Add code and package signing (#1895)

Build/Sign-Package.ps1

@@ -0,0 +1,26 @@
+
+$currentDirectory = split-path $MyInvocation.MyCommand.Definition
+
+# See if we have the ClientSecret available
+if([string]::IsNullOrEmpty($Env:SignClientSecret)){
+	Write-Host "Client Secret not found, not signing packages"
+	return;
+}
+
+dotnet tool install --tool-path . SignClient
+
+# Setup Variables we need to pass into the sign client tool
+
+$appSettings = "$currentDirectory\appsettings.json"
+
+$nupkgs = gci $Env:ArtifactDirectory\*.nupkg -recurse | Select -ExpandProperty FullName
+
+foreach ($nupkg in $nupkgs){
+	Write-Host "Submitting $nupkg for signing"
+
+	.\SignClient 'sign' -c $appSettings -i $nupkg -r $Env:SignClientUser -s $Env:SignClientSecret -n 'Json.NET' -d 'Json.NET' -u 'https://www.newtonsoft.com/json' 
+
+	Write-Host "Finished signing $nupkg"
+}
+
+Write-Host "Sign-package complete"

Build/appsettings.json

@@ -0,0 +1,13 @@
+{
+  "SignClient": {
+    "AzureAd": {
+      "AADInstance": "https://login.microsoftonline.com/",
+      "ClientId": "c248d68a-ba6f-4aa9-8a68-71fe872063f8",
+      "TenantId": "16076fdc-fcc1-4a15-b1ca-32c9a255900e"
+    },
+    "Service": {
+      "Url": "https://codesign.dotnetfoundation.org/",
+      "ResourceId": "https://SignService/3c30251f-36f3-490b-a955-520addb85001"
+    }
+  }
+}

Build/build.ps1

@@ -19,7 +19,6 @@
   $baseDir  = resolve-path ..
   $buildDir = "$baseDir\Build"
   $sourceDir = "$baseDir\Src"
-  $toolsDir = "$baseDir\Tools"
   $docDir = "$baseDir\Doc"
   $releaseDir = "$baseDir\Release"
   $workingDir = "$baseDir\$workingName"
@@ -129,7 +128,6 @@ task Package -depends Build {
   robocopy $sourceDir $workingDir\Package\Source\Src /MIR /NFL /NDL /NJS /NC /NS /NP /XD bin obj TestResults AppPackages .vs artifacts /XF *.suo *.user *.lock.json | Out-Default
   robocopy $buildDir $workingDir\Package\Source\Build /MIR /NFL /NDL /NJS /NC /NS /NP /XD Temp /XF runbuild.txt | Out-Default
   robocopy $docDir $workingDir\Package\Source\Doc /MIR /NFL /NDL /NJS /NC /NS /NP | Out-Default
-  robocopy $toolsDir $workingDir\Package\Source\Tools /MIR /NFL /NDL /NJS /NC /NS /NP | Out-Default
 
   Compress-Archive -Path $workingDir\Package\* -DestinationPath $workingDir\$zipFileName
 }

Build/runbuild.cmd

@@ -1,5 +1,5 @@
 cls
-powershell -Command "& { Start-Transcript '%~dp0\Temp\runbuild.txt'; Import-Module '%~dp0..\Tools\PSake\psake.psm1'; Invoke-psake '%~dp0..\Build\build.ps1' %*; Stop-Transcript; exit !($psake.build_success); }"
+powershell -Command "& { Start-Transcript '%~dp0\Temp\runbuild.txt'; Import-Module '%~dp0\psake.psm1'; Invoke-psake '%~dp0..\Build\build.ps1' %*; Stop-Transcript; exit !($psake.build_success); }"
 
 ECHO %ERRORLEVEL%
 EXIT /B %ERRORLEVEL%

Build/runbuild.ps1

@@ -6,7 +6,7 @@
 $path = Split-Path -Path $MyInvocation.MyCommand.Path
 
 write-host "Importing psake"
-Import-Module ($path + '\..\Tools\PSake\psake.psm1')
+Import-Module ($path + '\psake.psm1')
 
 Try
 {

azure-pipelines.yml

@@ -26,6 +26,16 @@ steps:
     BUILD_ID: $(Build.BuildId)
   displayName: 'Run build'
 
+- task: PowerShell@2
+  inputs:
+    filePath: .\Build\Sign-Package.ps1
+  env:
+    SignClientUser: $(newtonsoft.signClientUser)
+    SignClientSecret: $(newtonsoft.signClientSecret)
+    ArtifactDirectory: .\Working
+  displayName: 'Authenticode sign packages'
+  condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/master'), not(eq(variables['newtonsoft.signClientUser'], '')), not(eq(variables['newtonsoft.signClientSecret'], '')))
+
 - task: PublishTestResults@2
   inputs:
     testRunner: 'NUnit'