Skip to content

[debug-certificate-manager] add support for signed vsix publishing #5308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bmiddha merged 5 commits into from
Aug 20, 2025
Merged

[debug-certificate-manager] add support for signed vsix publishing #5308

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
53cd5d2
update extension publishing
bmiddha Aug 18, 2025
4f249cf
fix windows path issue
bmiddha Aug 18, 2025
2fef942
add config docs
bmiddha Aug 18, 2025
52a4b1d
pr feedback
bmiddha Aug 19, 2025
9eb98c1
add publish unsigned pipeline parameter
bmiddha Aug 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions ...changes/@rushstack/heft-vscode-extension-plugin/bmiddha-vscode-esrp_2025-08-13-08-06.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"changes": [
{
"packageName": "@rushstack/heft-vscode-extension-plugin",
"comment": "Add support for verifying extension signature.",
"type": "patch"
}
],
"packageName": "@rushstack/heft-vscode-extension-plugin"
}
10 changes: 10 additions & 0 deletions ...on/changes/@rushstack/heft-vscode-extension-rig/bmiddha-vscode-esrp_2025-08-13-09-22.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"changes": [
{
"packageName": "@rushstack/heft-vscode-extension-rig",
"comment": "Add support for verifying extension signature.",
"type": "patch"
}
],
"packageName": "@rushstack/heft-vscode-extension-rig"
}
43 changes: 27 additions & 16 deletions common/config/azure-pipelines/vscode-extension-publish.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,21 @@ parameters:
- name: shouldPublish
type: boolean
default: true
- name: publishUnsigned
type: boolean
default: true
- name: ExtensionPublishConfig
type: object
default:
- key: 'debug-certificate-manager-vscode-extension'
vsixPath: 'dist/vsix/packaged.vsix'
manifestPath: 'dist/vsix/extension-manifest.json'
projectRelativeAssetsDir: dist/vsix
vsixPath: 'extension.vsix'
manifestPath: 'extension.signature.manifest'
projectPath: '$(Build.SourcesDirectory)/vscode-extensions/debug-certificate-manager-vscode-extension'
- key: 'rush-vscode-extension'
vsixPath: 'dist/vsix/packaged.vsix'
manifestPath: 'dist/vsix/extension-manifest.json'
projectRelativeAssetsDir: dist/vsix
vsixPath: 'extension.vsix'
manifestPath: 'extension.signature.manifest'
projectPath: '$(Build.SourcesDirectory)/vscode-extensions/rush-vscode-extension'

resources:
Expand Down Expand Up @@ -68,20 +73,20 @@ extends:
az rest -u https://app.vssps.visualstudio.com/_apis/profile/profiles/me --resource 499b84ac-1321-427f-aa17-267ca6975798

- ${{ each extension in parameters.ExtensionPublishConfig }}:
- bash: cp ${{ extension.manifestPath }} ${{ extension.projectPath }}/extension.signature.p7s
workingDirectory: ${{ extension.projectPath }}
- bash: cp ${{ extension.manifestPath }} extension.signature.p7s
workingDirectory: ${{ extension.projectPath }}/${{ extension.projectRelativeAssetsDir }}
displayName: 'Prepare manifest for signing: ${{ extension.key }}'

- task: EsrpCodeSigning@5
- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@5
displayName: 'ESRP CodeSigning'
inputs:
connectedservicename: '' # TODO
AppRegistrationClientId: '' # TODO
AppRegistrationTenantId: '' # TODO
AuthAKVName: '' # TODO
AuthCertName: '' # TODO
AuthSignCertName: '' # TODO
FolderPath: '${{ extension.projectPath }}'
connectedservicename: 'rushstack-esrp-codesign-client'
AppRegistrationClientId: 'ceb49532-1c6a-445c-8d34-91ab779bdf50'
AppRegistrationTenantId: 'cdc5aeea-15c5-4db6-b079-fcadd2505dc2'
AuthAKVName: 'rushstack-esrp'
AuthCertName: 'ceb49532-rushstack-esrp'
AuthSignCertName: 'rushstack-vs-marketplace-publisher-signing-certificate'
FolderPath: '${{ extension.projectPath }}/${{ extension.projectRelativeAssetsDir }}'
Pattern: 'extension.signature.p7s'
signConfigType: inlineSignParams
inlineOperation: |
Expand All @@ -95,12 +100,18 @@ extends:
}
]

- bash: node node_modules/@rushstack/heft/lib/start.js verify-signature --vsix-path ${{ extension.projectRelativeAssetsDir }}/${{ extension.vsixPath }} --manifest-path ${{ extension.projectRelativeAssetsDir }}/${{ extension.manifestPath }} --signature-path ${{ extension.projectRelativeAssetsDir }}/extension.signature.p7s
displayName: 'Verify Signature: ${{ extension.key }}'
workingDirectory: ${{ extension.projectPath }}

- task: AzureCLI@2
displayName: 'Publish VSIX: ${{ extension.key }}'
inputs:
azureSubscription: rushstack-vscode-publish
scriptType: 'bash'
scriptLocation: 'inlineScript'
inlineScript: |
node node_modules/@rushstack/heft/lib/start.js publish-vsix --vsix-path ${{ extension.vsixPath }} --manifest-path ${{ extension.projectPath }}/extension.manifest --signature-path ${{ extension.projectPath }}/extension.signature.p7s
workingDirectory: ${{ extension.projectPath }}
${{ if parameters.publishUnsigned }}:
inlineScript: node node_modules/@rushstack/heft/lib/start.js publish-vsix --vsix-path ${{ extension.projectRelativeAssetsDir }}/${{ extension.vsixPath }} --publish-unsigned
${{ else }}:
inlineScript: node node_modules/@rushstack/heft/lib/start.js publish-vsix --vsix-path ${{ extension.projectRelativeAssetsDir }}/${{ extension.vsixPath }} --manifest-path ${{ extension.projectRelativeAssetsDir }}/${{ extension.manifestPath }} --signature-path ${{ extension.projectRelativeAssetsDir }}/extension.signature.p7s
Loading
Loading