@@ -4,8 +4,16 @@ parameters:
4
4
# Enable install tasks for MicroBuild on Mac and Linux
5
5
# Will be ignored if 'enableMicrobuild' is false or 'Agent.Os' is 'Windows_NT'
6
6
enableMicrobuildForMacAndLinux : false
7
+ # Determines whether the ESRP service connection information should be passed to the signing plugin.
8
+ # This overlaps with _SignType to some degree. We only need the service connection for real signing.
9
+ # It's important that the service connection not be passed to the MicroBuildSigningPlugin task in this place.
10
+ # Doing so will cause the service connection to be authorized for the pipeline, which isn't allowed and won't work for non-prod.
11
+ # Unfortunately, _SignType can't be used to exclude the use of the service connection in non-real sign scenarios. The
12
+ # variable is not available in template expression. _SignType has a very large proliferation across .NET, so replacing it is tough.
13
+ microbuildUseESRP : true
7
14
# Location of the MicroBuild output folder
8
15
microBuildOutputFolder : ' $(Build.SourcesDirectory)'
16
+
9
17
continueOnError : false
10
18
11
19
steps :
@@ -21,19 +29,37 @@ steps:
21
29
workingDirectory : ${{ parameters.microBuildOutputFolder }}
22
30
condition : and(succeeded(), ne(variables['Agent.Os'], 'Windows_NT'))
23
31
32
+ - script : |
33
+ REM Check if ESRP is disabled while SignType is real
34
+ if /I "${{ parameters.microbuildUseESRP }}"=="false" if /I "$(_SignType)"=="real" (
35
+ echo Error: ESRP must be enabled when SignType is real.
36
+ exit /b 1
37
+ )
38
+ displayName: 'Validate ESRP usage (Windows)'
39
+ condition: and(succeeded(), eq(variables['Agent.Os'], 'Windows_NT'))
40
+ - script : |
41
+ # Check if ESRP is disabled while SignType is real
42
+ if [ "${{ parameters.microbuildUseESRP }}" = "false" ] && [ "$(_SignType)" = "real" ]; then
43
+ echo "Error: ESRP must be enabled when SignType is real."
44
+ exit 1
45
+ fi
46
+ displayName: 'Validate ESRP usage (Non-Windows)'
47
+ condition: and(succeeded(), ne(variables['Agent.Os'], 'Windows_NT'))
48
+
24
49
- task : MicroBuildSigningPlugin@4
25
50
displayName : Install MicroBuild plugin
26
51
inputs :
27
52
signType : $(_SignType)
28
53
zipSources : false
29
54
feedSource : https://dnceng.pkgs.visualstudio.com/_packaging/MicroBuildToolset/nuget/v3/index.json
30
- ${{ if and(eq(parameters.enableMicrobuildForMacAndLinux, 'true'), ne(variables['Agent.Os'], 'Windows_NT')) }} :
31
- azureSubscription : ' MicroBuild Signing Task (DevDiv)'
32
- useEsrpCli : true
33
- ${{ elseif eq(variables['System.TeamProject'], 'DevDiv') }} :
34
- ConnectedPMEServiceName : 6cc74545-d7b9-4050-9dfa-ebefcc8961ea
35
- ${{ else }} :
36
- ConnectedPMEServiceName : 248d384a-b39b-46e3-8ad5-c2c210d5e7ca
55
+ ${{ if eq(parameters.microbuildUseESRP, true) }} :
56
+ ${{ if eq(parameters.enableMicrobuildForMacAndLinux, 'true') }} :
57
+ azureSubscription : ' MicroBuild Signing Task (DevDiv)'
58
+ useEsrpCli : true
59
+ ${{ elseif eq(variables['System.TeamProject'], 'DevDiv') }} :
60
+ ConnectedPMEServiceName : 6cc74545-d7b9-4050-9dfa-ebefcc8961ea
61
+ ${{ else }} :
62
+ ConnectedPMEServiceName : 248d384a-b39b-46e3-8ad5-c2c210d5e7ca
37
63
env :
38
64
TeamName : $(_TeamName)
39
65
MicroBuildOutputFolderOverride : ${{ parameters.microBuildOutputFolder }}
0 commit comments