Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Signing support for VMR builds #3708

Open
8 of 29 tasks
mmitche opened this issue Nov 1, 2023 · 3 comments
Open
8 of 29 tasks

Signing support for VMR builds #3708

mmitche opened this issue Nov 1, 2023 · 3 comments
Assignees
Labels
area-unified-build Epic Groups multiple user stories. Can be grouped under a theme. up-for-grabs

Comments

@mmitche
Copy link
Member

mmitche commented Nov 1, 2023

Products that Microsoft ships must be signed, of course.

We sign in a number of ways today:

  • Post-build signing (signing in staging). This includes
    • Signing of most binaries in 6.0
    • Signing and notarization of Mac binaries in staging (all versions)
    • Signing of Linux installers in staging (all versions)
  • Signing in-build (7.0 and 8.0, plus some repos in 6.0)
  • Signing the DAC during the runtime build.

Some of the multiple ways of post-build signing have been driven by technical limitations. Linux and Mac signing could not occur within the same infra as typical MIcrobuild signing infra.

We need to work on improving this for the 9.0 VMR builds.

Objectives

  • Signing is simpler, and in alignment with the Vertical build philosophies. Few machines, if any. They may be on separate machines as required by infra limitations (e.g. must sign mac on a mac?)
  • We still sign the DAC in build.
  • We need not sign every build (aside from DAC, which is critical for debugging)
  • Signing infra should be aligned across platforms. Right now we have 3-4 different technologies.

Depends On

Work Items

T-Shirt Size: XL

@dotnet-issue-labeler dotnet-issue-labeler bot added area-build Improvements in source-build's own build process untriaged labels Nov 1, 2023
@mmitche mmitche added area-unified-build and removed area-build Improvements in source-build's own build process untriaged labels Nov 1, 2023
@mmitche mmitche changed the title Design signing support for VMR builds Signing support for VMR builds Nov 1, 2023
@mmitche
Copy link
Member Author

mmitche commented Jan 3, 2024

T-Shirt Size: XL

There is a lot to do here:

  • Decide on a signing design (in-build after each repo builds, after-build?)
  • Expand signing support to other platforms (may not be critical)

@mmitche mmitche self-assigned this Jan 11, 2024
@mmitche mmitche added the Epic Groups multiple user stories. Can be grouped under a theme. label Jan 11, 2024
@mmitche mmitche assigned mmitche and unassigned mmitche Jan 30, 2024
@mmitche
Copy link
Member Author

mmitche commented Jan 30, 2024

https://microsoft-my.sharepoint.com/:w:/p/mmitche/ERcEQy4Xex9CpRyTiGx9HrkBqf4iGDjDjwSk98QsczcROw?e=I6sfYl contains the deisgn.

See the rough implementation plan in the doc for some more info, but it's important to recognize the independent tracks of work available here. This work is highly parallelizable. We can work on signtool support for different containers without actually being able to submit them for signing. Similarly, you can work on enabling signing infra in the vertical builds before you have the ability to sign all containers. The areas where there may be blocking issues are cases where support for unpacking a container requires running on a Mac or Linux machine, and we can't yet run SignTool on that machine.

@tkapin
Copy link
Member

tkapin commented Mar 6, 2024

Matt is about to work on this, needs the aspnetcore build in the VMR as the prerequisite.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area-unified-build Epic Groups multiple user stories. Can be grouped under a theme. up-for-grabs
Projects
Status: Backlog
Status: In Progress
Development

No branches or pull requests

2 participants