

‎windows-release/stage-layout-msix.yml‎

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
parameters:
22
BuildToPackage: current
3+
SigningCertificate: ''
34

45
jobs:
56
- job: Make_MSIX_Layout
@@ -69,25 +70,24 @@ jobs:
6970
displayName: 'Update TCL_LIBRARY'
7071
condition: and(succeeded(), variables['TclLibrary'])
7172
72-
- task: DownloadPipelineArtifact@2
73-
displayName: 'Download artifact: cert'
74-
condition: and(succeeded(), variables['SigningCertificate'])
75-
inputs:
76-
${{ if eq(parameters.BuildToPackage, 'current') }}:
77-
buildType: current
78-
${{ else }}:
79-
buildType: specific
80-
buildVersionToDownload: specific
81-
project: $(resources.pipeline.build_to_package.projectId)
82-
pipeline: $(resources.pipeline.build_to_package.pipelineId)
83-
runId: $(resources.pipeline.build_to_package.runID)
84-
artifact: cert
85-
targetPath: $(Pipeline.Workspace)\cert
86-
87-
- powershell: |
88-
copy "$(Pipeline.Workspace)\bin_$(Name)\Activate.ps1" Lib\venv\scripts\common\Activate.ps1 -Force
89-
displayName: 'Copy signed files into sources'
90-
condition: and(succeeded(), variables['SigningCertificate'])
73+
- ${{ if parameters.SigningCertificate }}:
74+
- task: DownloadPipelineArtifact@2
75+
displayName: 'Download artifact: cert'
76+
inputs:
77+
${{ if eq(parameters.BuildToPackage, 'current') }}:
78+
buildType: current
79+
${{ else }}:
80+
buildType: specific
81+
buildVersionToDownload: specific
82+
project: $(resources.pipeline.build_to_package.projectId)
83+
pipeline: $(resources.pipeline.build_to_package.pipelineId)
84+
runId: $(resources.pipeline.build_to_package.runID)
85+
artifact: cert
86+
targetPath: $(Pipeline.Workspace)\cert
87+
88+
- powershell: |
89+
copy "$(Pipeline.Workspace)\bin_$(Name)\Activate.ps1" Lib\venv\scripts\common\Activate.ps1 -Force
90+
displayName: 'Copy signed files into sources'
9191
9292
- template: ./layout-command.yml
9393
parameters:
@@ -100,14 +100,14 @@ jobs:
100100
env:
101101
TCL_LIBRARY: $(TclLibrary)
102102
103-
# The dotnet sign tool shouldn't need this, but we do because of the sccd file
104-
- powershell: |
105-
$info = (gc "$(Pipeline.Workspace)\cert\certinfo.json" | ConvertFrom-JSON)
106-
Write-Host "Side-loadable APPX must be signed with '$($info.Subject)'"
107-
Write-Host "##vso[task.setvariable variable=APPX_DATA_PUBLISHER]$($info.Subject)"
108-
Write-Host "##vso[task.setvariable variable=APPX_DATA_SHA256]$($info.SHA256)"
109-
displayName: 'Override signing parameters'
110-
condition: and(succeeded(), variables['SigningCertificate'])
103+
- ${{ if parameters.SigningCertificate }}:
104+
# The dotnet sign tool shouldn't need this, but we do because of the sccd file
105+
- powershell: |
106+
$info = (gc "$(Pipeline.Workspace)\cert\certinfo.json" | ConvertFrom-JSON)
107+
Write-Host "Side-loadable APPX must be signed with '$($info.Subject)'"
108+
Write-Host "##vso[task.setvariable variable=APPX_DATA_PUBLISHER]$($info.Subject)"
109+
Write-Host "##vso[task.setvariable variable=APPX_DATA_SHA256]$($info.SHA256)"
110+
displayName: 'Override signing parameters'
111111
112112
- powershell: |
113113
Remove-Item "$(Build.ArtifactStagingDirectory)\appx" -Recurse -Force -EA 0

‎windows-release/stage-layout-nuget.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
parameters:
22
BuildToPackage: current
33
DoFreethreaded: false
4+
SigningCertificate: ''
45

56
jobs:
67
- job: Make_Nuget_Layout
@@ -64,10 +65,10 @@ jobs:
6465
artifact: bin_$(Name)
6566
targetPath: $(Pipeline.Workspace)\bin_$(Name)
6667

67-
- powershell: |
68-
copy $(Pipeline.Workspace)\bin_$(Name)\Activate.ps1 Lib\venv\scripts\common\Activate.ps1 -Force
69-
displayName: 'Copy signed files into sources'
70-
condition: and(succeeded(), variables['SigningCertificate'])
68+
- ${{ if parameters.SigningCertificate }}:
69+
- powershell: |
70+
copy $(Pipeline.Workspace)\bin_$(Name)\Activate.ps1 Lib\venv\scripts\common\Activate.ps1 -Force
71+
displayName: 'Copy signed files into sources'
7172
7273
- template: ./layout-command.yml
7374
parameters:

‎windows-release/stage-layout-pymanager.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ parameters:
33
DoFreethreaded: false
44
DoEmbed: false
55
LayoutScriptBranch: main
6+
SigningCertificate: ''
67

78
jobs:
89
- job: Make_PyManager_Layouts
@@ -175,11 +176,11 @@ jobs:
175176
displayName: 'Update TCL_LIBRARY'
176177
condition: and(succeeded(), variables['TclLibrary'])
177178
178-
- powershell: |
179-
copy "$(Pipeline.Workspace)\bin_$(Name)\Activate.ps1" Lib\venv\scripts\common\Activate.ps1 -Force
180-
displayName: 'Copy signed files into sources'
181-
workingDirectory: $(Build.SourcesDirectory)\cpython
182-
condition: and(succeeded(), variables['SigningCertificate'])
179+
- ${{ if parameters.SigningCertificate }}:
180+
- powershell: |
181+
copy "$(Pipeline.Workspace)\bin_$(Name)\Activate.ps1" Lib\venv\scripts\common\Activate.ps1 -Force
182+
displayName: 'Copy signed files into sources'
183+
workingDirectory: $(Build.SourcesDirectory)\cpython
183184
184185
- template: ./layout-command.yml
185186
parameters:

‎windows-release/stage-layout-symbols.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ parameters:
1515
- win32_td
1616
- amd64_td
1717
- arm64_td
18+
SigningCertificate: ''
1819

1920

2021
jobs:

‎windows-release/stage-pack-msix.yml‎

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
Name: amd64
2626
Artifact: appxstore
2727
Suffix: -store
28-
Upload: true
28+
CreateMsixUpload: true
2929
arm64:
3030
Name: arm64
3131
Artifact: appx
@@ -35,7 +35,7 @@ jobs:
3535
Name: arm64
3636
Artifact: appxstore
3737
Suffix: -store
38-
Upload: true
38+
CreateMsixUpload: true
3939

4040
steps:
4141
- template: ./checkout.yml
@@ -70,26 +70,21 @@ jobs:
7070
- powershell: |
7171
7z a -tzip "$(Build.ArtifactStagingDirectory)\msixupload\$(Filename).msixupload" *
7272
displayName: 'Build msixupload'
73-
condition: and(succeeded(), eq(variables['Upload'], 'true'))
73+
condition: and(succeeded(), eq(variables['CreateMsixUpload'], 'true'))
7474
workingDirectory: $(Build.ArtifactStagingDirectory)\msix
7575
7676
- task: PublishBuildArtifacts@1
7777
displayName: 'Publish Artifact: MSIX'
78-
condition: and(succeeded(), or(ne(variables['ShouldSign'], 'true'), not(variables['SigningCertificate'])))
7978
inputs:
8079
PathtoPublish: '$(Build.ArtifactStagingDirectory)\msix'
81-
ArtifactName: msix
82-
83-
- task: PublishBuildArtifacts@1
84-
displayName: 'Publish Artifact: MSIX'
85-
condition: and(succeeded(), eq(variables['ShouldSign'], 'true'), variables['SigningCertificate'])
86-
inputs:
87-
PathtoPublish: '$(Build.ArtifactStagingDirectory)\msix'
88-
ArtifactName: unsigned_msix
80+
${{ if parameters.SigningCertificate }}:
81+
ArtifactName: unsigned_msix
82+
${{ else }}:
83+
ArtifactName: msix
8984

9085
- task: PublishBuildArtifacts@1
9186
displayName: 'Publish Artifact: MSIXUpload'
92-
condition: and(succeeded(), eq(variables['Upload'], 'true'))
87+
condition: and(succeeded(), eq(variables['CreateMsixUpload'], 'true'))
9388
inputs:
9489
PathtoPublish: '$(Build.ArtifactStagingDirectory)\msixupload'
9590
ArtifactName: msixupload

‎windows-release/stage-pack-pymanager.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
parameters:
22
DoFreethreaded: false
33
DoEmbed: false
4+
SigningCertificate: ''
45

56
Artifacts:
67
- name: win32

‎windows-release/stage-test-embed.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
jobs:
22
- job: Test_Embed
33
displayName: Test Embed
4-
condition: and(succeeded(), eq(variables['DoEmbed'], 'true'))
54

65
pool:
76
vmImage: windows-2022

0 commit comments

Comments
 (0)