Merge pull request #85545 from microsoft/rpm_signing

Setup ESRP code signing for rpm

build/azure-pipelines/linux/product-build-linux.yml

@@ -118,6 +118,32 @@ steps:
   displayName: Run integration tests
   condition: and(succeeded(), eq(variables['VSCODE_STEP_ON_IT'], 'false'))
 
+- script: |
+    set -e
+    yarn gulp "vscode-linux-x64-build-deb"
+    yarn gulp "vscode-linux-x64-build-rpm"
+    yarn gulp "vscode-linux-x64-prepare-snap"
+  displayName: Build packages
+
+- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
+  inputs:
+    ConnectedServiceName: 'ESRP CodeSign'
+    FolderPath: '.build/linux/rpm/x86_64'
+    Pattern: '*.rpm'
+    signConfigType: inlineSignParams
+    inlineOperation: |
+      [
+        {
+          "keyCode": "CP-450779-Pgp",
+          "operationSetCode": "LinuxSign",
+          "parameters": [ ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        }
+      ]
+    SessionTimeout: 120
+  displayName: Codesign rpm
+
 - script: |
     set -e
     AZURE_DOCUMENTDB_MASTERKEY="$(builds-docdb-key-readwrite)" \

build/azure-pipelines/linux/publish.sh

@@ -31,7 +31,6 @@ node build/azure-pipelines/common/createAsset.js "server-$PLATFORM_LINUX" archiv
 node build/azure-pipelines/common/symbols.js "$VSCODE_MIXIN_PASSWORD" "$VSCODE_HOCKEYAPP_TOKEN" "x64" "$VSCODE_HOCKEYAPP_ID_LINUX64"
 
 # Publish DEB
-yarn gulp "vscode-linux-x64-build-deb"
 PLATFORM_DEB="linux-deb-x64"
 DEB_ARCH="amd64"
 DEB_FILENAME="$(ls $REPO/.build/linux/deb/$DEB_ARCH/deb/)"
@@ -40,7 +39,6 @@ DEB_PATH="$REPO/.build/linux/deb/$DEB_ARCH/deb/$DEB_FILENAME"
 node build/azure-pipelines/common/createAsset.js "$PLATFORM_DEB" package "$DEB_FILENAME" "$DEB_PATH"
 
 # Publish RPM
-yarn gulp "vscode-linux-x64-build-rpm"
 PLATFORM_RPM="linux-rpm-x64"
 RPM_ARCH="x86_64"
 RPM_FILENAME="$(ls $REPO/.build/linux/rpm/$RPM_ARCH/ | grep .rpm)"
@@ -49,8 +47,6 @@ RPM_PATH="$REPO/.build/linux/rpm/$RPM_ARCH/$RPM_FILENAME"
 node build/azure-pipelines/common/createAsset.js "$PLATFORM_RPM" package "$RPM_FILENAME" "$RPM_PATH"
 
 # Publish Snap
-yarn gulp "vscode-linux-x64-prepare-snap"
-
 # Pack snap tarball artifact, in order to preserve file perms
 mkdir -p $REPO/.build/linux/snap-tarball
 SNAP_TARBALL_PATH="$REPO/.build/linux/snap-tarball/snap-x64.tar.gz"