Skip to content

Commit 9e3bbac

Browse files
Merged PR 4782: eng | Secure symbols publishing
1 parent 1152fcf commit 9e3bbac

File tree

6 files changed

+108
-30
lines changed

6 files changed

+108
-30
lines changed

eng/pipelines/common/templates/jobs/build-signed-akv-package-job.yml

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ parameters:
1717

1818
jobs:
1919
- job: build_signed_akv_package
20+
displayName: 'Build Signed AKV Provider Package'
2021
pool:
2122
type: windows # read more about custom job pool types at https://aka.ms/obpipelines/yaml/jobs
2223

@@ -59,20 +60,11 @@ jobs:
5960
product: AKV
6061
referenceType: package
6162

62-
# Publish symbols to private server
63+
# Publish symbols to servers
6364
- template: ../steps/publish-symbols-step.yml@self
6465
parameters:
65-
SymAccount: $(PrivateSymAccount)
66-
referenceType: package
67-
symbolsVersion: ${{variables.AKVNuGetPackageVersion }}
68-
product: AKV
69-
publishSymbols: ${{ parameters['PublishSymbols'] }}
70-
71-
# Publish symbols to public server
72-
- template: ../steps/publish-symbols-step.yml@self
73-
parameters:
74-
SymAccount: $(PublicSymAccount)
7566
referenceType: package
7667
symbolsVersion: ${{variables.AKVNuGetPackageVersion }}
7768
product: AKV
7869
publishSymbols: ${{ parameters['PublishSymbols'] }}
70+
symbolsArtifactName: akv_symbols_$(System.TeamProject)_$(Build.Repository.Name)_$(Build.SourceBranchName)_$(NuGetPackageVersion)_$(System.TimelineId)

eng/pipelines/common/templates/jobs/build-signed-package-job.yml

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ parameters:
1717

1818
jobs:
1919
- job: build_signed_package
20+
displayName: 'Build Signed MDS Package'
2021
pool:
2122
type: windows # read more about custom job pool types at https://aka.ms/obpipelines/yaml/jobs
2223

@@ -49,14 +50,8 @@ jobs:
4950
parameters:
5051
product: MDS
5152

52-
# Publish symbols to private server
53+
# Publish symbols to servers
5354
- template: ../steps/publish-symbols-step.yml@self
5455
parameters:
55-
SymAccount: $(PrivateSymAccount)
56-
publishSymbols: ${{ parameters['PublishSymbols'] }}
57-
58-
# Publish symbols to public server
59-
- template: ../steps/publish-symbols-step.yml@self
60-
parameters:
61-
SymAccount: $(PublicSymAccount)
6256
publishSymbols: ${{ parameters['PublishSymbols'] }}
57+
symbolsArtifactName: mds_symbols_$(System.TeamProject)_$(Build.Repository.Name)_$(Build.SourceBranchName)_$(NuGetPackageVersion)_$(System.TimelineId)

eng/pipelines/common/templates/jobs/run-tests-package-reference-job.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ parameters:
1919

2020
jobs:
2121
- job: run_tests_package_reference
22+
displayName: 'Run tests with package reference'
2223
${{ if ne(parameters.dependsOn, 'empty')}}:
2324
dependsOn: '${{parameters.dependsOn }}'
2425
pool:

eng/pipelines/common/templates/jobs/validate-signed-package-job.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ parameters:
3535

3636
jobs:
3737
- job: validate_signed_package
38+
displayName: 'Verify signed package'
3839
${{ if ne(parameters.dependsOn, '')}}:
3940
dependsOn: '${{parameters.dependsOn }}'
4041
pool:

eng/pipelines/common/templates/steps/publish-symbols-step.yml

Lines changed: 96 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,14 @@
1-
#################################################################################
2-
# Licensed to the .NET Foundation under one or more agreements. #
3-
# The .NET Foundation licenses this file to you under the MIT license. #
4-
# See the LICENSE file in the project root for more information. #
5-
#################################################################################
1+
####################################################################################
2+
# Licensed to the .NET Foundation under one or more agreements. #
3+
# The .NET Foundation licenses this file to you under the MIT license. #
4+
# See the LICENSE file in the project root for more information. #
5+
# #
6+
# doc: https://www.osgwiki.com/wiki/Symbols_Publishing_Pipeline_to_SymWeb_and_MSDL #
7+
####################################################################################
68
parameters:
79
- name: SymAccount
810
type: string
11+
default: 'SqlClientDrivers'
912

1013
- name: publishSymbols
1114
type: string
@@ -15,6 +18,23 @@ parameters:
1518
type: string
1619
default: '$(NuGetPackageVersion)'
1720

21+
- name: symbolServer
22+
type: string
23+
default: '$(SymbolServer)'
24+
25+
- name: symbolTokenUri
26+
type: string
27+
default: '$(SymbolTokenUri)'
28+
29+
- name: symbolsArtifactName
30+
type: string
31+
32+
- name: publishToServers
33+
type: object
34+
default:
35+
internal: true
36+
public: true
37+
1838
- name: referenceType
1939
default: project
2040
values:
@@ -30,12 +50,12 @@ parameters:
3050

3151
steps:
3252
- powershell: 'Write-Host "##vso[task.setvariable variable=ArtifactServices.Symbol.AccountName;]${{parameters.SymAccount}}"'
33-
displayName: 'Update Symbol.AccountName ${{parameters.SymAccount}}'
53+
displayName: 'Update Symbol.AccountName with ${{parameters.SymAccount}}'
3454
condition: and(succeeded(), ${{ eq(parameters.publishSymbols, 'true') }})
3555

3656
- ${{ if eq(parameters.product, 'MDS') }}:
3757
- task: PublishSymbols@2
38-
displayName: 'Publish symbols path'
58+
displayName: 'Upload symbols to ${{parameters.SymAccount }} org'
3959
inputs:
4060
SymbolsFolder: '$(Build.SourcesDirectory)\artifacts\${{parameters.referenceType }}\bin'
4161
SearchPattern: |
@@ -44,13 +64,16 @@ steps:
4464
IndexSources: false
4565
SymbolServerType: TeamServices
4666
SymbolsMaximumWaitTime: 60
67+
SymbolExpirationInDays: 1825 # 5 years
4768
SymbolsProduct: Microsoft.Data.SqlClient
48-
SymbolsVersion: '{{parameters.symbolsVersion }}'
69+
SymbolsVersion: ${{parameters.symbolsVersion }}
70+
SymbolsArtifactName: ${{parameters.symbolsArtifactName }}
71+
Pat: $(System.AccessToken)
4972
condition: and(succeeded(), ${{ eq(parameters.publishSymbols, 'true') }})
5073

5174
- ${{ if eq(parameters.product, 'AKV') }}:
5275
- task: PublishSymbols@2
53-
displayName: 'Publish symbols path'
76+
displayName: 'Upload symbols to ${{parameters.SymAccount }} org'
5477
inputs:
5578
SymbolsFolder: '$(Build.SourcesDirectory)\artifacts\${{parameters.referenceType }}\bin'
5679
SearchPattern: |
@@ -59,6 +82,69 @@ steps:
5982
IndexSources: false
6083
SymbolServerType: TeamServices
6184
SymbolsMaximumWaitTime: 60
85+
SymbolExpirationInDays: 1825 # 5 years
6286
SymbolsProduct: Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
63-
SymbolsVersion: '{{parameters.symbolsVersion }}'
87+
SymbolsVersion: ${{parameters.symbolsVersion }}
88+
SymbolsArtifactName: ${{parameters.symbolsArtifactName }}
89+
Pat: $(System.AccessToken)
6490
condition: and(succeeded(), ${{ eq(parameters.publishSymbols, 'true') }})
91+
92+
- task: AzureCLI@2
93+
displayName: 'Publish symbols'
94+
condition: and(succeeded(), ${{ eq(parameters.publishSymbols, 'true') }})
95+
inputs:
96+
azureSubscription: 'Symbols publishing Workload Identity federation service-ADO.Net'
97+
scriptType: ps
98+
scriptLocation: inlineScript
99+
inlineScript: |
100+
$publishToInternalServer = "${{parameters.publishToServers.internal }}".ToLower()
101+
$publishToPublicServer = "${{parameters.publishToServers.public }}".ToLower()
102+
103+
echo "Publishing request name: ${{parameters.symbolsArtifactName }}"
104+
echo "Publish to internal server: $publishToInternalServer"
105+
echo "Publish to public server: $publishToPublicServer"
106+
107+
$symbolServer = "${{parameters.symbolServer }}"
108+
$tokenUri = "${{parameters.symbolTokenUri }}"
109+
# Registered project name in the symbol publishing pipeline: https://portal.microsofticm.com/imp/v3/incidents/incident/520844254/summary
110+
$projectName = "Microsoft.Data.SqlClient.SNI"
111+
112+
# Get the access token for the symbol publishing service
113+
$symbolPublishingToken = az account get-access-token --resource $tokenUri --query accessToken -o tsv
114+
115+
echo "> 1.Symbol publishing token acquired."
116+
117+
echo "Registering the request name ..."
118+
$requestName = "${{parameters.symbolsArtifactName }}"
119+
$requestNameRegistrationBody = "{'requestName': '$requestName'}"
120+
Invoke-RestMethod -Method POST -Uri "https://$symbolServer.trafficmanager.net/projects/$projectName/requests" -Headers @{ Authorization = "Bearer $symbolPublishingToken" } -ContentType "application/json" -Body $requestNameRegistrationBody
121+
122+
echo "> 2.Registration of request name succeeded."
123+
124+
echo "Publishing the symbols ..."
125+
$publishSymbolsBody = "{'publishToInternalServer': $publishToInternalServer, 'publishToPublicServer': $publishToPublicServer}"
126+
echo "Publishing symbols request body: $publishSymbolsBody"
127+
Invoke-RestMethod -Method POST -Uri "https://$symbolServer.trafficmanager.net/projects/$projectName/requests/$requestName" -Headers @{ Authorization = "Bearer $symbolPublishingToken" } -ContentType "application/json" -Body $publishSymbolsBody
128+
129+
echo "> 3.Request to publish symbols succeeded."
130+
131+
# The following REST calls are used to check publishing status.
132+
echo "> 4.Checking the status of the request ..."
133+
134+
Invoke-RestMethod -Method GET -Uri "https://$symbolServer.trafficmanager.net/projects/$projectName/requests/$requestName" -Headers @{ Authorization = "Bearer $symbolPublishingToken" } -ContentType "application/json"
135+
136+
echo "Use below tables to interpret the values of xxxServerStatus and xxxServerResult fields from the response."
137+
138+
echo "PublishingStatus"
139+
echo "-----------------"
140+
echo "0 NotRequested; The request has not been requested to publish."
141+
echo "1 Submitted; The request is submitted to be published"
142+
echo "2 Processing; The request is still being processed"
143+
echo "3 Completed; The request has been completed processing. It can be failed or successful. Check PublishingResult to get more details"
144+
145+
echo "PublishingResult"
146+
echo "-----------------"
147+
echo "0 Pending; The request has not completed or has not been requested."
148+
echo "1 Succeeded; The request has published successfully"
149+
echo "2 Failed; The request has failed to publish"
150+
echo "3 Cancelled; The request was cancelled"

eng/pipelines/dotnet-sqlclient-signing-pipeline.yml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ extends:
125125
disableLegacyManifest: true
126126
stages:
127127
- stage: buildAKV
128+
displayName: 'Build AKV Provider'
128129
jobs:
129130
- template: eng/pipelines/common/templates/jobs/build-signed-akv-package-job.yml@self
130131
parameters:
@@ -133,14 +134,16 @@ extends:
133134
publishSymbols: ${{ parameters['publishSymbols'] }}
134135

135136
- stage: buildMDS
137+
displayName: 'Build MDS'
136138
jobs:
137139
- template: eng/pipelines/common/templates/jobs/build-signed-package-job.yml@self
138140
parameters:
139141
symbolsFolder: $(symbolsFolder)
140142
softwareFolder: $(softwareFolder)
141143
publishSymbols: ${{ parameters['publishSymbols'] }}
142144

143-
- stage: package_validation
145+
- stage: mds_package_validation
146+
displayName: 'MDS Package Validation'
144147
dependsOn: buildMDS
145148
jobs:
146149
- template: eng/pipelines/common/templates/jobs/validate-signed-package-job.yml@self

0 commit comments

Comments
 (0)