From a222a0c8d1b9c3dc53cc9633d3a3ecc882eea734 Mon Sep 17 00:00:00 2001 From: Paul Medynski <31868385+paulmedynski@users.noreply.github.com> Date: Fri, 21 Aug 2026 09:21:30 -0300 Subject: [PATCH 1/2] Add assembly signing for Microsoft.SqlServer.Server Introduce the shared signing-key download step and thread isInternalBuild through the CI core so the SqlServer package is strong-name signed on internal Package-mode builds. - Add eng/pipelines/common/steps/download-assembly-signing-key.yml, which exports driverKeyFile or testKeyFile from ADO secure files. - Adopt that step in the OneBranch build and nightly CI package pipelines, renaming keyFile to driverKeyFile. - Declare isInternalBuild in dotnet-sqlclient-ci-core.yml and set it from the CI package- and project-reference pipelines. - Sign the SqlServer package when isInternalBuild is true and referenceType is not Project. --- .../package/sqlclient-ci-package-pipeline.yml | 10 +--- .../steps/download-assembly-signing-key.yml | 39 +++++++++++++ eng/pipelines/dotnet-sqlclient-ci-core.yml | 8 +++ ...qlclient-ci-package-reference-pipeline.yml | 1 + ...qlclient-ci-project-reference-pipeline.yml | 1 + .../jobs/pack-sqlserver-package-ci-job.yml | 56 +++++++++++++++---- .../jobs/validate-signed-package-job.yml | 4 +- .../onebranch/steps/build-buildproj-step.yml | 10 +--- .../build-sqlserver-package-ci-stage.yml | 17 ++++++ 9 files changed, 118 insertions(+), 28 deletions(-) create mode 100644 eng/pipelines/common/steps/download-assembly-signing-key.yml diff --git a/eng/pipelines/ci/package/sqlclient-ci-package-pipeline.yml b/eng/pipelines/ci/package/sqlclient-ci-package-pipeline.yml index ada32431b2..f33614d97f 100644 --- a/eng/pipelines/ci/package/sqlclient-ci-package-pipeline.yml +++ b/eng/pipelines/ci/package/sqlclient-ci-package-pipeline.yml @@ -81,7 +81,7 @@ variables: value: ${{ eq(variables['System.TeamProject'], 'ADO.Net') }} # Signing key argument passed to build.proj. On internal builds this references the secure file - # downloaded by DownloadSecureFile@1; on public builds it expands to empty. + # downloaded by download-assembly-signing-key.yml; on public builds it expands to empty. - name: signingKeyArg ${{ if eq(variables.isInternalBuild, true) }}: value: -p:SigningKeyPath="$(driverKeyFile.secureFilePath)" @@ -125,13 +125,9 @@ jobs: Write-Host 'Done.' displayName: Clean Packages Directory - # On internal builds, download the strong-name signing key. + # On internal builds, download the assembly signing key. - ${{ if eq(variables.isInternalBuild, true) }}: - - task: DownloadSecureFile@1 - displayName: Download Driver Signing Key - inputs: - secureFile: netfxKeypair.snk - name: driverKeyFile + - template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self # Run the Pack target via build.proj. - task: DotNetCoreCLI@2 diff --git a/eng/pipelines/common/steps/download-assembly-signing-key.yml b/eng/pipelines/common/steps/download-assembly-signing-key.yml new file mode 100644 index 0000000000..0a58703319 --- /dev/null +++ b/eng/pipelines/common/steps/download-assembly-signing-key.yml @@ -0,0 +1,39 @@ +################################################################################ +# Licensed to the .NET Foundation under one or more agreements. The .NET +# Foundation licenses this file to you under the MIT license. See the LICENSE +# file in the project root for more information. +################################################################################ + +# Downloads a signing key from ADO secure files. +# +# When isTest is false, downloads the driver signing key and exports it as 'driverKeyFile'. When +# isTest is true, downloads the test signing key and exports it as 'testKeyFile'. +# +# Downstream steps reference the path via: +# +# $(driverKeyFile.secureFilePath) or +# $(testKeyFile.secureFilePath) + +parameters: + + # When false, download the driver signing key. + # When true, download the test signing key. + - name: isTest + type: boolean + default: false + +steps: + + - ${{ if eq(parameters.isTest, false) }}: + - task: DownloadSecureFile@1 + displayName: Download Driver Signing Key + inputs: + secureFile: netfxKeypair.snk + name: driverKeyFile + + - ${{ else }}: + - task: DownloadSecureFile@1 + displayName: Download Test Signing Key + inputs: + secureFile: sqlclient-test-key.snk + name: testKeyFile diff --git a/eng/pipelines/dotnet-sqlclient-ci-core.yml b/eng/pipelines/dotnet-sqlclient-ci-core.yml index 3e68e93325..2f42bf6e41 100644 --- a/eng/pipelines/dotnet-sqlclient-ci-core.yml +++ b/eng/pipelines/dotnet-sqlclient-ci-core.yml @@ -109,6 +109,12 @@ parameters: - detailed - diagnostic + # True when building on the internal ADO.Net project. Internal builds may perform additional or + # different steps, such as assembly signing. + - name: isInternalBuild + type: boolean + default: false + variables: - template: /eng/pipelines/libraries/ci-build-variables.yml@self @@ -149,6 +155,8 @@ stages: buildConfiguration: ${{ parameters.buildConfiguration }} debug: ${{ parameters.debug }} dotnetVerbosity: ${{ parameters.dotnetVerbosity }} + referenceType: ${{ parameters.referenceType }} + isInternalBuild: ${{ parameters.isInternalBuild }} # Build the Logging package, and publish it to the pipeline artifacts # under the given artifact name. This runs in parallel with the Secrets diff --git a/eng/pipelines/dotnet-sqlclient-ci-package-reference-pipeline.yml b/eng/pipelines/dotnet-sqlclient-ci-package-reference-pipeline.yml index c7fa90860f..ea94e62abf 100644 --- a/eng/pipelines/dotnet-sqlclient-ci-package-reference-pipeline.yml +++ b/eng/pipelines/dotnet-sqlclient-ci-package-reference-pipeline.yml @@ -178,3 +178,4 @@ extends: testJobTimeout: ${{ parameters.testJobTimeout }} testSets: ${{ parameters.testSets }} useManagedSNI: ${{ parameters.useManagedSNI }} + isInternalBuild: ${{ eq(variables['System.TeamProject'], 'ADO.Net') }} diff --git a/eng/pipelines/dotnet-sqlclient-ci-project-reference-pipeline.yml b/eng/pipelines/dotnet-sqlclient-ci-project-reference-pipeline.yml index 54a1b0e639..757a5b5dd8 100644 --- a/eng/pipelines/dotnet-sqlclient-ci-project-reference-pipeline.yml +++ b/eng/pipelines/dotnet-sqlclient-ci-project-reference-pipeline.yml @@ -178,3 +178,4 @@ extends: testJobTimeout: ${{ parameters.testJobTimeout }} testSets: ${{ parameters.testSets }} useManagedSNI: ${{ parameters.useManagedSNI }} + isInternalBuild: ${{ eq(variables['System.TeamProject'], 'ADO.Net') }} diff --git a/eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml b/eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml index 4f619b3f1b..dcf5c3b6c9 100644 --- a/eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml +++ b/eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml @@ -49,6 +49,21 @@ parameters: - detailed - diagnostic + # The C# project reference type to use when building and packing the packages. + - name: referenceType + type: string + default: Project + values: + # Reference sibling packages as NuGet packages. + - Package + # Reference sibling packages as C# projects. + - Project + + # True when building on the internal ADO.Net project. + - name: isInternalBuild + type: boolean + default: false + jobs: - job: pack_sqlserver_package_job @@ -94,19 +109,36 @@ jobs: parameters: debug: ${{ parameters.debug }} + # Download the assembly signing key for internal Package-mode builds. + - ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}: + - template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self + # Create the NuGet packages. - - task: DotNetCoreCLI@2 - displayName: Create NuGet Package - inputs: - command: pack - packagesToPack: $(project) - configurationToPack: ${{ parameters.buildConfiguration }} - packDirectory: $(dotnetPackagesDir) - verbosityToPack: ${{ parameters.dotnetVerbosity }} - # BuildNumber supplies the revision component of FileVersion - # (Major.Minor.Patch.Revision). Without it, FileVersionBuildNumber - # defaults to 0 and the assembly is stamped Major.Minor.Patch.0. - buildProperties: SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }};BuildNumber=$(Build.BuildNumber) + # + # BuildNumber supplies the revision component of FileVersion + # (Major.Minor.Patch.Revision). Without it, FileVersionBuildNumber + # defaults to 0 and the assembly is stamped Major.Minor.Patch.0. + - ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}: + - task: DotNetCoreCLI@2 + displayName: Create NuGet Package + inputs: + command: pack + packagesToPack: $(project) + configurationToPack: ${{ parameters.buildConfiguration }} + packDirectory: $(dotnetPackagesDir) + verbosityToPack: ${{ parameters.dotnetVerbosity }} + buildProperties: SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }};BuildNumber=$(Build.BuildNumber);SigningKeyPath=$(driverKeyFile.secureFilePath) + + - ${{ else }}: + - task: DotNetCoreCLI@2 + displayName: Create NuGet Package + inputs: + command: pack + packagesToPack: $(project) + configurationToPack: ${{ parameters.buildConfiguration }} + packDirectory: $(dotnetPackagesDir) + verbosityToPack: ${{ parameters.dotnetVerbosity }} + buildProperties: SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }};BuildNumber=$(Build.BuildNumber) - task: PublishPipelineArtifact@1 displayName: Publish Pipeline Artifact diff --git a/eng/pipelines/onebranch/jobs/validate-signed-package-job.yml b/eng/pipelines/onebranch/jobs/validate-signed-package-job.yml index afa5aa5918..0769e2093c 100644 --- a/eng/pipelines/onebranch/jobs/validate-signed-package-job.yml +++ b/eng/pipelines/onebranch/jobs/validate-signed-package-job.yml @@ -157,8 +157,8 @@ jobs: $nugetPackageInstallPath = "${{ variables.nugetPackageInstallPath }}" echo "nugetPackageInstallPath= $nugetPackageInstallPath" - # Verify strong name signing ##################################### - echo "> 1. Verifying strong name signing of DLLs ..." + # Verify strong-name signing ################################### + echo "> 1. Verifying strong-name signing of DLLs ..." # @TODO: This path seems brittle to VS upgrades, can we make it more flexible? $snPath = "C:\Program Files (x86)\Microsoft SDKs\Windows\*\bin\NETFX 4.8.1 Tools\sn.exe" diff --git a/eng/pipelines/onebranch/steps/build-buildproj-step.yml b/eng/pipelines/onebranch/steps/build-buildproj-step.yml index 5cfc809772..83f14aaacc 100644 --- a/eng/pipelines/onebranch/steps/build-buildproj-step.yml +++ b/eng/pipelines/onebranch/steps/build-buildproj-step.yml @@ -57,12 +57,8 @@ parameters: type: string steps: - # Download the strong name signing key from secure file storage - - task: DownloadSecureFile@1 - displayName: 'Download Signing Key' - inputs: - secureFile: 'netfxKeypair.snk' - name: keyFile + # Download the assembly signing key from secure file storage. + - template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self - task: DotNetCoreCLI@2 displayName: 'build.proj - Build${{ parameters.packageShortName }}' @@ -74,7 +70,7 @@ steps: -p:Configuration=${{ parameters.buildConfiguration }} -p:ReferenceType=Package -p:SkipDependencyPack=true - -p:SigningKeyPath="$(keyFile.secureFilePath)" + -p:SigningKeyPath="$(driverKeyFile.secureFilePath)" -p:BuildNumber="${{ parameters.revision }}" -p:PackageVersion${{ parameters.versionPropertySuffix }}="${{ parameters.packageVersion }}" ${{ parameters.dependencyArguments }} diff --git a/eng/pipelines/stages/build-sqlserver-package-ci-stage.yml b/eng/pipelines/stages/build-sqlserver-package-ci-stage.yml index 3a1417185d..66fe07cf36 100644 --- a/eng/pipelines/stages/build-sqlserver-package-ci-stage.yml +++ b/eng/pipelines/stages/build-sqlserver-package-ci-stage.yml @@ -59,6 +59,21 @@ parameters: - detailed - diagnostic + # The C# project reference type to use when building and packing the packages. + - name: referenceType + type: string + default: Project + values: + # Reference sibling packages as NuGet packages. + - Package + # Reference sibling packages as C# projects. + - Project + + # True when building on the internal ADO.Net project. + - name: isInternalBuild + type: boolean + default: false + stages: - stage: build_sqlserver_package_stage @@ -83,3 +98,5 @@ stages: # The version is computed by this stage (see the sqlServerPackageVersion variable above). sqlServerPackageVersion: $(sqlServerPackageVersion) dotnetVerbosity: ${{ parameters.dotnetVerbosity }} + referenceType: ${{ parameters.referenceType }} + isInternalBuild: ${{ parameters.isInternalBuild }} From ea6f3a1d272ed04370e4796b8545875c2d322247 Mon Sep 17 00:00:00 2001 From: Paul Medynski <31868385+paulmedynski@users.noreply.github.com> Date: Fri, 21 Aug 2026 17:56:31 -0300 Subject: [PATCH 2/2] Address PR 4566 review feedback in the SqlServer pack job - Quote SigningKeyPath in buildProperties so the secure-file path is robust to spaces, matching build-buildproj-step.yml and sqlclient-ci-package-pipeline.yml. - Move the BuildNumber/FileVersion note directly above buildProperties in both the signed and unsigned pack branches. No change to signing behaviour: signing stays gated on internal Package-reference builds. --- eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml b/eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml index dcf5c3b6c9..5e71c98d40 100644 --- a/eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml +++ b/eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml @@ -114,10 +114,6 @@ jobs: - template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self # Create the NuGet packages. - # - # BuildNumber supplies the revision component of FileVersion - # (Major.Minor.Patch.Revision). Without it, FileVersionBuildNumber - # defaults to 0 and the assembly is stamped Major.Minor.Patch.0. - ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}: - task: DotNetCoreCLI@2 displayName: Create NuGet Package @@ -127,7 +123,10 @@ jobs: configurationToPack: ${{ parameters.buildConfiguration }} packDirectory: $(dotnetPackagesDir) verbosityToPack: ${{ parameters.dotnetVerbosity }} - buildProperties: SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }};BuildNumber=$(Build.BuildNumber);SigningKeyPath=$(driverKeyFile.secureFilePath) + # BuildNumber supplies the revision component of FileVersion + # (Major.Minor.Patch.Revision). Without it, FileVersionBuildNumber + # defaults to 0 and the assembly is stamped Major.Minor.Patch.0. + buildProperties: SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }};BuildNumber=$(Build.BuildNumber);SigningKeyPath="$(driverKeyFile.secureFilePath)" - ${{ else }}: - task: DotNetCoreCLI@2 @@ -138,6 +137,9 @@ jobs: configurationToPack: ${{ parameters.buildConfiguration }} packDirectory: $(dotnetPackagesDir) verbosityToPack: ${{ parameters.dotnetVerbosity }} + # BuildNumber supplies the revision component of FileVersion + # (Major.Minor.Patch.Revision). Without it, FileVersionBuildNumber + # defaults to 0 and the assembly is stamped Major.Minor.Patch.0. buildProperties: SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }};BuildNumber=$(Build.BuildNumber) - task: PublishPipelineArtifact@1