From 9b8dbb147cd0a103830eaac64205cdad644054a9 Mon Sep 17 00:00:00 2001 From: "Patrick Nelson (VS)" Date: Wed, 26 Aug 2026 15:26:09 -0700 Subject: [PATCH 1/2] Fix signed build PME authentication Pass the DevDiv PME service connection to real signing jobs so MicroBuild can retrieve its ESRP authentication certificate. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d733ef65-e5dd-4c4c-91e6-85c8b01678e2 --- build/yaml/jobs/binaries.yaml | 2 ++ build/yaml/jobs/linux/packages.yaml | 2 ++ build/yaml/jobs/packages.yaml | 3 +++ build/yaml/jobs/windows/binaries.yaml | 3 ++- build/yaml/jobs/windows/packages.yaml | 2 ++ build/yaml/pipelines/signed.yaml | 1 + build/yaml/stages/build_and_package.yaml | 4 ++++ build/yaml/steps/microbuild/signing.yaml | 5 ++++- 8 files changed, 20 insertions(+), 2 deletions(-) diff --git a/build/yaml/jobs/binaries.yaml b/build/yaml/jobs/binaries.yaml index fe0b5e0e..03034610 100644 --- a/build/yaml/jobs/binaries.yaml +++ b/build/yaml/jobs/binaries.yaml @@ -10,6 +10,7 @@ parameters: Configuration: Both IsMicroBuildInternal: false OneESPT: false + SigningPMEServiceConnection: '' jobs: # Windows Binaries @@ -17,6 +18,7 @@ jobs: parameters: IndexSources: ${{ parameters.IndexSources }} SignType: ${{ parameters.SignType }} + SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }} OneESPT: ${{ parameters.OneESPT }} # Filter out Tests for Signed Builds diff --git a/build/yaml/jobs/linux/packages.yaml b/build/yaml/jobs/linux/packages.yaml index c963658a..68578957 100644 --- a/build/yaml/jobs/linux/packages.yaml +++ b/build/yaml/jobs/linux/packages.yaml @@ -8,6 +8,7 @@ parameters: IsMicroBuildInternal: false MatrixStrategy: {} OneESPT: false + SigningPMEServiceConnection: '' jobs: - job: Linux_Packages @@ -37,6 +38,7 @@ jobs: - template: ../../steps/microbuild/signing.yaml@self parameters: SignType: ${{ parameters.SignType }} + SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} - template: ../../steps/linux/packages.yaml@self parameters: diff --git a/build/yaml/jobs/packages.yaml b/build/yaml/jobs/packages.yaml index 9f48019d..13b927b8 100644 --- a/build/yaml/jobs/packages.yaml +++ b/build/yaml/jobs/packages.yaml @@ -9,12 +9,14 @@ parameters: Configuration: Both IsMicroBuildInternal: false OneESPT: false + SigningPMEServiceConnection: '' jobs: # Windows Packages - template: windows/packages.yaml@self parameters: SignType: ${{ parameters.SignType }} + SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }} OneESPT: ${{ parameters.OneESPT }} MatrixStrategy: @@ -47,6 +49,7 @@ jobs: - template: linux/packages.yaml@self parameters: SignType: ${{ parameters.SignType }} + SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }} OneESPT: ${{ parameters.OneESPT }} MatrixStrategy: diff --git a/build/yaml/jobs/windows/binaries.yaml b/build/yaml/jobs/windows/binaries.yaml index 94046f8e..c6bc7431 100644 --- a/build/yaml/jobs/windows/binaries.yaml +++ b/build/yaml/jobs/windows/binaries.yaml @@ -13,6 +13,7 @@ parameters: CopyFilters: | ** OneESPT: false + SigningPMEServiceConnection: '' jobs: - job: Windows @@ -45,6 +46,7 @@ jobs: - template: ../../steps/microbuild/signing.yaml@self parameters: SignType: ${{ parameters.SignType }} + SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} - template: ../../steps/windows/binaries.yaml@self parameters: @@ -88,4 +90,3 @@ jobs: - template: ../../steps/microbuild/cleanup.yaml@self - template: ../../steps/azuredevops/componentgovernance.yaml@self - diff --git a/build/yaml/jobs/windows/packages.yaml b/build/yaml/jobs/windows/packages.yaml index 8af5d876..eb304d0e 100644 --- a/build/yaml/jobs/windows/packages.yaml +++ b/build/yaml/jobs/windows/packages.yaml @@ -8,6 +8,7 @@ parameters: IsMicroBuildInternal: false MatrixStrategy: {} OneESPT: false + SigningPMEServiceConnection: '' jobs: - job: Windows_Packages @@ -37,6 +38,7 @@ jobs: - template: ../../steps/microbuild/signing.yaml@self parameters: SignType: ${{ parameters.SignType }} + SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} - template: ../../steps/azuredevops/downloadbuildartifacts.yaml@self parameters: diff --git a/build/yaml/pipelines/signed.yaml b/build/yaml/pipelines/signed.yaml index 30aae928..feb62a05 100644 --- a/build/yaml/pipelines/signed.yaml +++ b/build/yaml/pipelines/signed.yaml @@ -39,6 +39,7 @@ extends: IncludeTests: false Configuration: Release SignType: $(SignType) # NOTE this string won't be replaced until runtime + SigningPMEServiceConnection: 6cc74545-d7b9-4050-9dfa-ebefcc8961ea - stage: PostPackage jobs: diff --git a/build/yaml/stages/build_and_package.yaml b/build/yaml/stages/build_and_package.yaml index 16b41e4e..e216d577 100644 --- a/build/yaml/stages/build_and_package.yaml +++ b/build/yaml/stages/build_and_package.yaml @@ -4,6 +4,7 @@ parameters: IncludeTests: true Configuration: Both SignType: None + SigningPMEServiceConnection: '' stages: - stage: Build @@ -12,11 +13,13 @@ stages: - template: ../jobs/binaries.yaml@self parameters: SignType: ${{ parameters.SignType}} + SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} IndexSources: true Configuration: ${{ parameters.Configuration }} OneESPT: ${{ parameters.OneESPT }} IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }} + - ${{ if eq('true', parameters.IncludeTests) }}: - stage: Test dependsOn: Build @@ -34,6 +37,7 @@ stages: - template: ../jobs/packages.yaml@self parameters: SignType: ${{ parameters.SignType}} + SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} Configuration: ${{ parameters.Configuration }} OneESPT: ${{ parameters.OneESPT }} IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }} \ No newline at end of file diff --git a/build/yaml/steps/microbuild/signing.yaml b/build/yaml/steps/microbuild/signing.yaml index c0d7d5ba..45485fb8 100644 --- a/build/yaml/steps/microbuild/signing.yaml +++ b/build/yaml/steps/microbuild/signing.yaml @@ -5,6 +5,7 @@ parameters: SignType: None + SigningPMEServiceConnection: '' steps: @@ -19,4 +20,6 @@ steps: condition: and(succeeded(), in(variables['SignType'], 'Real', 'Test')) inputs: signType: ${{ parameters.SignType }} - zipSources: false \ No newline at end of file + zipSources: false + ${{ if ne(parameters.SigningPMEServiceConnection, '') }}: + ConnectedPMEServiceName: ${{ parameters.SigningPMEServiceConnection }} From d6567305940f318bbb1539a388e6b6213d324fe7 Mon Sep 17 00:00:00 2001 From: "Patrick Nelson (VS)" Date: Wed, 26 Aug 2026 16:29:17 -0700 Subject: [PATCH 2/2] Use documented PME parameter name Rename the signing template passthrough to ConnectedPMEServiceName so it matches the MicroBuildSigningPlugin input and migration guidance. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d733ef65-e5dd-4c4c-91e6-85c8b01678e2 --- build/yaml/jobs/binaries.yaml | 4 ++-- build/yaml/jobs/linux/packages.yaml | 4 ++-- build/yaml/jobs/packages.yaml | 6 +++--- build/yaml/jobs/windows/binaries.yaml | 4 ++-- build/yaml/jobs/windows/packages.yaml | 4 ++-- build/yaml/pipelines/signed.yaml | 2 +- build/yaml/stages/build_and_package.yaml | 6 +++--- build/yaml/steps/microbuild/signing.yaml | 6 +++--- 8 files changed, 18 insertions(+), 18 deletions(-) diff --git a/build/yaml/jobs/binaries.yaml b/build/yaml/jobs/binaries.yaml index 03034610..b0f2375d 100644 --- a/build/yaml/jobs/binaries.yaml +++ b/build/yaml/jobs/binaries.yaml @@ -10,7 +10,7 @@ parameters: Configuration: Both IsMicroBuildInternal: false OneESPT: false - SigningPMEServiceConnection: '' + ConnectedPMEServiceName: '' jobs: # Windows Binaries @@ -18,7 +18,7 @@ jobs: parameters: IndexSources: ${{ parameters.IndexSources }} SignType: ${{ parameters.SignType }} - SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} + ConnectedPMEServiceName: ${{ parameters.ConnectedPMEServiceName }} IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }} OneESPT: ${{ parameters.OneESPT }} # Filter out Tests for Signed Builds diff --git a/build/yaml/jobs/linux/packages.yaml b/build/yaml/jobs/linux/packages.yaml index 68578957..68fe9274 100644 --- a/build/yaml/jobs/linux/packages.yaml +++ b/build/yaml/jobs/linux/packages.yaml @@ -8,7 +8,7 @@ parameters: IsMicroBuildInternal: false MatrixStrategy: {} OneESPT: false - SigningPMEServiceConnection: '' + ConnectedPMEServiceName: '' jobs: - job: Linux_Packages @@ -38,7 +38,7 @@ jobs: - template: ../../steps/microbuild/signing.yaml@self parameters: SignType: ${{ parameters.SignType }} - SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} + ConnectedPMEServiceName: ${{ parameters.ConnectedPMEServiceName }} - template: ../../steps/linux/packages.yaml@self parameters: diff --git a/build/yaml/jobs/packages.yaml b/build/yaml/jobs/packages.yaml index 13b927b8..0a44d4cf 100644 --- a/build/yaml/jobs/packages.yaml +++ b/build/yaml/jobs/packages.yaml @@ -9,14 +9,14 @@ parameters: Configuration: Both IsMicroBuildInternal: false OneESPT: false - SigningPMEServiceConnection: '' + ConnectedPMEServiceName: '' jobs: # Windows Packages - template: windows/packages.yaml@self parameters: SignType: ${{ parameters.SignType }} - SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} + ConnectedPMEServiceName: ${{ parameters.ConnectedPMEServiceName }} IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }} OneESPT: ${{ parameters.OneESPT }} MatrixStrategy: @@ -49,7 +49,7 @@ jobs: - template: linux/packages.yaml@self parameters: SignType: ${{ parameters.SignType }} - SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} + ConnectedPMEServiceName: ${{ parameters.ConnectedPMEServiceName }} IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }} OneESPT: ${{ parameters.OneESPT }} MatrixStrategy: diff --git a/build/yaml/jobs/windows/binaries.yaml b/build/yaml/jobs/windows/binaries.yaml index c6bc7431..6e9b767d 100644 --- a/build/yaml/jobs/windows/binaries.yaml +++ b/build/yaml/jobs/windows/binaries.yaml @@ -13,7 +13,7 @@ parameters: CopyFilters: | ** OneESPT: false - SigningPMEServiceConnection: '' + ConnectedPMEServiceName: '' jobs: - job: Windows @@ -46,7 +46,7 @@ jobs: - template: ../../steps/microbuild/signing.yaml@self parameters: SignType: ${{ parameters.SignType }} - SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} + ConnectedPMEServiceName: ${{ parameters.ConnectedPMEServiceName }} - template: ../../steps/windows/binaries.yaml@self parameters: diff --git a/build/yaml/jobs/windows/packages.yaml b/build/yaml/jobs/windows/packages.yaml index eb304d0e..c10b3886 100644 --- a/build/yaml/jobs/windows/packages.yaml +++ b/build/yaml/jobs/windows/packages.yaml @@ -8,7 +8,7 @@ parameters: IsMicroBuildInternal: false MatrixStrategy: {} OneESPT: false - SigningPMEServiceConnection: '' + ConnectedPMEServiceName: '' jobs: - job: Windows_Packages @@ -38,7 +38,7 @@ jobs: - template: ../../steps/microbuild/signing.yaml@self parameters: SignType: ${{ parameters.SignType }} - SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} + ConnectedPMEServiceName: ${{ parameters.ConnectedPMEServiceName }} - template: ../../steps/azuredevops/downloadbuildartifacts.yaml@self parameters: diff --git a/build/yaml/pipelines/signed.yaml b/build/yaml/pipelines/signed.yaml index feb62a05..cb7d4b07 100644 --- a/build/yaml/pipelines/signed.yaml +++ b/build/yaml/pipelines/signed.yaml @@ -39,7 +39,7 @@ extends: IncludeTests: false Configuration: Release SignType: $(SignType) # NOTE this string won't be replaced until runtime - SigningPMEServiceConnection: 6cc74545-d7b9-4050-9dfa-ebefcc8961ea + ConnectedPMEServiceName: 6cc74545-d7b9-4050-9dfa-ebefcc8961ea - stage: PostPackage jobs: diff --git a/build/yaml/stages/build_and_package.yaml b/build/yaml/stages/build_and_package.yaml index e216d577..66aaa4cb 100644 --- a/build/yaml/stages/build_and_package.yaml +++ b/build/yaml/stages/build_and_package.yaml @@ -4,7 +4,7 @@ parameters: IncludeTests: true Configuration: Both SignType: None - SigningPMEServiceConnection: '' + ConnectedPMEServiceName: '' stages: - stage: Build @@ -13,7 +13,7 @@ stages: - template: ../jobs/binaries.yaml@self parameters: SignType: ${{ parameters.SignType}} - SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} + ConnectedPMEServiceName: ${{ parameters.ConnectedPMEServiceName }} IndexSources: true Configuration: ${{ parameters.Configuration }} OneESPT: ${{ parameters.OneESPT }} @@ -37,7 +37,7 @@ stages: - template: ../jobs/packages.yaml@self parameters: SignType: ${{ parameters.SignType}} - SigningPMEServiceConnection: ${{ parameters.SigningPMEServiceConnection }} + ConnectedPMEServiceName: ${{ parameters.ConnectedPMEServiceName }} Configuration: ${{ parameters.Configuration }} OneESPT: ${{ parameters.OneESPT }} IsMicroBuildInternal: ${{ parameters.IsMicroBuildInternal }} \ No newline at end of file diff --git a/build/yaml/steps/microbuild/signing.yaml b/build/yaml/steps/microbuild/signing.yaml index 45485fb8..63ab5d82 100644 --- a/build/yaml/steps/microbuild/signing.yaml +++ b/build/yaml/steps/microbuild/signing.yaml @@ -5,7 +5,7 @@ parameters: SignType: None - SigningPMEServiceConnection: '' + ConnectedPMEServiceName: '' steps: @@ -21,5 +21,5 @@ steps: inputs: signType: ${{ parameters.SignType }} zipSources: false - ${{ if ne(parameters.SigningPMEServiceConnection, '') }}: - ConnectedPMEServiceName: ${{ parameters.SigningPMEServiceConnection }} + ${{ if ne(parameters.ConnectedPMEServiceName, '') }}: + ConnectedPMEServiceName: ${{ parameters.ConnectedPMEServiceName }}