Configure MicroBuild to sign NuGet.Jobs #590
Conversation
NuGet.Jobs.sln
Outdated
| @@ -1,7 +1,7 @@ | |||
| | |||
| Microsoft Visual Studio Solution File, Format Version 12.00 | |||
| # Visual Studio 15 | |||
| VisualStudioVersion = 15.0.27121.1 | |||
| # Visual Studio Version 16 | |||
There was a problem hiding this comment.
What if I am using dev15 😓 ?
There was a problem hiding this comment.
Wasn't aware of exactly what this did...will revert.
| <Import Project="..\..\build\sign.targets" Condition="Exists('..\..\build\sign.targets')" /> | ||
| <Import Project="$(SignPath)\sign.microbuild.targets" Condition="Exists('$(SignPath)\sign.microbuild.targets')" /> | ||
| <ItemGroup> | ||
| <PowerShellScriptsToSign Include="InstallAzCopy.ps1"/> |
| @@ -0,0 +1,4 @@ | |||
| # This file is a placeholder--it does nothing. | |||
| # "sign.scripts.targets", which is imported by the project from ServerCommon, requires that "nssm.exe", "Functions.ps1", "PreDeploy.ps1", and "PostDeploy.ps1" all exist. | |||
There was a problem hiding this comment.
Let's find a way to make this place-holder file unnecessary. Perhaps a no-op powershell or an ItemGroup Remove="..."
| @@ -26,6 +26,7 @@ | |||
| <dependency id="NuGetGallery.Core" version="4.4.4-master-41290" /> | |||
| <dependency id="Serilog" version="2.5.0" /> | |||
| <dependency id="System.Net.Http" version="4.3.3" /> | |||
| <dependency id="MicroBuild.Core" version="0.3.0" /> | |||
There was a problem hiding this comment.
We should check IncludeAssets/PrivateAssets to exclude dev dependencies in the unit test requiring this change.
after addressing comments.
|
This should go into |
|
@joelverhagen - I thought the priority of this was enough to make it a hotfix-level change. I can change to |
|
@scottbommarito, that's a good point. We don't want to block this work and deployments on some issue in |
https://github.com/NuGet/Engineering/issues/1728
sign.thirdparty.targets, a target shared by all projects in the solution, that configures all the third-party assemblies in the project to be signed.MicroBuilddependencies to projects that didn't have them.sign.scripts.targetsto projects that have PowerShell scripts so that it signs them.Validation.Callback.Vcs, which is no longer needed and would have needed to be signed.Note: This doesn't sign
NuGetCDNRedirect, but because it's an App Service we are not required to sign it yet.