8000 VS-124: Sign Analyzer releases (#62) · mongodb/mongo-csharp-analyzer@22f8a3c · GitHub
[go: up one dir, main page]
Skip to content

Commit 22f8a3c

Browse files
BorisDogBorisDog
authored
VS-124: Sign Analyzer releases (#62)
1 parent e008ef4 commit 22f8a3c

File tree

3 files changed

+42
-3
lines changed

3 files changed

+42
-3
lines changed

‎evergreen/evergreen.yml

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,9 +145,15 @@ functions:
145145
- command: shell.exec
146146
params:
147147
working_dir: mongo-csharp-analyzer
148+
env:
149+
ARTIFACTORY_PASSWORD: ${ARTIFACTORY_PASSWORD}
150+
ARTIFACTORY_USERNAME: ${ARTIFACTORY_USERNAME}
151+
AZURE_NUGET_SIGN_TENANT_ID: ${AZURE_NUGET_SIGN_TENANT_ID}
152+
AZURE_NUGET_SIGN_CLIENT_ID: ${AZURE_NUGET_SIGN_CLIENT_ID}
153+
AZURE_NUGET_SIGN_CLIENT_SECRET: ${AZURE_NUGET_SIGN_CLIENT_SECRET}
154+
PACKAGE_VERSION: ${PACKAGE_VERSION}
148155
script: |
149156
${PREPARE_SHELL}
150-
OS=${OS} \
151157
PACKAGE_VERSION=${PACKAGE_VERSION} \
152158
evergreen/run-pack.sh
153159
@@ -157,6 +163,7 @@ functions:
157163
shell: bash
158164
working_dir: mongo-csharp-analyzer
159165
env:
166+
NUGET_SIGN_CERTIFICATE_FINGERPRINT: ${NUGET_SIGN_CERTIFICATE_FINGERPRINT}
160167
PACKAGES_SOURCE: ${PACKAGES_SOURCE}
161168
PACKAGES_SOURCE_KEY: ${PACKAGES_SOURCE_KEY}
162169
PACKAGE_VERSION: ${PACKAGE_VERSION}

‎evergreen/run-pack.sh

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,14 @@
22
set -o errexit # Exit the script with error if any of the commands fail
33
set +o xtrace # Disable tracing.
44

5+
# Environment variables used as input:
6+
# ARTIFACTORY_PASSWORD
7+
# ARTIFACTORY_USERNAME
8+
# AZURE_NUGET_SIGN_TENANT_ID
9+
# AZURE_NUGET_SIGN_CLIENT_ID
10+
# AZURE_NUGET_SIGN_CLIENT_SECRET
11+
# PACKAGE_VERSION
12+
513
if [ -z "$PACKAGE_VERSION" ]; then
614
echo "PACKAGE_VERSION variable should be set"
715
exit 1
@@ -11,4 +19,19 @@ echo Creating nuget package...
1119

1220
dotnet clean "./MongoDB.Analyzer.sln"
1321
dotnet build "./MongoDB.Analyzer.sln" -c Release
14-
dotnet pack ./src/MongoDB.Analyzer.Package/MongoDB.Analyzer.Package.csproj -o ./artifacts/nuget -c Release -p:Version="$PACKAGE_VERSION" -p:ContinuousIntegrationBuild=true
22+
dotnet pack ./src/MongoDB.Analyzer.Package/MongoDB.Analyzer.Package.csproj -o ./artifacts/nuget -c Release -p:Version="$PACKAGE_VERSION" -p:ContinuousIntegrationBuild=true
23+
24+
echo "${ARTIFACTORY_PASSWORD}" | docker login --password-stdin --username "${ARTIFACTORY_USERNAME}" artifactory.corp.mongodb.com
25+
26+
docker run --platform="linux/amd64" --rm -v $(pwd):/workdir -w /workdir \
27+
artifactory.corp.mongodb.com/release-tools-container-registry-local/azure-keyvault-nuget \
28+
NuGetKeyVaultSignTool sign "artifacts/nuget/*"."$PACKAGE_VERSION".nupkg \
29+
--force \
30+
--file-digest=sha256 \
31+
--timestamp-rfc3161=http://timestamp.digicert.com \
32+
--timestamp-digest=sha256 \
33+
--azure-key-vault-url=https://mdb-authenticode.vault.azure.net \
34+
--azure-key-vault-tenant-id="$AZURE_NUGET_SIGN_TENANT_ID" \
35+
--azure-key-vault-client-secret="$AZURE_NUGET_SIGN_CLIENT_SECRET" \
36+
--azure-key-vault-client-id="$AZURE_NUGET_SIGN_CLIENT_ID" \
37+
--azure-key-vault-certificate=authenticode-2021

‎evergreen/run-push.sh

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,12 @@
22
set -o errexit # Exit the script with error if any of the commands fail
33
set +o xtrace # Disable tracing.
44

5+
# Environment variables used as input:
6+
# NUGET_SIGN_CERTIFICATE_FINGERPRINT
7+
# PACKAGES_SOURCE
8+
# PACKAGES_SOURCE_KEY
9+
# PACKAGE_VERSION
10+
511
if [ -z "$PACKAGES_SOURCE" ]; then
612
echo "PACKAGES_SOURCE variable should be set"
713
exit 1
@@ -23,5 +29,8 @@ if [ "$PACKAGES_SOURCE" = "https://api.nuget.org/v3/index.json" ] && [[ ! "$PACK
2329
exit 1
2430
fi
2531

32+
echo Verifying signature
33+
dotnet nuget verify ./artifacts/nuget/MongoDB.Analyzer."$PACKAGE_VERSION".nupkg --certificate-fingerprint "$NUGET_SIGN_CERTIFICATE_FINGERPRINT"
34+
2635
echo Pushing nuget package...
27-
dotnet nuget push --source "$PACKAGES_SOURCE" --api-key "$PACKAGES_SOURCE_KEY" ./artifacts/nuget/MongoDB.Analyzer."$PACKAGE_VERSION".nupkg
36+
dotnet nuget push --source "$PACKAGES_SOURCE" --api-key "$PACKAGES_SOURCE_KEY" ./artifacts/nuget/MongoDB.Analyzer."$PACKAGE_VERSION".nupkg

0 commit comments

Comments
 (0)
0