EsrpSign.yml

parameters:
  - name: "buildOutputPath"
    default: "$(Build.ArtifactStagingDirectory)\\build"
  - name: "signOutputPath"
    default: "$(Build.ArtifactStagingDirectory)\\signed"
  - name: "certificateId"
    default: "CP-230012"
  - name: "pattern"
    default: "*.dll,*.exe"
  - name: "useMinimatch"
    type: boolean
    default: false
  - name: "signingService"
    default: "pwshSigning"
  - name: "shouldSign"
    default: "auto"
  - name: OutputMode
    type: string
    default: Default
    values:
      - Default
      - AlwaysCopy
      - NeverCopy
      - CopyIfSigned
  - name: "alwaysCopy"
    type: boolean
    default: False
  - name: "useCustomEsrpJson"
    type: boolean
    default: false
  - name: "verifySignature"
    type: boolean
    default: false
  - name: "pageHash"
    type: boolean
    default: true
  - name: "displayName"
    default: "ESRP Signing"

steps:
- task: UseDotNet@2
  displayName: '${{ parameters.displayName }} - Install .NET Core sdk 2.x'
  inputs:
    version: 3.x

- pwsh: |
    Write-Verbose -Verbose "buildOutputPath = '${{ parameters.buildOutputPath }}'"
    Write-Verbose -Verbose "signOutputPath = '${{ parameters.signOutputPath }}'"
    Write-Verbose -Verbose "certificateId = '${{ parameters.certificateId }}'"
    Write-Verbose -Verbose "pattern = '${{ parameters.pattern }}'"
    Write-Verbose -Verbose "useMinimatch = '${{ parameters.useMinimatch }}'"
    Write-Verbose -Verbose "signingService = '${{ parameters.signingService }}'"
    Write-Verbose -Verbose "shouldSign = '${{ parameters.shouldSign }}'"
    Write-Verbose -Verbose "alwaysCopy = '${{ parameters.alwaysCopy }}'"
    Write-Verbose -Verbose "outputMode = '${env:OUTPUT_MODE}'"
    Write-Verbose -Verbose "useCustomEsrpJson = '${{ parameters.useCustomEsrpJson }}'"
    Write-Verbose -Verbose "verifySignature = '${{ parameters.verifySignature }}'"
    Write-Verbose -Verbose "pageHash = '${{ parameters.pageHash }}'"

    if (('${{ parameters.useCustomEsrpJson }}' -ne 'false') -and ('${{ parameters.certificateId }}' -ne ''))
    {
      throw "Only one of useCustomEsrpJson and certificateId must be set!"
    }

    $certId = '${{ parameters.certificateId }}'

    $vstsCommandString = "vso[task.setvariable variable=ESRP_TEMPLATE_CERT_ID]$certId"
    Write-Verbose -Message ("sending " + $vstsCommandString) -Verbose
    Write-Host "##$vstsCommandString"

    [string] $VariableName = "EsrpJson"
    $vstsCommandString = "vso[task.setvariable variable=$VariableName][]"
    Write-Verbose -Message ("sending " + $vstsCommandString) -Verbose
    Write-Host "##$vstsCommandString"

    $usePgp = $certId -like '*pgp'
    $vstsCommandString = "vso[task.setvariable variable=ESRP_TEMPLATE_USE_PGP]$usePgp"
    Write-Verbose -Message ("sending " + $vstsCommandString) -Verbose
    Write-Host "##$vstsCommandString"

    if($env:ALWAYS_COPY -ne 'False') {
      Write-Warning "AlwaysCopy is replaced by OutputMode!"
    }

    if($env:OUTPUT_MODE -ne 'Default' -and $env:ALWAYS_COPY -ne 'False' ) {
      throw "Only one of OutputMode and AlwaysCopy can be set!"
    } elseif ($env:ALWAYS_COPY -ne 'False') {
      $effectiveOutputMode = 'AlwaysCopy'
    } elseif ($env:OUTPUT_MODE -ne 'Default') {
      $effectiveOutputMode = $env:OUTPUT_MODE
    } else {
      # Default
      $effectiveOutputMode = 'CopyIfSigned'
    }

    $vstsCommandString = "vso[task.setvariable variable=ESRP_TEMPLATE_COPY_MODE]$effectiveOutputMode"
    Write-Verbose -Message ("sending " + $vstsCommandString) -Verbose
    Write-Host "##$vstsCommandString"
  displayName: ${{ parameters.displayName }} - Log parameters
  env:
    ALWAYS_COPY: ${{ parameters.alwaysCopy }}
    OUTPUT_MODE: ${{ parameters.OutputMode }}

- pwsh: |
    if ('${{ parameters.shouldSign }}' -eq 'auto') {
      Write-Verbose -Verbose -Message 'calculating shouldsign'
      $shouldSign = $env:BUILD_REASON -eq 'Manual' -and $env:SKIPSIGNING -ne 'True' -and $env:SIGNINGSERVER -ne ''
    }
    elseif ('${{ parameters.shouldSign }}' -eq 'false') {
      $shouldSign = $false
    }
    else {
      $shouldSign = $true
    }
    $vstsCommandString = "vso[task.setvariable variable=ESRP_TEMPLATE_SHOULD_SIGN]$shouldSign"
    Write-Verbose -Message ("sending " + $vstsCommandString) -Verbose
    Write-Host "##$vstsCommandString"
  displayName: ${{ parameters.displayName }} - Set ESRP_TEMPLATE_SHOULD_SIGN

- template: template-compliance/authenticode-sign.yml
  parameters:
    buildOutputPath: ${{ parameters.buildOutputPath }}
    signOutputPath: ${{ parameters.signOutputPath }}
    pattern: ${{ parameters.pattern }}
    certificateId: ${{ parameters.certificateId }}
    verifySignature: ${{ parameters.verifySignature }}
    pageHash: ${{ parameters.pageHash }}
    displayName: ${{ parameters.displayName }}

- template: template-compliance/nuget-sign.yml
  parameters:
    buildOutputPath: ${{ parameters.buildOutputPath }}
    signOutputPath: ${{ parameters.signOutputPath }}
    pattern: ${{ parameters.pattern }}
    certificateId: ${{ parameters.certificateId }}
    verifySignature: ${{ parameters.verifySignature }}
    displayName: ${{ parameters.displayName }}

- template: template-compliance/pgp-sign.yml
  parameters:
    signOutputPath: ${{ parameters.signOutputPath }}
    pattern: ${{ parameters.pattern }}
    certificateId: ${{ parameters.certificateId }}
    displayName: ${{ parameters.displayName }}

- template: template-compliance/macOS-sign.yml
  parameters:
    signOutputPath: ${{ parameters.signOutputPath }}
    pattern: ${{ parameters.pattern }}
    certificateId: ${{ parameters.certificateId }}
    displayName: ${{ parameters.displayName }}

- template: template-compliance/strongname-sign.yml
  parameters:
    signOutputPath: ${{ parameters.signOutputPath }}
    pattern: ${{ parameters.pattern }}
    certificateId: ${{ parameters.certificateId }}
    displayName: ${{ parameters.displayName }}

- ${{ if eq(parameters.useCustomEsrpJson, 'true') }}:
  - template: template-compliance/custom-sign.yml
    parameters:
      signOutputPath: ${{ parameters.signOutputPath }}
      displayName: ${{ parameters.displayName }}

- pwsh: |
    if(${env:EsrpJson} -eq '[]') {
      throw "No Json generated, exiting!  Update template to support ${{ parameters.certificateId }}"
    }
    Write-Verbose -Verbose "EsrpJson = '${env:EsrpJson}'"
  displayName: ${{ parameters.displayName }} - Log Json

- pwsh: |
    Write-Verbose "BUILD_OUTPUT_PATH- ${{ parameters.buildOutputPath }}" -Verbose
    Write-Verbose "SIGNED_OUTPUT_PATH- ${{ parameters.signOutputPath }}" -Verbose
    $mode = $env:ESRP_TEMPLATE_COPY_MODE

    if(!(Test-Path '${{ parameters.signOutputPath }}'))
    {
      if($mode -eq 'NeverCopy') {
        throw "Output path does not exist and copy mode is NeverCopy, exiting!"
      }
      Write-Verbose "Creating SIGNED_OUTPUT_PATH- ${{ parameters.signOutputPath }}" -Verbose
      $null = New-Item -Path '${{ parameters.signOutputPath }}' -ItemType Directory -force
    }

    if($mode -eq 'AlwaysCopy' -or ($mode -eq 'CopyIfSigned' -and $env:ESRP_TEMPLATE_SHOULD_SIGN -eq $true)) {
      Write-Verbose "Copying files to SIGNED_OUTPUT_PATH- ${{ parameters.signOutputPath }} because mode is $mode" -Verbose
      Copy-Item -Path ${{ parameters.buildOutputPath }}\* -Dest ${{ parameters.signOutputPath }}\ -Recurse -Force -Verbose
    } else {
      Write-Verbose "Not copying files to SIGNED_OUTPUT_PATH- ${{ parameters.signOutputPath }} because mode is $mode" -Verbose
    }
  displayName: ${{ parameters.displayName }} - Prepare signed output directory
  timeoutInMinutes: 10

- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
  displayName: ${{ parameters.displayName }} - Sign files
  inputs:
    ConnectedServiceName: ${{ parameters.signingService }}
    FolderPath: '${{ parameters.signOutputPath }}'
    signConfigType: inlineSignParams
    inlineOperation: $(EsrpJson)
    Pattern: ${{ parameters.pattern }}
    UseMinimatch: ${{ parameters.useMinimatch }}
  condition: |
    and(succeeded(), eq(variables['ESRP_TEMPLATE_SHOULD_SIGN'], 'True'))
  timeoutInMinutes: 30

- pwsh: |
    $file = Get-ChildItem -Path "${{ parameters.signOutputPath }}\codesignsummary-*.md" -File
    $fileName = $file.Name
    $retryCount = 0
    $maxTries = 5
    while($retryCount -lt $maxTries)
    {
      try {
        Move-Item -Path "${{ parameters.signOutputPath }}\$fileName" -Dest "$(Agent.TempDirectory)\$fileName" -Force -ErrorAction Stop
        Write-Verbose "Moved ${{ parameters.signOutputPath }}\$fileName" -Verbose
        Write-Host "##vso[artifact.upload containerfolder=signingReport;artifactname=signingReport]$(Agent.TempDirectory)\$fileName"
      }
      catch {
        $retryCount++
        if($retryCount -ge $maxTries)
        {
          throw
        }
        Write-Verbose -message "Failed to move ${{ parameters.signOutputPath }}\$fileName, will retry.  The error is:" -Verbose
        Get-Error $_ -ErrorAction Ignore
        Start-Sleep -Seconds ($retryCount * 5)
        continue
      }
      break
    }
  displayName: ${{ parameters.displayName }} - Upload codesign summary
  condition: and(succeeded(), eq(variables['ESRP_TEMPLATE_SHOULD_SIGN'], 'True'))
  timeoutInMinutes: 10