[release/v7.4.20] Use Custom Validation Policy for vPack Pipeline - #27913
Merged
Justin Chung (jshigetomi) merged 1 commit intoSep 1, 2026
Merged
Justin Chung (jshigetomi) merged 1 commit into
Justin Chung (jshigetomi) merged 1 commit into
Conversation
Co-authored-by: Justin Chung <chungjustin@microsoft.com> Copilot-Session: 99e6a033-65fd-4a39-9a71-2ce9b7657c10 (cherry picked from commit bc487bf)
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
Backport to release/v7.4.20 that updates the vPack Azure Pipeline to use a repository-managed custom CodeSign validation policy, explicitly sign the vPack payload with the Windows build tools certificate, and then validate the payload against that tools-only policy.
Changes:
- Disable injected OneBranch CodeSign validation for the vPack job and exclude the vPack payload from forced validation adapters.
- Extend signing to cover the complete vPack payload with the Windows build tools certificate and run explicit CodeSign validation using a custom policy file.
- Narrow the repository CodeSign policy (
.config/codesignpolicy.xml) to allow only the Windows build tools publisher and remove the prior broad signer list.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .pipelines/templates/stages/PowerShell-vPack-Stages.yml | Disables injected validation, signs full vPack payload with tools cert, and runs explicit validation with the custom policy. |
| .pipelines/templates/obp-file-signing.yml | Adds parameters to control third-party signing profile and optionally sign all binaries with that profile. |
| .pipelines/PowerShell-vPack-Official.yml | Removes the prior global SDL custom-policy configuration in favor of the repo-managed validation flow. |
| .config/codesignpolicy.xml | Replaces the broad policy with a tools-only signer policy and updates policy metadata/version. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+117
to
+122
| $signAllBinaries = [System.Convert]::ToBoolean('${{ parameters.SignAllBinariesWithThirdPartyProfile }}') | ||
| if ($signAllBinaries) { | ||
| $missingSignatures = $signatures | Select-Object -ExpandProperty Path | ||
| } else { | ||
| $missingSignatures = $signatures | Where-Object { $_.status -eq 'notsigned' -or $_.SignerCertificate.Issuer -notmatch $testCert -or $_.SignerCertificate.Issuer -notmatch $officialIssuerPattern} | Select-Object -ExpandProperty Path | ||
| } |
Justin Chung (jshigetomi)
added
the
CL-BuildPackaging
Aditya Patwardhan (adityapatwardhan)
approved these changes
Sep 1, 2026
Justin Chung (jshigetomi)
merged commit Sep 1, 2026
50a301f
into
PowerShell:release/v7.4.20
35 of 36 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #27911 to
release/v7.4.20.This replaces the branch's superseded broad custom CodeSign policy with the merged tools-only policy and signs the complete vPack payload with the Windows build tools certificate before explicit validation.