-
Notifications
You must be signed in to change notification settings - Fork 3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Re-enable codesign for maven packages (#22308)
### Description PR #22217 was reverted. This PR re-enables it. ### Motivation and Context
- Loading branch information
Showing
10 changed files
with
155 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
56 changes: 56 additions & 0 deletions
56
tools/ci_build/github/azure-pipelines/templates/jar-maven-signing-linux.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| parameters: | ||
| - name: JarFileDirectory | ||
| type: string | ||
|
|
||
| steps: | ||
| - task: AzureKeyVault@2 | ||
| displayName: 'Get GnuPG signing keys' | ||
| inputs: | ||
| #The value below is the name of an ADO service connection. | ||
| azureSubscription: 'OnnxrunTimeCodeSign_20240611' | ||
| KeyVaultName: 'ort-release' | ||
| SecretsFilter: 'java-pgp-pwd,java-pgp-key' | ||
| RunAsPreJob: false | ||
|
|
||
| - task: CmdLine@2 | ||
| displayName: 'Sign jar files: GnuPG and sha256' | ||
| inputs: | ||
| workingDirectory: '$(Build.SourcesDirectory)' | ||
| script: | | ||
| #!/bin/bash | ||
| set -e | ||
| jar_file_directory='${{ parameters.JarFileDirectory }}' | ||
| working_directory='$(Build.SourcesDirectory)' | ||
| original_private_key='$(java-pgp-key)' | ||
| original_passphrase='$(java-pgp-pwd)' | ||
| private_key_file=$working_directory/private_key.txt | ||
| passphrase_file=$working_directory/passphrase.txt | ||
| echo "Generating GnuPG key files." | ||
| printf "%s" "$original_private_key" >$private_key_file | ||
| printf "%s" "$original_passphrase" >$passphrase_file | ||
| echo "Generated GnuPG key files." | ||
| echo "Importing GnuPG private key file." | ||
| gpg --batch --import $private_key_file | ||
| echo "Imported GnuPG private key file." | ||
| for file in $(find $jar_file_directory -type f); do | ||
| echo "GnuPG signing to file: $file" | ||
| gpg --pinentry-mode loopback --passphrase-file $passphrase_file -ab $file | ||
| echo "GnuPG signed to file: $file" | ||
| done | ||
| for file in $(find $jar_file_directory -type f); do | ||
| echo "Adding checksum of sha256 to file: $file" | ||
| sha256sum $file | awk '{print $1}' >$file.sha256 | ||
| echo "Added checksum of sha256 to file: $file" | ||
| done | ||
| echo "GnuPG and sha256 signing to files completed." | ||
| echo "Deleting GnuPG key files." | ||
| rm -f $private_key_file | ||
| rm -f $passphrase_file | ||
| echo "Deleted GnuPG key files." |
70 changes: 70 additions & 0 deletions
70
tools/ci_build/github/azure-pipelines/templates/jar-maven-signing-win.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| parameters: | ||
| - name: JarFileDirectory | ||
| type: string | ||
|
|
||
| steps: | ||
| - task: AzureKeyVault@2 | ||
| displayName: 'Get GnuPG signing keys' | ||
| inputs: | ||
| azureSubscription: 'OnnxrunTimeCodeSign_20240611' | ||
| KeyVaultName: 'ort-release' | ||
| SecretsFilter: 'java-pgp-pwd,java-pgp-key' | ||
| RunAsPreJob: false | ||
|
|
||
| - task: PowerShell@2 | ||
| displayName: 'Sign jar files: GnuPG and sha256' | ||
| inputs: | ||
| targetType: 'inline' | ||
| workingDirectory: '$(Build.SourcesDirectory)' | ||
| script: | | ||
| $jar_file_directory = '${{ parameters.JarFileDirectory }}' | ||
| $working_directory = '$(Build.SourcesDirectory)' | ||
| $original_passphrase='$(java-pgp-pwd)' | ||
| $original_private_key='$(java-pgp-key)' | ||
| $gpg_exe_path = "C:\Program Files (x86)\gnupg\bin\gpg.exe" | ||
| $passphrase_file = Join-Path -Path $working_directory -ChildPath "passphrase.txt" | ||
| $private_key_file = Join-Path -Path $working_directory -ChildPath "private_key.txt" | ||
| Write-Host "Generating GnuPG key files." | ||
| Out-File -FilePath $passphrase_file -InputObject $original_passphrase -NoNewline -Encoding ascii | ||
| Out-File -FilePath $private_key_file -InputObject $original_private_key -NoNewline -Encoding ascii | ||
| Write-Host "Generated GnuPG key files." | ||
| Write-Host "Importing GnuPG private key file." | ||
| & $gpg_exe_path --batch --import $private_key_file | ||
| if ($lastExitCode -ne 0) { | ||
| Write-Host -Object "GnuPG importing private key command failed. Exitcode: $exitCode" | ||
| exit $lastExitCode | ||
| } | ||
| Write-Host "Imported GnuPG private key file." | ||
| $targeting_original_files = Get-ChildItem $jar_file_directory -Recurse -Force -File -Name | ||
| foreach ($file in $targeting_original_files) { | ||
| $file_path = Join-Path $jar_file_directory -ChildPath $file | ||
| Write-Host "GnuPG signing to file: "$file_path | ||
| & $gpg_exe_path --pinentry-mode loopback --passphrase-file $passphrase_file -ab $file_path | ||
| if ($lastExitCode -ne 0) { | ||
| Write-Host -Object "GnuPG signing file command failed. Exitcode: $exitCode" | ||
| exit $lastExitCode | ||
| } | ||
| Write-Host "GnuPG signed to file: "$file_path | ||
| } | ||
| $targeting_asc_files = Get-ChildItem $jar_file_directory -Recurse -Force -File -Name | ||
| foreach ($file in $targeting_asc_files) { | ||
| $file_path = Join-Path $jar_file_directory -ChildPath $file | ||
| Write-Host "Adding checksum of sha256 to file: "$file_path | ||
| $file_path_sha256 = $file_path + ".sha256" | ||
| CertUtil -hashfile $file_path SHA256 | ||
| CertUtil -hashfile $file_path SHA256 | find /v `"hash`" | Out-File -FilePath $file_path_sha256 | ||
| Write-Host "Added checksum of sha256 to file: "$file_path | ||
| } | ||
| Write-Host "GnuPG and sha256 signing to files completed." | ||
| Write-Host "Deleting GnuPG key files." | ||
| Remove-Item -Path $passphrase_file | ||
| Remove-Item -Path $private_key_file | ||
| Write-Host "Deleted GnuPG key files." |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters