Skip to content

Update to latest compliance template #315

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Dec 1, 2020
Merged

Update to latest compliance template #315

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
227 changes: 26 additions & 201 deletions .ci/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,12 @@ pr:
#- master
- development

variables:
- group: ESRP
resources:
repositories:
- repository: ComplianceRepo
type: github
endpoint: ComplianceGHRepo
name: PowerShell/compliance

stages:
- stage: Build
Expand All @@ -22,7 +26,7 @@ stages:
- job: BuildPkg
displayName: Build Package
pool:
vmImage: windows-2019
vmImage: windows-latest

steps:
- powershell: |
Expand Down Expand Up @@ -96,196 +100,14 @@ stages:
$modPath = Join-Path -Path $modulePath -ChildPath PSPackageProject
Write-Verbose -Verbose "Importing PSPackageProject from: $modPath"
Import-Module -Name $modPath -Force

$config = Get-PSPackageProjectConfiguration

# Created files signing directory
$srcPath = "$($config.BuildOutputPath)\$($config.ModuleName)"
$createdSignSrcPath = "$($config.BuildOutputPath)\CreatedFiles"
if (! (Test-Path -Path $createdSignSrcPath)) {
$null = New-Item -Path $createdSignSrcPath -ItemType Directory -Verbose
}
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "PowerShellGet.psd1") -Dest $createdSignSrcPath -Force -Verbose
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "PSModule.psm1") -Dest $createdSignSrcPath -Force -Verbose
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "DscResources") -Dest $createdSignSrcPath -Recurse -Force -Verbose
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "Modules") -Dest $createdSignSrcPath -Recurse -Force -Verbose

$net472Path = Join-Path -Path $createdSignSrcPath -ChildPath "net472"
if (! (Test-Path -Path $net472Path)) {
$null = New-Item -Path $net472Path -ItemType Directory -Verbose
}
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "net472\PowerShellGet.*") -Dest $net472Path -Force -Verbose

$netStandardPath = Join-Path -Path $createdSignSrcPath -ChildPath "netstandard2.0"
if (! (Test-Path -Path $netStandardPath)) {
$null = New-Item -Path $netStandardPath -ItemType Directory -Verbose
}
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "netstandard2.0\PowerShellGet.*") -Dest $netStandardPath -Force -Verbose

$signOutPath = "$($config.SignedOutputPath)\$($config.ModuleName)"
if (! (Test-Path -Path $signOutPath)) {
$null = New-Item -Path $signOutPath -ItemType Directory
}

# Set signing src path variable
$vstsCommandString = "vso[task.setvariable variable=signSrcPath]${createdSignSrcPath}"
Write-Host "sending " + $vstsCommandString
Write-Host "##$vstsCommandString"

$outSignPath = "$($config.SignedOutputPath)\$($config.ModuleName)"
if (! (Test-Path -Path $outSignPath)) {
$null = New-Item -Path $outSignPath -ItemType Directory -Verbose
}

# Set signing out path variable
$vstsCommandString = "vso[task.setvariable variable=signOutPath]${outSignPath}"
Write-Host "sending " + $vstsCommandString
Write-Host "##$vstsCommandString"
displayName: Set up for module created files code signing
condition: and(and(succeeded(), eq(variables['Build.Reason'], 'Manual')), ne(variables['SkipSigning'], 'True'))

- template: ./templates/sign.yml
parameters:
buildOutputPath: $(signSrcPath)
signOutputPath: $(signOutPath)
certificateId: "CP-230012"
pattern: '*.dll,*.psd1,*.psm1,*.ps1xml,*.mof'

- pwsh: |
$modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
$env:PSModulePath = $modulePath + [System.IO.Path]::PathSeparator + $env:PSModulePath
$modPath = Join-Path -Path $modulePath -ChildPath PSPackageProject
Write-Verbose -Verbose "Importing PSPackageProject from: $modPath"
Import-Module -Name $modPath -Force

$config = Get-PSPackageProjectConfiguration

$signOutPath = "$($config.SignedOutputPath)\$($config.ModuleName)"
if (! (Test-Path -Path $signOutPath)) {
$null = New-Item -Path $signOutPath -ItemType Directory
}

# Third party files signing directory
$srcPath = "$($config.BuildOutputPath)\$($config.ModuleName)"
$thirdPartySignSrcPath = "$($config.BuildOutputPath)\ThirdParty"
if (! (Test-Path -Path $thirdPartySignSrcPath)) {
$null = New-Item -Path $thirdPartySignSrcPath -ItemType Directory -Verbose
}

# Net472 directory
$net472Path = Join-Path -Path $thirdPartySignSrcPath -ChildPath "net472"
if (! (Test-Path -Path $net472Path)) {
$null = New-Item -Path $net472Path -ItemType Directory -Verbose
}
Get-ChildItem -Path (Join-Path -Path $srcPath -ChildPath "net472") -Filter '*.dll' | Foreach-Object {
if ($_.Name -ne 'PowerShellGet.dll') {
$sig = Get-AuthenticodeSignature -FilePath $_.FullName
if ($sig.Status -ne 'Valid' -or $sig.SignerCertificate.Subject -notlike '*Microsoft*' -or $sig.SignerCertificate.Issuer -notlike '*Microsoft Code Signing PCA*') {
# Copy for third party signing
Copy-Item -Path $_.FullName -Dest $net472Path -Force -Verbose
}
}
}

# NetStandard directory
$netStandardPath = Join-Path -Path $thirdPartySignSrcPath -ChildPath "netstandard2.0"
if (! (Test-Path -Path $netStandardPath)) {
$null = New-Item -Path $netStandardPath -ItemType Directory -Verbose
}
Get-ChildItem -Path (Join-Path -Path $srcPath -ChildPath "netstandard2.0") -Filter '*.dll' | Foreach-Object {
if ($_.Name -ne 'PowerShellGet.dll') {
$sig = Get-AuthenticodeSignature -FilePath $_.FullName
if ($sig.Status -ne 'Valid' -or $sig.SignerCertificate.Subject -notlike '*Microsoft*' -or $sig.SignerCertificate.Issuer -notlike '*Microsoft Code Signing PCA*') {
# Copy for third party signing
Copy-Item -Path $_.FullName -Dest $netStandardPath -Force -Verbose
}
}
}

# Set signing src path variable
$vstsCommandString = "vso[task.setvariable variable=signSrcPath]${thirdPartySignSrcPath}"
Write-Host "sending " + $vstsCommandString
Write-Host "##$vstsCommandString"

# Set signing out path variable
$vstsCommandString = "vso[task.setvariable variable=signOutPath]${signOutPath}"
Write-Host "sending " + $vstsCommandString
Write-Host "##$vstsCommandString"
displayName: Set up for module third party files code signing
condition: and(and(succeeded(), eq(variables['Build.Reason'], 'Manual')), ne(variables['SkipSigning'], 'True'))

- template: ./templates/sign.yml
parameters:
buildOutputPath: $(signSrcPath)
signOutputPath: $(signOutPath)
certificateId: "CP-231522"
pattern: '*.dll'

- pwsh: |
$modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
$env:PSModulePath = $modulePath + [System.IO.Path]::PathSeparator + $env:PSModulePath
$modPath = Join-Path -Path $modulePath -ChildPath PSPackageProject
Write-Verbose -Verbose "Importing PSPackageProject from: $modPath"
Import-Module -Name $modPath -Force

$config = Get-PSPackageProjectConfiguration

$srcPath = "$($config.BuildOutputPath)\$($config.ModuleName)"
$signOutPath = "$($config.SignedOutputPath)\$($config.ModuleName)"
if (! (Test-Path -Path $signOutPath)) {
$null = New-Item -Path $signOutPath -ItemType Directory
}

# en-US
Copy-Item -Path (Join-Path -Path $srcPath -ChildPath "en-US") -Dest $signOutPath -Recurse

# Net472 directory
$net472SignedOutPath = Join-Path -Path $signOutPath -ChildPath "net472"
if (! (Test-Path -Path $net472SignedOutPath)) {
$null = New-Item -Path $net472SignedOutPath -ItemType Directory -Verbose
}
Get-ChildItem -Path (Join-Path -Path $srcPath -ChildPath "net472") -Filter '*.dll' | Foreach-Object {
if ($_.Name -ne 'PowerShellGet.dll') {
$sig = Get-AuthenticodeSignature -FilePath $_.FullName
if ($sig.Status -eq 'Valid' -and ($sig.SignerCertificate.Subject -like '*Microsoft*' -and $sig.SignerCertificate.Issuer -like '*Microsoft Code Signing PCA*')) {
# Copy already signed files directly to output
Copy-Item -Path $_.FullName -Dest $net472SignedOutPath -Force -Verbose
}
}
}

# NetStandard directory
$netStandardSignedOutPath = Join-Path -Path $signOutPath -ChildPath "netstandard2.0"
if (! (Test-Path -Path $netStandardSignedOutPath)) {
$null = New-Item -Path $netStandardSignedOutPath -ItemType Directory -Verbose
}
Get-ChildItem -Path (Join-Path -Path $srcPath -ChildPath "netstandard2.0") -Filter '*.dll' | Foreach-Object {
if ($_.Name -ne 'PowerShellGet.dll') {
$sig = Get-AuthenticodeSignature -FilePath $_.FullName
if ($sig.Status -eq 'Valid' -and ($sig.SignerCertificate.Subject -like '*Microsoft*' -and $sig.SignerCertificate.Issuer -like '*Microsoft Code Signing PCA*')) {
# Copy already signed files directly to output
Copy-Item -Path $_.FullName -Dest $netStandardSignedOutPath -Force -Verbose
}
}
}
displayName: Copy already properly signed third party files
condition: and(and(succeeded(), eq(variables['Build.Reason'], 'Manual')), ne(variables['SkipSigning'], 'True'))

- pwsh: |
$modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
$env:PSModulePath = $modulePath + [System.IO.Path]::PathSeparator + $env:PSModulePath
$modPath = Join-Path -Path $modulePath -ChildPath PSPackageProject
Write-Verbose -Verbose "Importing PSPackageProject from: $modPath"
Import-Module -Name $modPath -Force
#
if ($env:SkipSigning -eq 'True')
{
$(Build.SourcesDirectory)/build.ps1 -Publish
}
else
{
$(Build.SourcesDirectory)/build.ps1 -Publish -Signed
}
$srcModulePath = Resolve-Path -Path "$($config.BuildOutputPath)/$($config.ModuleName)"
Get-ChildItem $srcModulePath
$artifactName = "$($config.ModuleName)"
Write-Host "##vso[artifact.upload containerfolder=$artifactName;artifactname=$artifactName;]$srcModulePath"
#
$(Build.SourcesDirectory)/build.ps1 -Publish
displayName: Create module artifact

- stage: Compliance
Expand All @@ -294,9 +116,18 @@ stages:
jobs:
- job: ComplianceJob
pool:
vmImage: windows-2019
vmImage: windows-latest
steps:
- template: compliance.yml
- checkout: self
clean: true
- checkout: ComplianceRepo
clean: true
- download: current
artifact: 'PowerShellGet'
- template: ci-compliance.yml@ComplianceRepo
parameters:
# credscan
suppressionsFile: ''

- stage: Test
displayName: Test Package
Expand All @@ -306,13 +137,13 @@ stages:
parameters:
jobName: TestPkgWin
displayName: PowerShell Core on Windows
imageName: windows-2019
imageName: windows-latest

- template: test.yml
parameters:
jobName: TestPkgWinPS
displayName: Windows PowerShell on Windows
imageName: windows-2019
imageName: windows-latest
powershellExecutable: powershell

# - template: test.yml
Expand All @@ -326,9 +157,3 @@ stages:
# jobName: TestPkgWinMacOS
# displayName: PowerShell Core on macOS
# imageName: macOS-10.14

- stage: Release
displayName: Release Package
condition: and(and(succeeded(), eq(variables['Build.Reason'], 'Manual')), eq(variables['Publish'], 'True'))
jobs:
- template: release.yml
105 changes: 0 additions & 105 deletions .ci/compliance.yml
View file
Open in desktop

This file was deleted.

Loading