diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt index a40c04119d..a5a2db2128 100644 --- a/.github/actions/spelling/expect.txt +++ b/.github/actions/spelling/expect.txt @@ -35,6 +35,7 @@ ATL AUrl Authenticode azurewebsites +Azure-Pipelines-1ESPT-ExDShared bcp BEFACEF BFirst @@ -63,6 +64,7 @@ cinq CLASSNOTREG CLIE CLOSEAPP +cloudai cloudapp clsctx clsid @@ -97,6 +99,7 @@ diskfull DISMAPI dnld Dobbeleer +DShared dsc DUPLICATEALIAS dustojnikhummer @@ -114,6 +117,7 @@ epth EQU ERRORONEXIT ESource +ESPT ESRB ests etest @@ -139,6 +143,7 @@ fundraiser fuzzer fzanollo gcpi +gdnsuppress GESMBH GHS gity @@ -371,6 +376,7 @@ runtimeclass ryfu rzkzqaqjwj SARL +sbom schematab sddl SECUREFILEPATH diff --git a/azure-pipelines.nuget.yml b/azure-pipelines.nuget.yml index e81cfb6f94..eff40afe98 100644 --- a/azure-pipelines.nuget.yml +++ b/azure-pipelines.nuget.yml @@ -1,12 +1,9 @@ trigger: none parameters: - - name: version - displayName: Version to stamp on binaries and nuget package. Should be in form of "major.minor", for example "1.0" - type: string - -pool: - vmImage: "windows-latest" +- name: version + displayName: Version to stamp on binaries and nuget package. Should be in form of "major.minor", for example "1.0" + type: string variables: solution: "src/AppInstallerCLI.sln" @@ -14,103 +11,130 @@ variables: buildVer: $[counter(${{ parameters.version }}, 1)] version: ${{ parameters.version }}.$(buildVer) -jobs: - - job: "Build" - timeoutInMinutes: 120 - strategy: - matrix: - x86_release: - buildConfiguration: 'Release' - buildPlatform: 'x86' - x64_release: - buildConfiguration: 'Release' - buildPlatform: 'x64' - variables: - artifactsDir: $(Build.ArtifactStagingDirectory)\$(buildPlatform) - steps: - - script: echo $(version) - - - task: NuGetToolInstaller@1 - displayName: Install Nuget - - # Restores all projects, including native (vcxproj) projects - - task: NuGetCommand@2 - displayName: Restore Solution - inputs: - restoreSolution: "$(solution)" - - # Restore these UAP packages as https://github.com/NuGet/Home/issues/7796 leads to all UAP packages being skipped for restore. - # Even though they don't need any actual restore action, they need the project.assets.json file to be created and a direct restore does that. - - task: NuGetCommand@2 - displayName: Restore AppInstallerCLIPackage - inputs: - restoreSolution: 'src\AppInstallerCLIPackage\AppInstallerCLIPackage.wapproj' +resources: + repositories: + - repository: 1ESPipelineTemplates + type: git + name: 1ESPipelineTemplates/1ESPipelineTemplates + ref: refs/tags/release +extends: + template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates + parameters: + pool: + name: Azure-Pipelines-1ESPT-ExDShared + image: windows-2022 + os: windows + customBuildTags: + - ES365AIMigrationTooling + sdl: + suppression: + suppressionFile: $(Build.SourcesDirectory)\guardian\SDL\.gdnsuppress + + stages: + - stage: Build_Publish + jobs: + - job: "Build" + timeoutInMinutes: 120 + strategy: + matrix: + x86_release: + buildConfiguration: 'Release' + buildPlatform: 'x86' + x64_release: + buildConfiguration: 'Release' + buildPlatform: 'x64' + variables: + artifactsDir: $(Build.ArtifactStagingDirectory)\$(buildPlatform) + templateContext: + outputs: + - output: pipelineArtifact + displayName: 'Publish Pipeline Artifacts' + targetPath: '$(artifactsDir)' + artifactName: 'Build.$(buildPlatform)$(buildConfiguration)' + steps: + - script: echo $(version) + + - task: NuGetToolInstaller@1 + displayName: Install Nuget + + # Restores all projects, including native (vcxproj) projects + - task: NuGetCommand@2 + displayName: Restore Solution + inputs: + restoreSolution: "$(solution)" + + # Restore these UAP packages as https://github.com/NuGet/Home/issues/7796 leads to all UAP packages being skipped for restore. + # Even though they don't need any actual restore action, they need the project.assets.json file to be created and a direct restore does that. + - task: NuGetCommand@2 + displayName: Restore AppInstallerCLIPackage + inputs: + restoreSolution: 'src\AppInstallerCLIPackage\AppInstallerCLIPackage.wapproj' - - task: NuGetCommand@2 - displayName: Restore AppInstallerTestMsixInstaller - inputs: - restoreSolution: 'src\AppInstallerTestMsixInstaller\AppInstallerTestMsixInstaller.wapproj' - - # Restores only .NET core projects, but is still necessary, as without this the IndexCreationTool and LocalhostWebServer projects fail to build - - task: DotNetCoreCLI@2 - displayName: DotNet Restore - inputs: - command: "restore" - projects: "**/*.csproj" - - - task: PowerShell@2 - displayName: Update Binary Version - condition: not(eq(variables['Build.Reason'], 'PullRequest')) - inputs: - filePath: 'src\binver\Update-BinVer.ps1' - arguments: '-TargetFile binver\binver\version.h -BuildVersion $(buildVer) -MajorMinorOverride ${{ parameters.version }}' - workingDirectory: "src" - - - task: VSBuild@1 - displayName: Build Solution - inputs: - platform: "$(buildPlatform)" - solution: "$(solution)" - configuration: "$(buildConfiguration)" - - - task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@2 - displayName: "ESRP CodeSigning - Package contents" - inputs: - ConnectedServiceName: "WindowsPackageManager ESRP CodeSigning" - FolderPath: src - Pattern: | - *\$(buildConfiguration)\WinGetUtil\WinGetUtil.dll - WinGetUtilInterop\bin\$(buildConfiguration)\netstandard2.0\WinGetUtilInterop.dll - UseMinimatch: true - signConfigType: inlineSignParams - inlineOperation: | - [ - { - "KeyCode" : "CP-230012", - "OperationCode" : "SigntoolSign", - "Parameters" : { - "OpusName" : "Microsoft", - "OpusInfo" : "http://www.microsoft.com", - "FileDigest" : "/fd \"SHA256\"", - "PageHash" : "/NPH", - "TimeStamp" : "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256" - }, - "ToolName" : "sign", - "ToolVersion" : "1.0" - }, - { - "KeyCode" : "CP-230012", - "OperationCode" : "SigntoolVerify", - "Parameters" : {}, - "ToolName" : "sign", - "ToolVersion" : "1.0" - } - ] - - - task: CopyFiles@2 - displayName: 'Copy nuget pack files to artifacts folder' - inputs: - Contents: | + - task: NuGetCommand@2 + displayName: Restore AppInstallerTestMsixInstaller + inputs: + restoreSolution: 'src\AppInstallerTestMsixInstaller\AppInstallerTestMsixInstaller.wapproj' + + # Restores only .NET core projects, but is still necessary, as without this the IndexCreationTool and LocalhostWebServer projects fail to build + - task: DotNetCoreCLI@2 + displayName: DotNet Restore + inputs: + command: "restore" + projects: "**/*.csproj" + + - task: PowerShell@2 + displayName: Update Binary Version + condition: not(eq(variables['Build.Reason'], 'PullRequest')) + inputs: + filePath: 'src\binver\Update-BinVer.ps1' + arguments: '-TargetFile binver\binver\version.h -BuildVersion $(buildVer) -MajorMinorOverride ${{ parameters.version }}' + workingDirectory: "src" + + - task: VSBuild@1 + displayName: Build Solution + inputs: + platform: "$(buildPlatform)" + solution: "$(solution)" + configuration: "$(buildConfiguration)" + + - task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@2 + displayName: "ESRP CodeSigning - Package contents" + inputs: + ConnectedServiceName: "WindowsPackageManager ESRP CodeSigning" + FolderPath: src + Pattern: | + *\$(buildConfiguration)\WinGetUtil\WinGetUtil.dll + WinGetUtilInterop\bin\$(buildConfiguration)\netstandard2.0\WinGetUtilInterop.dll + UseMinimatch: true + signConfigType: inlineSignParams + inlineOperation: | + [ + { + "KeyCode" : "CP-230012", + "OperationCode" : "SigntoolSign", + "Parameters" : { + "OpusName" : "Microsoft", + "OpusInfo" : "http://www.microsoft.com", + "FileDigest" : "/fd \"SHA256\"", + "PageHash" : "/NPH", + "TimeStamp" : "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256" + }, + "ToolName" : "sign", + "ToolVersion" : "1.0" + }, + { + "KeyCode" : "CP-230012", + "OperationCode" : "SigntoolVerify", + "Parameters" : {}, + "ToolName" : "sign", + "ToolVersion" : "1.0" + } + ] + + - task: CopyFiles@2 + displayName: 'Copy nuget pack files to artifacts folder' + inputs: + Contents: | WinGetUtil.nuspec src\$(buildPlatform)\$(buildConfiguration)\WinGetUtil\WinGetUtil.dll src\$(buildPlatform)\$(buildConfiguration)\WinGetUtil\WinGetUtil.pdb @@ -118,78 +142,72 @@ jobs: src\WinGetUtilInterop\bin\$(buildConfiguration)\netstandard2.0\WinGetUtilInterop.pdb src\WinGetUtilInterop\build\Microsoft.WindowsPackageManager.Utils.targets schemas\JSON\manifests\** - TargetFolder: '$(artifactsDir)' - - - task: PublishPipelineArtifact@1 - displayName: Publish Pipeline Artifacts - inputs: - targetPath: '$(artifactsDir)' - - - job: "Nuget" - timeoutInMinutes: 60 - dependsOn: 'Build' - steps: - - checkout: none - - - task: DownloadPipelineArtifact@2 - displayName: 'Download Build.x64release artifacts' - inputs: - artifactName: Build.x64release - targetPath: '$(Pipeline.Workspace)\Build.x64release' - - - task: DownloadPipelineArtifact@2 - displayName: 'Download Build.x86release artifacts' - inputs: - artifactName: Build.x86release - targetPath: '$(Pipeline.Workspace)\Build.x86release' - - - task: NuGetCommand@2 - displayName: Pack WingetUtil nuget package - inputs: - command: pack - packagesToPack: '$(Pipeline.Workspace)\Build.x64release\WinGetUtil.nuspec' - versioningScheme: byEnvVar - versionEnvVar: version - packDestination: '$(Build.ArtifactStagingDirectory)' - basePath: $(Pipeline.Workspace) - - - task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@2 - displayName: "ESRP CodeSigning - NuGet package" - inputs: - ConnectedServiceName: "WindowsPackageManager ESRP CodeSigning" - FolderPath: "$(Build.ArtifactStagingDirectory)" - Pattern: "$(packageName).$(version).nupkg" - signConfigType: inlineSignParams - inlineOperation: | - [ - { - "KeyCode" : "CP-401405", - "OperationCode" : "NuGetSign", - "Parameters" : {}, - "ToolName" : "sign", - "ToolVersion" : "1.0" - }, - { - "KeyCode" : "CP-401405", - "OperationCode" : "NuGetVerify", - "Parameters" : {}, - "ToolName" : "sign", - "ToolVersion" : "1.0" - } - ] - - - task: PublishBuildArtifacts@1 - displayName: Publish nuget package to artifacts - inputs: - PathtoPublish: '$(Build.ArtifactStagingDirectory)\$(packageName).$(version).nupkg' - ArtifactName: $(packageName) - publishLocation: Container - - - task: NuGetCommand@2 - displayName: Push WingetUtil nuget package to nuget.org - inputs: - command: push - nuGetFeedType: external - includeNugetOrg: true - packagesToPush: '$(Build.ArtifactStagingDirectory)\$(packageName).$(version).nupkg' - publishFeedCredentials: "WindowsPackageManagerAzurePipelineNuget - NuGet.org" + TargetFolder: '$(artifactsDir)' + + - job: "Nuget" + timeoutInMinutes: 60 + dependsOn: 'Build' + templateContext: + outputs: + - output: pipelineArtifact + displayName: 'Publish nuget package to artifacts' + targetPath: '$(Build.ArtifactStagingDirectory)\$(packageName).$(version).nupkg' + artifactName: $(packageName) + publishLocation: Container + sbomBuildDropPath: '$(Build.ArtifactStagingDirectory)' + - output: nuget + displayName: 'Push WingetUtil nuget package to nuget.org' + packageParentPath: '$(Build.ArtifactStagingDirectory)' + nuGetFeedType: external + includeNugetOrg: true + packagesToPush: '$(Build.ArtifactStagingDirectory)\$(packageName).$(version).nupkg' + publishFeedCredentials: "WindowsPackageManagerAzurePipelineNuget - NuGet.org" + steps: + - checkout: none + + - task: DownloadPipelineArtifact@2 + displayName: 'Download Build.x64release artifacts' + inputs: + artifactName: Build.x64release + targetPath: '$(Pipeline.Workspace)\Build.x64release' + + - task: DownloadPipelineArtifact@2 + displayName: 'Download Build.x86release artifacts' + inputs: + artifactName: Build.x86release + targetPath: '$(Pipeline.Workspace)\Build.x86release' + + - task: NuGetCommand@2 + displayName: Pack WingetUtil nuget package + inputs: + command: pack + packagesToPack: '$(Pipeline.Workspace)\Build.x64release\WinGetUtil.nuspec' + versioningScheme: byEnvVar + versionEnvVar: version + packDestination: '$(Build.ArtifactStagingDirectory)' + basePath: $(Pipeline.Workspace) + + - task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@2 + displayName: "ESRP CodeSigning - NuGet package" + inputs: + ConnectedServiceName: "WindowsPackageManager ESRP CodeSigning" + FolderPath: "$(Build.ArtifactStagingDirectory)" + Pattern: "$(packageName).$(version).nupkg" + signConfigType: inlineSignParams + inlineOperation: | + [ + { + "KeyCode" : "CP-401405", + "OperationCode" : "NuGetSign", + "Parameters" : {}, + "ToolName" : "sign", + "ToolVersion" : "1.0" + }, + { + "KeyCode" : "CP-401405", + "OperationCode" : "NuGetVerify", + "Parameters" : {}, + "ToolName" : "sign", + "ToolVersion" : "1.0" + } + ] \ No newline at end of file diff --git a/guardian/SDL/.gdnsuppress b/guardian/SDL/.gdnsuppress new file mode 100644 index 0000000000..c7964f6fa2 --- /dev/null +++ b/guardian/SDL/.gdnsuppress @@ -0,0 +1,137 @@ +{ + "hydrated": false, + "properties": { + "helpUri": "https://eng.ms/docs/microsoft-security/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/microsoft-guardian/general/suppressions", + "hydrationStatus": "This file does not contain identifying data. It is safe to check into your repo. To hydrate this file with identifying data, run `guardian hydrate --help` and follow the guidance." + }, + "version": "1.0.0", + "suppressionSets": { + "default": { + "name": "default", + "createdDate": "2024-01-20 00:01:02Z", + "lastUpdatedDate": "2024-01-20 00:01:02Z" + } + }, + "results": { + "64a425d92c4ff3a23893e149517a736e444f5d745c18e961280ca9e6c7583ad4": { + "signature": "64a425d92c4ff3a23893e149517a736e444f5d745c18e961280ca9e6c7583ad4", + "alternativeSignatures": [ + "b231a52f13113732ba6eb0059562696d22e63386eaf4a8371e079c39e13464c5" + ], + "memberOf": [ + "default" + ], + "createdDate": "2024-01-20 00:01:02Z" + }, + "037b90140bbaef1cdda8ff9a2829bc894e6d9ef745b209219bf6c3cf6532a0b4": { + "signature": "037b90140bbaef1cdda8ff9a2829bc894e6d9ef745b209219bf6c3cf6532a0b4", + "alternativeSignatures": [ + "8955e3fdce9d13e2fea6e4edd80f85fc92d3fa4575b7c8aec78de062df0cabf8" + ], + "memberOf": [ + "default" + ], + "createdDate": "2024-01-20 00:01:02Z" + }, + "ba35c30e34e312e15795849df6f2f67b6f77fbae70befd89bddef56d90ebd027": { + "signature": "ba35c30e34e312e15795849df6f2f67b6f77fbae70befd89bddef56d90ebd027", + "alternativeSignatures": [ + "05c6641341e014062bff1bb0ba073b72c6c85a7304c1d91ab0c56399475f341a" + ], + "memberOf": [ + "default" + ], + "createdDate": "2024-01-20 00:01:02Z" + }, + "629a5ff62fd9bd29634548b757dcf026ee86419c1324f3a9d857aedcc6c87e1f": { + "signature": "629a5ff62fd9bd29634548b757dcf026ee86419c1324f3a9d857aedcc6c87e1f", + "alternativeSignatures": [ + "ac0b1bb6e16c27bbbb1ddd338c544e0c688871e60bb1d37cc10f67c288d96ec4" + ], + "memberOf": [ + "default" + ], + "createdDate": "2024-01-20 00:01:02Z" + }, + "9bde2b3e655b9b9286f7a2b2630160a94038b781a1b56c826e9a7f6587a0ffc0": { + "signature": "9bde2b3e655b9b9286f7a2b2630160a94038b781a1b56c826e9a7f6587a0ffc0", + "alternativeSignatures": [ + "4921cc6623cceca162dbd5b90d1ce2b68e82327e4dee42ace06bc1d7abc7b53f" + ], + "memberOf": [ + "default" + ], + "createdDate": "2024-01-20 00:01:02Z" + }, + "f641ed23db16fde82bebb15a12c7ddc15c5e6d351ee26599d85788344ecd2341": { + "signature": "f641ed23db16fde82bebb15a12c7ddc15c5e6d351ee26599d85788344ecd2341", + "alternativeSignatures": [ + "9c005ccfc554298d887c24656e2bb740e84ac166846d78a9ff49e8a22c653ce7" + ], + "memberOf": [ + "default" + ], + "createdDate": "2024-01-20 00:01:02Z" + }, + "341bb1cbc9b433a776e1da069ab6a578412911198daf9e827bae457538ee79b5": { + "signature": "341bb1cbc9b433a776e1da069ab6a578412911198daf9e827bae457538ee79b5", + "alternativeSignatures": [ + "88b177748c73e7f84dc936f59bd58251a43a2517cc79af94714be094e94d383b" + ], + "memberOf": [ + "default" + ], + "createdDate": "2024-01-20 00:01:02Z" + }, + "fbabaf1dffc169cac5d046266716158ec6e66569057d28945a2e575433c49c3d": { + "signature": "fbabaf1dffc169cac5d046266716158ec6e66569057d28945a2e575433c49c3d", + "alternativeSignatures": [ + "fa7c37e0a406315118a19c204696f673103704e2d2e16921da7439b649e69268" + ], + "memberOf": [ + "default" + ], + "createdDate": "2024-01-20 00:01:02Z" + }, + "cfa3b2e5a366b6caa17129f1e30f36a4fce9660296b378c9463050e35444c256": { + "signature": "cfa3b2e5a366b6caa17129f1e30f36a4fce9660296b378c9463050e35444c256", + "alternativeSignatures": [ + "5c9c6d472db911eeea0a0bcc10807f77a4476b8572f782a096f4e16bfb354f36" + ], + "memberOf": [ + "default" + ], + "createdDate": "2024-01-20 00:01:02Z" + }, + "22077a7c2d29c3a189d6676eca4d1e99a8dfde508263ef2a0854083d680aab6e": { + "signature": "22077a7c2d29c3a189d6676eca4d1e99a8dfde508263ef2a0854083d680aab6e", + "alternativeSignatures": [ + "13de9c1c1a3a4462eefe182716e077cdff162cfd858ab8daf308e83617940338" + ], + "memberOf": [ + "default" + ], + "createdDate": "2024-01-20 00:01:02Z" + }, + "8e37f874079c200a8f5fa9022b462b20e318c2a035e61cf6ed45374294968d52": { + "signature": "8e37f874079c200a8f5fa9022b462b20e318c2a035e61cf6ed45374294968d52", + "alternativeSignatures": [ + "4571b7214d460ec428f4c14f36232fa9ad620c6eaa13958ab47aef555e156845" + ], + "memberOf": [ + "default" + ], + "createdDate": "2024-01-20 00:01:02Z" + }, + "5c525a016119c7de6065c03f3f6015e119c53aaaf1798a444963c1b8093f484c": { + "signature": "5c525a016119c7de6065c03f3f6015e119c53aaaf1798a444963c1b8093f484c", + "alternativeSignatures": [ + "7e858857e8b993f25c1741a41d3c426979e4db5fba20f332a0e0e44dc77de901" + ], + "memberOf": [ + "default" + ], + "createdDate": "2024-01-20 00:01:02Z" + } + } +} \ No newline at end of file diff --git a/src/AppInstallerCLITests/AppInstallerCLITests.vcxproj b/src/AppInstallerCLITests/AppInstallerCLITests.vcxproj index cf9ef4ba37..c91e7228fa 100644 --- a/src/AppInstallerCLITests/AppInstallerCLITests.vcxproj +++ b/src/AppInstallerCLITests/AppInstallerCLITests.vcxproj @@ -115,6 +115,7 @@ $(MSBuildThisFileDirectory)..\AppInstallerCommonCore;$(MSBuildThisFileDirectory)..\AppInstallerRepositoryCore\Public;$(MSBuildThisFileDirectory)..\AppInstallerRepositoryCore;$(MSBuildThisFileDirectory)..\AppInstallerCommonCore\Public;$(MSBuildThisFileDirectory)..\AppInstallerSharedLib\Public;$(MSBuildThisFileDirectory)..\AppInstallerCLICore\Public;$(MSBuildThisFileDirectory)..\AppInstallerCLICore;$(ProjectDir)..\JsonCppLib;$(ProjectDir)..\cpprestsdk\cpprestsdk\Release\include;%(AdditionalIncludeDirectories) true false + false Console @@ -134,6 +135,7 @@ $(MSBuildThisFileDirectory)..\AppInstallerCommonCore;$(MSBuildThisFileDirectory)..\AppInstallerRepositoryCore\Public;$(MSBuildThisFileDirectory)..\AppInstallerRepositoryCore;$(MSBuildThisFileDirectory)..\AppInstallerCommonCore\Public;$(MSBuildThisFileDirectory)..\AppInstallerSharedLib\Public;$(MSBuildThisFileDirectory)..\AppInstallerCLICore\Public;$(MSBuildThisFileDirectory)..\AppInstallerCLICore;$(ProjectDir)..\JsonCppLib;$(ProjectDir)..\cpprestsdk\cpprestsdk\Release\include;%(AdditionalIncludeDirectories) true false + false wininet.lib;shell32.lib;winsqlite3.lib;shlwapi.lib;icuuc.lib;icuin.lib;urlmon.lib;Advapi32.lib;winhttp.lib;onecoreuap.lib;msi.lib;%(AdditionalDependencies) @@ -157,6 +159,8 @@ true false false + Guard + Guard Console diff --git a/src/AppInstallerTestExeInstaller/AppInstallerTestExeInstaller.vcxproj b/src/AppInstallerTestExeInstaller/AppInstallerTestExeInstaller.vcxproj index 8c55233101..8ea3dcf2e6 100644 --- a/src/AppInstallerTestExeInstaller/AppInstallerTestExeInstaller.vcxproj +++ b/src/AppInstallerTestExeInstaller/AppInstallerTestExeInstaller.vcxproj @@ -115,6 +115,9 @@ stdcpp17 stdcpp17 MultiThreadedDebugDLL + false + false + false Console @@ -126,6 +129,7 @@ WIN32;%(PreprocessorDefinitions) true stdcpp17 + false @@ -142,6 +146,10 @@ stdcpp17 stdcpp17 stdcpp17 + Guard + Guard + Guard + Guard Console