CodeSign.targets

<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">

  <UsingTask TaskName="ESRPSignTask" AssemblyFile="$(CISignRepoPath)\tools\sdkbuildtools\tasks\MS.Az.Sdk.OnPremise.Build.Tasks.dll" />

  <PropertyGroup>
    <!-- CISignRepo is an environment variable that points to ci-signing repo clone -->
    <CISignRepoPath>$(CISignRepo)</CISignRepoPath>
  </PropertyGroup>
  
  <Target Name="CodeSignBinaries" DependsOnTargets="RestoreNugetPackages;BuildMsBuildTask">
    <Message Text="====> Executing CodeSignBinaries Target..." Importance="high"/>

    <PropertyGroup>
      <!--public token associated with MSSharedLibKey.snk-->
      <StrongNameToken Condition=" '$(StrongNameToken)' == '' ">31bf3856ad364e35</StrongNameToken>
    </PropertyGroup>

    <Message Text="----> Dlls signing section" Importance="high"/>
    <!-- Azure -->
    <ItemGroup Condition="'$(Scope)' == 'All' or '$(Scope)' == 'Latest' or '$(Scope)' == 'Netcore'">
      <DelaySignedAssembliesToSign Include="$(PackageDirectory)\$(Configuration)\**\Microsoft*Azure*PowerShell*Cmdlets*.dll;
        $(PackageDirectory)\$(Configuration)\Az.Accounts\Microsoft.Azure.PowerShell.Authentication.ResourceManager.dll;
        $(PackageDirectory)\$(Configuration)\**\Microsoft.Azure.PowerShell.Authenticators.dll;
        $(PackageDirectory)\$(Configuration)\Az.Accounts\Microsoft.Azure.PowerShell.Authentication.dll" />
    </ItemGroup>

    <Message Importance="high" Text="$(PackageDirectory)\$(Configuration) does not contains any files to sign. Code sign will skip." Condition="'@(DelaySignedAssembliesToSign)' == ''" />
    <ESRPSignTask
        CopyBackSignedFilesToOriginalLocation="true"
        UnsignedFileList="@(DelaySignedAssembliesToSign)"
        SignLogDirPath="$(LibraryRoot)dlls-signing.log" 
        Condition="!$(DelaySign) and '@(DelaySignedAssembliesToSign)' != ''"/>

    <Exec Command="$(PowerShellCommandPrefix) &quot;. $(LibraryToolsFolder)\UpdateModules.ps1 -BuildConfig $(Configuration) -Scope $(Scope) &quot;" />

    <!-- Copying shortcut to be signed -->
    <Copy SourceFiles="$(LibraryRoot)tools\Az\Az.psm1" DestinationFolder="$(PackageDirectory)\$(Configuration)" Condition="'$(Scope)' == 'Netcore'" />

    <Message Text="----> Scripts signing section" Importance="high"/>
    <!-- Azure -->
    <ItemGroup Condition="'$(Scope)' == 'All' or '$(Scope)' == 'Latest' or '$(Scope)' == 'Netcore'">
      <ScriptsToSign Include="$(PackageDirectory)\$(Configuration)\**\*.ps1" />
      <ScriptsToSign Include="$(PackageDirectory)\$(Configuration)\**\*.psm1" />
      <ScriptsToSign Include="$(PackageDirectory)\$(Configuration)\**\*.ps1xml" />
      <ScriptsToSign Include="$(PackageDirectory)\$(Configuration)\**\*.js" />
    </ItemGroup>

    <ESRPSignTask
        CopyBackSignedFilesToOriginalLocation="true"
        UnsignedFileList="@(ScriptsToSign)"
        SignLogDirPath="$(LibraryRoot)scripts-signing.log" 
        Condition="!$(DelaySign) and '@(ScriptsToSign)' != ''"/>            

    <!-- RemoveCodeSignArtifacts.ps1 -->
    <Message Text="----> Remove artifacts section" Importance="high"/>
    <Exec Command="$(PowerShellCoreCommandPrefix) &quot;Get-ChildItem -Path $(PackageDirectory) -Recurse -Include 'Signed','Unsigned' | Remove-Item -Recurse -Force -Confirm:$false -ErrorAction Ignore&quot;" 
        ContinueOnError="WarnAndContinue" 
        IgnoreExitCode="true" />
    
    <!-- CheckSignature.ps1 -->    
    <Message Text="----> CheckSignature section" Importance="high"/>        
    <Exec Command="$(PowerShellCommandPrefix) &quot;. $(LibraryToolsFolder)\CheckSignature.ps1 -CustomPath $(PackageDirectory)\$(Configuration) &quot;" Condition="'$(Scope)' != 'Stack'" ContinueOnError="ErrorAndContinue" />

    <!-- Copy files back after signing -->
    <Copy SourceFiles="$(PackageDirectory)\$(Configuration)\Az.psm1" DestinationFolder="$(LibraryRoot)tools\Az" Condition="'$(Scope)' == 'Netcore'" />
  </Target>

  <Target Name="CodeSignInstaller">
    <Message Text="----> CodeSignInstaller section" Importance="high"/>
    <PropertyGroup>
      <!--public token associated with MSSharedLibKey.snk-->
      <StrongNameToken Condition=" '$(StrongNameToken)' == '' ">31bf3856ad364e35</StrongNameToken>
    </PropertyGroup>
    <GetFrameworkSdkPath>
      <Output TaskParameter="Path" PropertyName="WindowsSdkPath"/>
    </GetFrameworkSdkPath>

    <ItemGroup>
      <InstallersToSign Include="$(LibraryRoot)\setup\*.msi" />
    </ItemGroup>

    <Message Importance="high" Text="$(LibraryRoot)\setup does not contain any installers to sign. Code sign will skip."
        Condition="'@(InstallersToSign)' == ''" />

    <ESRPSignTask
        SignedFilesRootDirPath="$(SignedOutputRootDir)"
        UnsignedFileList="@(InstallersToSign)"
        SignLogDirPath="$(LibraryRoot)\msi-signing.log" 
        Condition="!$(DelaySign) and '@(InstallersToSign)' != ''"/>

    <!--If we are testing locally then we copy the binaries and do not submit to the code sign server-->
    <Copy SourceFiles="@(InstallersToSign)" DestinationFolder="signed" Condition="$(DelaySign)" />
    <SetEnvVar EnvName="SignedMsiDir" EnvValue="$(SignedOutputRootDir)" />
  </Target>

</Project>