Use arcade signing

Install-Scripts.sln

@@ -3,8 +3,6 @@ Microsoft Visual Studio Solution File, Format Version 12.00
 # Visual Studio Version 17
 VisualStudioVersion = 17.2.32526.322
 MinimumVisualStudioVersion = 10.0.40219.1
-Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "SignScripts", "src\Signing\SignScripts.csproj", "{8335F5A8-00BD-4457-924B-CAF878E5D929}"
-EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Install-Scripts.Test", "tests\Install-Scripts.Test\Install-Scripts.Test.csproj", "{EC847B17-29BB-486C-8BC8-91EA9565B286}"
 EndProject
 Global
@@ -13,10 +11,6 @@ Global
 		Release|Any CPU = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{8335F5A8-00BD-4457-924B-CAF878E5D929}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{8335F5A8-00BD-4457-924B-CAF878E5D929}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{8335F5A8-00BD-4457-924B-CAF878E5D929}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{8335F5A8-00BD-4457-924B-CAF878E5D929}.Release|Any CPU.Build.0 = Release|Any CPU
 		{EC847B17-29BB-486C-8BC8-91EA9565B286}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{EC847B17-29BB-486C-8BC8-91EA9565B286}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{EC847B17-29BB-486C-8BC8-91EA9565B286}.Release|Any CPU.ActiveCfg = Release|Any CPU

azure-pipelines-PR.yml

@@ -13,6 +13,11 @@ stages:
   jobs:
   - template: /eng/common/templates/jobs/jobs.yml
     parameters:
+      artifacts:
+        publish:
+          artifacts: true
+          manifests: true
+      enableMicrobuild: true
       workspace:
         clean: all
       jobs:
@@ -26,21 +31,28 @@ stages:
         - checkout: self
           clean: true
         steps:
-        - script: Build.cmd -test
-          displayName: Run Tests
+        - script: Build.cmd
+            -test
+            -sign
+            -configuration $(_BuildConfig)
+            -bl
+            $(_InternalBuildArgs)
+          displayName: Test and Sign
         - task: PublishTestResults@2
           displayName: Publish Test Results
           inputs:
             testResultsFormat: xUnit
-            testResultsFiles: 'artifacts/TestResults/Debug/*.xml'
+            testResultsFiles: 'artifacts/TestResults/$(_BuildConfig)/*.xml'
             testRunTitle: $(Agent.JobName)
             mergeTestResults: true
           condition: always()
-        - task: PublishBuildArtifacts@1
-          displayName: Publish Logs
+        - task: CopyFiles@2
+          displayName: Gather logs for publish to artifacts
           inputs:
-            PathtoPublish: artifacts/log
-            ArtifactName: Logs_$(Agent.JobName)
+            SourceFolder: 'artifacts/log'
+            Contents: '**'
+            TargetFolder: '$(Build.ArtifactStagingDirectory)/artifacts/log'
+          continueOnError: true
           condition: always()
 
   - job: Linux
@@ -52,13 +64,13 @@ stages:
     - checkout: self
       displayName: Checkout Self
       clean: true
-    - script: ./build.sh --test
+    - script: ./build.sh --test --configuration $(_BuildConfig) -bl
       displayName: Run Tests
     - task: PublishTestResults@2
       displayName: Publish Test Results
       inputs:
         testResultsFormat: xUnit
-        testResultsFiles: 'artifacts/TestResults/Debug/*.xml'
+        testResultsFiles: 'artifacts/TestResults/$(_BuildConfig)/*.xml'
         testRunTitle: $(Agent.JobName)
         mergeTestResults: true
       condition: always()
@@ -77,13 +89,13 @@ stages:
     - checkout: self
       displayName: Checkout Self
       clean: true
-    - script: ./build.sh --test
+    - script: ./build.sh --test --configuration $(_BuildConfig) -bl
       displayName: Run Tests
     - task: PublishTestResults@2
       displayName: Publish Test Results
       inputs:
         testResultsFormat: xUnit
-        testResultsFiles: 'artifacts/TestResults/Debug/*.xml'
+        testResultsFiles: 'artifacts/TestResults/$(_BuildConfig)/*.xml'
         testRunTitle: $(Agent.JobName)
         mergeTestResults: true
       condition: always()

azure-pipelines-official.yml

@@ -59,10 +59,9 @@ extends:
           artifacts:
             publish:
               artifacts: true
-              logs: true
               manifests: true
+          isAssetlessBuild: true
           enableMicrobuild: true
-          enablePublishUsingPipelines: true
           workspace:
             clean: all
           jobs:
@@ -77,8 +76,13 @@ extends:
             - checkout: self
               clean: true
             steps:
-            - script: Build.cmd -test
-              displayName: Run Tests
+            - script: Build.cmd
+                -sign
+                -test
+                -configuration $(_BuildConfig)
+                -bl
+                $(_InternalBuildArgs)
+              displayName: Test and Sign
             - task: PublishTestResults@2
               displayName: Publish Test Results
               inputs:
@@ -87,30 +91,22 @@ extends:
                 testRunTitle: $(Agent.JobName)
                 mergeTestResults: true
               condition: always()
-            - task: 1ES.PublishBuildArtifacts@1
-              displayName: Publish Logs
-              inputs:
-                PathtoPublish: artifacts/log
-                ArtifactName: Logs_$(Agent.JobName)
-              condition: always()
-            - script: eng\common\cibuild.cmd
-                -configuration Release
-                -projects src/Signing/SignScripts.csproj
-                -prepareMachine
-                $(_InternalBuildArgs)
-                /p:Test=false
-                /p:DotNetSignType=$(_SignType)
-                /p:TeamName=$(_TeamName)
-              displayName: Sign scripts
-              env:
-                SIGNTOOL_DISABLE_TELEMETRY: 'true'
             - task: PowerShell@2
               displayName: Validate Signature
               inputs:
                 filePath: eng/common/sdk-task.ps1
-                arguments: -task SigningValidation -restore -msbuildEngine vs 
-                  /p:InputFiles='$(Build.Repository.LocalPath)/artifacts/bin/SignScripts/**/*.ps1'
-                  /p:PackageBasePath='$(Build.Repository.LocalPath)/artifacts/bin/SignScripts/'
+                arguments: -task SigningValidation -restore -msbuildEngine vs
+                  /p:PackageBasePath='$(Build.Repository.LocalPath)/artifacts/bin/SignScripts/$(_BuildConfig)/'
+                  /p:RestoreConfigFile='$(Build.Repository.LocalPath)/NuGet.config'
+            - task: CopyFiles@2
+              displayName: Gather logs for publish to artifacts
+              inputs:
+                SourceFolder: 'artifacts/log'
+                Contents: '**'
+                TargetFolder: '$(Build.ArtifactStagingDirectory)/artifacts/log'
+              continueOnError: true
+              condition: always()
+
       - job: Linux
         timeoutInMinutes: 30
         pool:
@@ -121,7 +117,7 @@ extends:
         - checkout: self
           displayName: Checkout Self
           clean: true
-        - script: ./build.sh --test
+        - script: ./build.sh --test -configuration $(_BuildConfig) -bl
           displayName: Run Tests
         - task: PublishTestResults@2
           displayName: Publish Test Results
@@ -148,7 +144,7 @@ extends:
         - checkout: self
           displayName: Checkout Self
           clean: true
-        - script: ./build.sh --test
+        - script: ./build.sh --test -configuration $(_BuildConfig) -bl
           displayName: Run Tests
         - task: PublishTestResults@2
           displayName: Publish Test Results
@@ -169,8 +165,8 @@ extends:
       parameters:
         enableSigningValidation: false
         enableNugetValidation: false
-        enableSymbolValidation: true
-        enableSourceLinkValidation: true
+        enableSymbolValidation: false
+        enableSourceLinkValidation: false
         publishingInfraVersion: 3
         publishDependsOn:
         - Validate
@@ -189,4 +185,3 @@ extends:
           -TsaCodebaseName "Install-Scripts"
           -TsaPublish $True
           -PoliCheckAdditionalRunConfigParams @("UserExclusionPath < $(Build.SourcesDirectory)\eng\policheck_exclusions.xml")'
-

eng/Signing.props

@@ -1,5 +1,35 @@
 <Project>
+    <PropertyGroup>
+        <_SignOutputDir>$(ArtifactsDir)bin\SignScripts\$(Configuration)\</_SignOutputDir>
+    </PropertyGroup>
+
     <ItemGroup>
-        <ItemsToSign Include="$(ArtifactsDir)bin/SignScripts/$(Configuration)/dotnet-install.ps1" />
+        <!-- Remove default package artifacts - this repo doesn't produce NuGet packages -->
+        <ItemsToSign Remove="@(ItemsToSign)" />
     </ItemGroup>
-</Project>
+
+    <Target Name="PrepareFilesForSigning" BeforeTargets="Sign">
+        <MakeDir Directories="$(_SignOutputDir)" />
+        <MakeDir Directories="$(ArtifactsPackagesDir)" />
+        <Copy SourceFiles="$(RepoRoot)src\dotnet-install.ps1" DestinationFolder="$(_SignOutputDir)" />
+        <Copy SourceFiles="$(RepoRoot)src\dotnet-install.sh" DestinationFolder="$(_SignOutputDir)" />
+    </Target>
+
+    <Target Name="RenameDetachedSignature" AfterTargets="Sign">
+        <Move SourceFiles="$(_SignOutputDir)dotnet-install.sh.sig" DestinationFiles="$(_SignOutputDir)dotnet-install.sig" />
+    </Target>
+
+    <ItemGroup>
+        <CertificatesSignInfo Include="Linux500046PGPDetached" SupportsDetachedSignature="true" />
+    </ItemGroup>
+
+    <ItemGroup>
+        <ItemsToSign Include="$(_SignOutputDir)dotnet-install.ps1" />
+        <ItemsToSign Include="$(_SignOutputDir)dotnet-install.sh" />
+    </ItemGroup>
+
+    <ItemGroup>
+        <FileSignInfo Include="dotnet-install.ps1" CertificateName="Microsoft400" />
+        <FileSignInfo Include="dotnet-install.sh" CertificateName="Linux500046PGPDetached" />
+    </ItemGroup>
+</Project>

eng/common-variables.yml

@@ -8,12 +8,16 @@ variables:
     value: True
   - name: _RunAsInternal
     value: False
-  - name: _InternalBuildArgs
-    value: ''
   - name: _UseBuildManifest
     value: False
   - name: _SignType
     value: test
+  - name: _BuildConfig
+    value: Release
+  - name: _InternalBuildArgs
+    value: /p:DotNetSignType=$(_SignType) 
+      /p:TeamName=$(_TeamName)
+      /p:DotNetPublishUsingPipelines=false
 
   - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
     - name: _RunAsPublic