Skip to content

Commit

Permalink
Add Files Signature Validation after Signed by ESRP (#21949)
Browse files Browse the repository at this point in the history
### Description
<!-- Describe your changes. -->
Files signature validation after signed by ESRP.


### Motivation and Context
<!-- - Why is this change required? What problem does it solve?
- If it fixes an open issue, please link to the issue here. -->
- Add validation after the ESRP process.
- Make sure the targeting pattern/suffix files are signed successfully
by ESRP.
- If the signature is not Valid, then will fail the following stages.
  • Loading branch information
idiskyle authored Sep 2, 2024
1 parent 8c53364 commit b1ae43c
Showing 1 changed file with 56 additions and 0 deletions.
56 changes: 56 additions & 0 deletions tools/ci_build/github/azure-pipelines/templates/win-esrp-dll.yml
Original file line number Diff line number Diff line change
Expand Up @@ -64,3 +64,59 @@ steps:
SessionTimeout: 90
ServiceEndpointUrl: 'https://api.esrp.microsoft.com/api/v2'
MaxConcurrency: 25

- task: PowerShell@2
displayName: 'Signature validation for signed file(s)'
inputs:
targetType: 'inline'
script: |
Write-Host "FolderPath: ${{ parameters.FolderPath }}"
Write-Host "Pattern(s): ${{ parameters.Pattern }}"
if ("${{ parameters.Pattern }}" -eq "")
{
Write-Host "Pattern is empty."
exit 0
}
$valid_flag=$true
$normal_sign_status="Valid"
$patterns="${{ parameters.Pattern }}" -split ','
foreach($pattern_original in $patterns)
{
$pattern=$pattern_original.Trim()
Write-Host "Validating pattern:" $pattern
$file_names=Get-ChildItem -Path ${{ parameters.FolderPath }} .\$pattern -Name -Recurse -Force
foreach($file in $file_names)
{
$file_path=Join-Path ${{ parameters.FolderPath }} -ChildPath $file
$sign=Get-AuthenticodeSignature -FilePath $file_path
$sign_status=$sign.Status.ToString()
Write-Host "File:" $file
Write-Host "Signature Status:" $sign_status
if ($sign_status -ne $normal_sign_status)
{
Write-Host "File" $file "does not have valid signature."
Write-Host "Signature status:" $sign.status
Write-Host "Signature message:" $sign.StatusMessage
$valid_flag=$false
break
}
}
}
if ($valid_flag -eq $false)
{
Write-Host "Signature validation failed."
exit 1
}
else
{
Write-Host "Signature validation passed."
exit 0
}
workingDirectory: ${{ parameters.FolderPath }}

0 comments on commit b1ae43c

Please sign in to comment.