From 68545815b0923ac8547487c7fa5d8a0ba0e82787 Mon Sep 17 00:00:00 2001 From: Dan Legg Date: Tue, 3 Nov 2026 13:41:04 -0800 Subject: [PATCH 1/2] CI: use Node20 ESRP signing tasks Upgrade the bundle and Windows CLI signing task references to ESRP v6. YAML parsing, exact-byte diff checks, and installed task metadata confirm unchanged signing inputs and conditions with a Node20 handler. Live signing remains unverified. Refs #1662 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9f8e152b-45ce-4ea4-a7ba-e55526b64931 --- .../templates/IsolationSession.TestBundle.Build.Job.yml | 2 +- .azure-pipelines/templates/Rust.Build.Job.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.azure-pipelines/templates/IsolationSession.TestBundle.Build.Job.yml b/.azure-pipelines/templates/IsolationSession.TestBundle.Build.Job.yml index bef7ebfaa..8bf115a8f 100644 --- a/.azure-pipelines/templates/IsolationSession.TestBundle.Build.Job.yml +++ b/.azure-pipelines/templates/IsolationSession.TestBundle.Build.Job.yml @@ -399,7 +399,7 @@ jobs: displayName: 'Assemble test bundle' # Test sign (CP-230072) the staged binaries so the vpack ships signed binaries. - - task: EsrpCodeSigning@5 + - task: EsrpCodeSigning@6 displayName: Code Sign inputs: ConnectedServiceName: ${{ parameters.ESRPInfo.serviceName }} diff --git a/.azure-pipelines/templates/Rust.Build.Job.yml b/.azure-pipelines/templates/Rust.Build.Job.yml index c2d9629d3..e0e29a721 100644 --- a/.azure-pipelines/templates/Rust.Build.Job.yml +++ b/.azure-pipelines/templates/Rust.Build.Job.yml @@ -155,7 +155,7 @@ jobs: workingDirectory: $(Build.SourcesDirectory)/src condition: and(eq('${{ item.os }}', 'linux'), eq('${{ item.arch }}', 'x64')) - - task: EsrpCodeSigning@5 + - task: EsrpCodeSigning@6 displayName: Code Sign condition: and(eq(${{ parameters.isOfficialBuild }}, true), eq('${{ item.os }}', 'windows')) inputs: From 24970e2cebe15739056e10569cbea64bf60b5333 Mon Sep 17 00:00:00 2001 From: Dan Legg Date: Tue, 3 Nov 2026 13:43:52 -0800 Subject: [PATCH 2/2] CI: complete ESRP Node20 upgrade for official build jobs Producer preview exposed four remaining Node16 signing steps from the macOS and .NET templates. Upgrade their three source references without changing signing, notarization, framework selection, or existing v6 package signing. Exact-byte and YAML comparisons plus upgraded task input checks pass. Refs #1662 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9f8e152b-45ce-4ea4-a7ba-e55526b64931 --- .azure-pipelines/templates/DotNet.Build.Job.yml | 2 +- .azure-pipelines/templates/Mac.Build.Job.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.azure-pipelines/templates/DotNet.Build.Job.yml b/.azure-pipelines/templates/DotNet.Build.Job.yml index de9354ea1..642777349 100644 --- a/.azure-pipelines/templates/DotNet.Build.Job.yml +++ b/.azure-pipelines/templates/DotNet.Build.Job.yml @@ -109,7 +109,7 @@ jobs: - ${{ if eq(parameters.isOfficialBuild, true) }}: - ${{ each framework in split('net8.0,net10.0', ',') }}: - - task: EsrpCodeSigning@5 + - task: EsrpCodeSigning@6 displayName: Sign Microsoft.Mxc.Sdk.dll (${{ framework }}) inputs: ConnectedServiceName: ${{ parameters.ESRPInfo.serviceName }} diff --git a/.azure-pipelines/templates/Mac.Build.Job.yml b/.azure-pipelines/templates/Mac.Build.Job.yml index 11cf31a58..8df568e71 100644 --- a/.azure-pipelines/templates/Mac.Build.Job.yml +++ b/.azure-pipelines/templates/Mac.Build.Job.yml @@ -113,7 +113,7 @@ jobs: displayName: 'Zip binaries for ESRP signing' condition: and(succeeded(), eq(${{ parameters.isOfficialBuild }}, true)) - - task: EsrpCodeSigning@5 + - task: EsrpCodeSigning@6 displayName: 'Sign macOS binary (ESRP)' condition: and(succeeded(), eq(${{ parameters.isOfficialBuild }}, true)) inputs: @@ -140,7 +140,7 @@ jobs: } ] - - task: EsrpCodeSigning@5 + - task: EsrpCodeSigning@6 displayName: 'Notarize macOS binary (ESRP)' condition: and(succeeded(), eq(${{ parameters.isOfficialBuild }}, true)) inputs: