8000 Enables building and signing OpenSSL, LibFFI and Tcl/Tk with Azure Ke… · python/release-tools@991e18f · GitHub
[go: up one dir, main page]
Skip to content

Commit 991e18f

Browse files
zoobazooba
authored
Enables building and signing OpenSSL, LibFFI and Tcl/Tk with Azure Key Vault (#37)
1 parent 09bee2a commit 991e18f

File tree

4 files changed

+151
-75
lines changed

4 files changed

+151
-75
lines changed

‎windows-release/libffi-build.yml

Lines changed: 56 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,37 @@
1-
name: $(SourceTag)_$(Date:yyyyMMdd)$(Rev:.rr)
1+
parameters:
2+
- name: SourceTag
3+
displayName: 'LibFFI Source Tag'
4+
type: string
5+
- name: SigningCertificate
6+
displayName: "Code signing certificate"
7+
type: string
8+
default: 'PythonSoftwareFoundation'
9+
values:
10+
- 'PythonSoftwareFoundation'
11+
- 'TestSign'
12+
- 'Unsigned'
13+
- name: SourcesRepo
14+
displayName: 'Sources Repository'
15+
type: string
16+
default: 'https://github.com/python/cpython-source-deps'
17+
- name: LibFFIBuildScript
18+
displayName: 'Build script'
19+
type: string
20+
default: 'https://github.com/python/cpython/raw/main/PCbuild/prepare_libffi.bat'
21+
22+
23+
name: ${{ parameters.SourceTag }}_$(Date:yyyyMMdd)$(Rev:.rr)
24+
225

326
variables:
4-
IntDir: '$(Build.BinariesDirectory)'
5-
OutDir: '$(Build.ArtifactStagingDirectory)'
27+
- group: CPythonSign
28+
- name: IntDir
29+
value: '$(Build.BinariesDirectory)'
30+
- name: OutDir
31+
value: '$(Build.ArtifactStagingDirectory)'
32+
- name: SigningDescription
33+
value: 'LibFFI for Python (${{ parameters.SourceTag }})'
634

7-
# MUST BE SET AT QUEUE TIME
8-
# SigningCertificate: 'Python Software Foundation'
9-
< 8000 span class="pl-c"># SourcesRepo: 'https://github.com/python/cpython-source-deps'
10-
# SourceTag: 'libffi-3.4.2'
1135

1236
jobs:
1337
- job: Build_LibFFI
@@ -25,12 +49,11 @@ jobs:
2549

2650
- powershell: |
2751
mkdir -Force "$(IntDir)\script"
28-
iwr "https://github.com/python/cpython/raw/main/PCbuild/prepare_libffi.bat" `
29-
-outfile "$(IntDir)\script\prepare_libffi.bat"
52+
iwr "${{ parameters.LibFFIBuildScript }}" -outfile "$(IntDir)\script\prepare_libffi.bat"
3053
displayName: 'Download build script'
3154
3255
- powershell: |
33-
git clone $(SourcesRepo) -b $(SourceTag) --depth 1 -c core.autocrlf=false -c core.eol=lf .
56+
git clone ${{ parameters.SourcesRepo }} -b ${{ parameters.SourceTag }} --depth 1 -c core.autocrlf=false -c core.eol=lf .
3457
displayName: 'Check out LibFFI sources'
3558
3659
- script: 'prepare_libffi.bat --install-cygwin'
@@ -42,10 +65,10 @@ jobs:
4265
LIBFFI_OUT: '$(OutDir)'
4366

4467
- powershell: |
45-
if ((gci *\*.dll).Count -lt 4) {
68+
if ((gci *\*.dll).Count -lt 3) {
4669
Write-Error "Did not generate enough DLL files"
4770
}
48-
if ((gci *\Include\ffi.h).Count -lt 4) {
71+
if ((gci *\Include\ffi.h).Count -lt 3) {
4972
Write-Error "Did not generate enough include files"
5073
}
5174
failOnStderr: true
@@ -56,32 +79,28 @@ jobs:
5679
artifact: 'unsigned'
5780
displayName: 'Publish unsigned build'
5881

59-
- job: Sign_LibFFI
60-
displayName: Sign LibFFI
61-
dependsOn: Build_LibFFI
62-
condition: and(succeeded(), variables['SigningCertificate'])
63-
pool:
64-
name: 'Windows Release'
6 A36C 582

66-
workspace:
67-
clean: all
83+
- ${{ if ne(parameters.SigningCertificate, 'Unsigned') }}:
84+
- job: Sign_LibFFI
85+
displayName: Sign LibFFI
86+
dependsOn: Build_LibFFI
87+
pool:
88+
vmImage: windows-latest
6889

69-
steps:
70-
- checkout: none
71-
- download: current
72-
artifact: unsigned
90+
workspace:
91+
clean: all
7392

74-
- template: ./find-tools.yml
93+
steps:
94+
- checkout: none
95+
- download: current
96+
artifact: unsigned
7597

76-
- powershell: |
77-
signtool sign /q /a `
78-
/n "$(SigningCertificate)" `
79-
/fd sha256 `
80-
/tr http://timestamp.digicert.com/ /td sha256 `
81-
/d "LibFFI for Python" `
82-
(gci "$(Pipeline.Workspace)\unsigned\*.dll" -r)
83-
displayName: 'Sign files'
84-
85-
- publish: '$(Pipeline.Workspace)\unsigned'
86-
artifact: 'libffi'
87-
displayName: 'Publish libffi'
98+
- template: sign-files.yml
99+
parameters:
100+
Include: '-r *.dll'
101+
WorkingDir: '$(Pipeline.Workspace)\unsigned'
102+
SigningCertificate: ${{ parameters.SigningCertificate }}
103+
104+
- publish: '$(Pipeline.Workspace)\unsigned'
105+
artifact: 'libffi'
106+
displayName: 'Publish libffi'

‎windows-release/openssl-build.yml

Lines changed: 35 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,39 @@
1-
name: $(SourceTag)_$(Date:yyyyMMdd)$(Rev:.rr)
1+
parameters:
2+
- name: SourceTag
3+
displayName: 'OpenSSL Source Tag'
4+
type: string
5+
- name: SigningCertificate
6+
displayName: "Code signing certificate"
7+
type: string
8+
default: 'PythonSoftwareFoundation'
9+
values:
10+
- 'PythonSoftwareFoundation'
11+
- 'TestSign'
12+
- 'Unsigned'
13+
- name: SourcesRepo
14+
displayName: 'Sources Repository'
15+
type: string
16+
default: 'https://github.com/python/cpython-source-deps'
17+
18+
19+
name: ${{ parameters.SourceTag }}_$(Date:yyyyMMdd)$(Rev:.rr)
20+
221

322
variables:
4-
IntDir: '$(Build.BinariesDirectory)'
5-
OutDir: '$(Build.ArtifactStagingDirectory)'
23+
- group: CPythonSign
24+
- name: IntDir
25+
value: '$(Build.BinariesDirectory)'
26+
- name: OutDir
27+
value: '$(Build.ArtifactStagingDirectory)'
28+
- name: SigningDescription
29+
value: 'OpenSSL for Python (${{ parameters.SourceTag }})'
630

7-
# MUST BE SET AT QUEUE TIME
8-
# SigningCertificate: 'Python Software Foundation'
9-
# SourcesRepo: 'https://github.com/python/cpython-source-deps'
10-
# SourceTag: 'openssl-1.1.1k'
1131

1232
jobs:
1333
- job: Build_SSL
1434
displayName: OpenSSL
1535
pool:
16-
name: 'Windows Release'
17-
#vmImage: windows-latest
36+
vmImage: windows-latest
1837

1938
strategy:
2039
matrix:
@@ -26,10 +45,6 @@ jobs:
2645
Platform: 'amd64'
2746
VCPlatform: 'amd64'
2847
OpenSSLPlatform: 'VC-WIN64A-masm'
29-
arm32:
30-
Platform: 'arm32'
31-
VCPlatform: 'amd64_arm'
32-
OpenSSLPlatform: 'VC-WIN32-ARM'
3348
arm64:
3449
Platform: 'arm64'
3550
VCPlatform: 'amd64_arm64'
@@ -44,7 +59,7 @@ jobs:
4459
- template: ./find-tools.yml
4560

4661
- powershell: |
47-
git clone $(SourcesRepo) -b $(SourceTag) --depth 1 .
62+
git clone ${{ parameters.SourcesRepo }} -b ${{ parameters.SourceTag }} --depth 1 .
4863
displayName: 'Check out OpenSSL sources'
4964
5065
- powershell: |
@@ -65,12 +80,12 @@ jobs:
6580
workingDirectory: '$(IntDir)'
6681
displayName: 'Build OpenSSL'
6782
68-
- script: |
69-
call "$(vcvarsall)" $(VCPlatform)
70-
signtool sign /q /a /n "$(SigningCertificate)" /fd sha256 /tr http://timestamp.digicert.com/ /td sha256 /d "OpenSSL for Python" *.dll
71-
workingDirectory: '$(IntDir)'
72-
displayName: 'Sign OpenSSL Build'
73-
condition: and(succeeded(), variables['SigningCertificate'])
83+
- ${{ if ne(parameters.SigningCertificate, 'Unsigned') }}:
84+
- template: sign-files.yml
85+
parameters:
86+
Include: 'lib*.dll'
87+
WorkingDir: $(IntDir)
88+
SigningCertificate: ${{ parameters.SigningCertificate }}
7489

7590
- task: CopyFiles@2
7691
displayName: 'Copy built libraries for upload'

‎windows-release/sign-files.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ steps:
1616

1717
- powershell: |
1818
if ("${{ parameters.Exclude }}") {
19-
$files = (gi ${{ parameters.Include }} -Exclude ${{ parameters.Exclude }})
19+
$files = (dir ${{ parameters.Include }} -Exclude ${{ parameters.Exclude }} -File)
2020
} else {
21-
$files = (gi ${{ parameters.Include }})
21+
$files = (dir ${{ parameters.Include }} -File)
2222
}
2323
AzureSignTool sign -kvu '$(KeyVaultUri)' `
2424
-kvi '$(KeyVaultApplication)' -kvt '$(KeyVaultDirectory)' -kvs '$(KeyVaultSecret)' `
@@ -32,9 +32,9 @@ steps:
3232
- ${{ if parameters.ExtractDir }}:
3333
- powershell: |
3434
if ("${{ parameters.Exclude }}") {
35-
$files = (gi ${{ parameters.Include }} -Exclude ${{ parameters.Exclude }})
35+
$files = (dir ${{ parameters.Include }} -Exclude ${{ parameters.Exclude }} -File 2851 )
3636
} else {
37-
$files = (gi ${{ parameters.Include }})
37+
$files = (dir ${{ parameters.Include }} -File)
3838
}
3939
$c = $files | %{ (Get-AuthenticodeSignature $_).SignerCertificate } | ?{ $_ -ne $null } | select -First 1
4040
if (-not $c) {

‎windows-release/tcltk-build.yml

Lines changed: 56 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,30 @@
1-
name: tcl$(TkSourceTag)_$(Date:yyyyMMdd)$(Rev:.rr)
1+
parameters:
2+
- name: TclSourceTag
3+
displayName: 'Tcl Source Tag'
4+
type: string
5+
- name: TkSourceTag
6+
displayName: 'Tk Source Tag'
7+
type: string
8+
- name: TixSourceTag
9+
displayName: 'Tix Source Tag'
10+
type: string
11+
default: tix-8.4.3.6
12+
- name: SigningCertificate
13+
displayName: "Code signing certificate"
14+
type: string
15+
default: 'PythonSoftwareFoundation'
16+
values:
17+
- 'PythonSoftwareFoundation'
18+
- 'TestSign'
19+
- 'Unsigned'
20+
- name: SourcesRepo
21+
displayName: 'Sources Repository'
22+
type: string
23+
default: 'https://github.com/python/cpython-source-deps'
24+
25+
26+
name: tcltk$(TkSourceTag)_$(Date:yyyyMMdd)$(Rev:.rr)
27+
228

329
resources:
430
repositories:
@@ -7,25 +33,34 @@ resources:
733
name: Python/cpython
834
endpoint: "Steve's github repos"
935

36+
1037
variables:
11-
IntDir: '$(Build.BinariesDirectory)\obj'
12-
ExternalsDir: '$(Build.BinariesDirectory)\externals'
13-
OutDir: '$(Build.ArtifactStagingDirectory)'
14-
Configuration: 'Release'
15-
16-
# MUST BE SET AT QUEUE TIME
17-
# SigningCertificate: 'Python Software Foundation'
18-
# SourcesRepo: 'https://github.com/python/cpython-source-deps'
19-
# TclSourceTag: 'tcl-core-8.6.12.0'
20-
# TkSourceTag: 'tk-8.6.12.0'
21-
# TixSourceTag: 'tix-8.4.3.6'
38+
- group: CPythonSign
39+
- name: IntDir
40+
value: '$(Build.BinariesDirectory)\obj'
41+
- name: ExternalsDir
42+
value: '$(Build.BinariesDirectory)\externals'
43+
- name: OutDir
44+
value: '$(Build.ArtifactStagingDirectory)'
45+
- name: Configuration
46+
value: 'Release'
47+
- name: SigningDescription
48+
value: 'Tcl/Tk for Python (${{ parameters.TclSourceTag }})'
49+
- name: SourcesRepo
50+
value: ${{ parameters.SourcesRepo }}
51+
- name: TclSourceTag
52+
value: ${{ parameters.TclSourceTag }}
53+
- name: TkSourceTag
54+
value: ${{ parameters.TkSourceTag }}
55+
- name: TixSourceTag
56+
value: ${{ parameters.TixSourceTag }}
57+
2258

2359
jobs:
2460
- job: Build_TclTk
2561
displayName: 'Tcl/Tk'
2662
pool:
27-
name: 'Windows Release'
28-
#vmImage: windows-latest
63+
vmImage: windows-latest
2964

3065
workspace:
3166
clean: all
@@ -75,6 +110,13 @@ jobs:
75110
& "$(msbuild)" cpython\PCbuild\tix.vcxproj "@msbuild.rsp" /p:Platform=ARM64 /p:tcltkDir="$(OutDir)\arm64"
76111
displayName: 'Build for arm64'
77112
113+
- ${{ if ne(parameters.SigningCertificate, 'Unsigned') }}:
114+
- template: sign-files.yml
115+
parameters:
116+
Include: '-r *.dll'
117+
WorkingDir: '$(OutDir)'
118+
SigningCertificate: ${{ parameters.SigningCertificate }}
119+
78120
- publish: '$(OutDir)'
79121
artifact: 'tcltk'
80122
displayName: 'Publishing tcltk'

0 commit comments

Comments
 (0)
0