From cd2ac1d5b6f7cc1c1f38c98540f22620ae200305 Mon Sep 17 00:00:00 2001 From: Changming Sun Date: Wed, 30 Apr 2025 12:21:01 -0700 Subject: [PATCH 1/2] update ESRP settings --- .../github/azure-pipelines/nuget-windows-ai.yml | 11 +++++------ .../github/azure-pipelines/templates/esrp_nuget.yml | 11 +++++------ .../azure-pipelines/templates/mac-esrp-dylib.yml | 11 +++++------ .../github/azure-pipelines/templates/win-esrp-dll.yml | 10 +++++----- 4 files changed, 20 insertions(+), 23 deletions(-) diff --git a/tools/ci_build/github/azure-pipelines/nuget-windows-ai.yml b/tools/ci_build/github/azure-pipelines/nuget-windows-ai.yml index c6ab33164035c..aee0a8e9e7d80 100644 --- a/tools/ci_build/github/azure-pipelines/nuget-windows-ai.yml +++ b/tools/ci_build/github/azure-pipelines/nuget-windows-ai.yml @@ -260,12 +260,11 @@ extends: displayName: "Sign Nuget package" inputs: ConnectedServiceName: 'OnnxrunTimeCodeSign_20240611' - AppRegistrationClientId: '53d54d02-978d-4305-8572-583cf6711c4f' - AppRegistrationTenantId: '72f988bf-86f1-41af-91ab-2d7cd011db47' - AuthAKVName: 'buildkeyvault' - AuthCertName: '53d54d02-SSL-AutoRotate' - AuthSignCertName: '53d54d02-978d-4305-8572-583cf6711c4f' - + AppRegistrationClientId: '62b7cfed-4d25-454f-880e-010dc21455ac' + AppRegistrationTenantId: '975f013f-7f24-47e8-a7d3-abc4752bf346' + EsrpClientId: "53d54d02-978d-4305-8572-583cf6711c4f" + AuthAKVName: 'ortbuildkeyvault' + AuthSignCertName: 'esrpcodesign' FolderPath: $(Build.ArtifactStagingDirectory) Pattern: '*.nupkg' SessionTimeout: 90 diff --git a/tools/ci_build/github/azure-pipelines/templates/esrp_nuget.yml b/tools/ci_build/github/azure-pipelines/templates/esrp_nuget.yml index 79cceb7a02511..acb8173b3e07b 100644 --- a/tools/ci_build/github/azure-pipelines/templates/esrp_nuget.yml +++ b/tools/ci_build/github/azure-pipelines/templates/esrp_nuget.yml @@ -9,12 +9,11 @@ steps: displayName: 'ESRP CodeSigning' inputs: ConnectedServiceName: 'OnnxrunTimeCodeSign_20240611' - AppRegistrationClientId: '53d54d02-978d-4305-8572-583cf6711c4f' - AppRegistrationTenantId: '72f988bf-86f1-41af-91ab-2d7cd011db47' - AuthAKVName: 'buildkeyvault' - AuthCertName: '53d54d02-SSL-AutoRotate' - AuthSignCertName: '53d54d02-978d-4305-8572-583cf6711c4f' - + AppRegistrationClientId: '62b7cfed-4d25-454f-880e-010dc21455ac' + AppRegistrationTenantId: '975f013f-7f24-47e8-a7d3-abc4752bf346' + EsrpClientId: "53d54d02-978d-4305-8572-583cf6711c4f" + AuthAKVName: 'ortbuildkeyvault' + AuthSignCertName: 'esrpcodesign' FolderPath: ${{ parameters.FolderPath }} Pattern: '*.nupkg' SessionTimeout: 90 diff --git a/tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml b/tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml index aeebf2a39c8e0..29965b1500261 100644 --- a/tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml +++ b/tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml @@ -20,12 +20,11 @@ steps: displayName: 'ESRP CodeSigning' inputs: ConnectedServiceName: 'OnnxrunTimeCodeSign_20240611' - AppRegistrationClientId: '53d54d02-978d-4305-8572-583cf6711c4f' - AppRegistrationTenantId: '72f988bf-86f1-41af-91ab-2d7cd011db47' - AuthAKVName: 'buildkeyvault' - AuthCertName: '53d54d02-SSL-AutoRotate' - AuthSignCertName: '53d54d02-978d-4305-8572-583cf6711c4f' - + AppRegistrationClientId: '62b7cfed-4d25-454f-880e-010dc21455ac' + AppRegistrationTenantId: '975f013f-7f24-47e8-a7d3-abc4752bf346' + EsrpClientId: "53d54d02-978d-4305-8572-583cf6711c4f" + AuthAKVName: 'ortbuildkeyvault' + AuthSignCertName: 'esrpcodesign' FolderPath: ${{ parameters.FolderPath }} Pattern: '*.nupkg' SessionTimeout: 90 diff --git a/tools/ci_build/github/azure-pipelines/templates/win-esrp-dll.yml b/tools/ci_build/github/azure-pipelines/templates/win-esrp-dll.yml index 86acebc9f7a71..055276635c5d5 100644 --- a/tools/ci_build/github/azure-pipelines/templates/win-esrp-dll.yml +++ b/tools/ci_build/github/azure-pipelines/templates/win-esrp-dll.yml @@ -21,11 +21,11 @@ steps: condition: and(succeeded(), eq('${{ parameters.DoEsrp }}', true)) inputs: ConnectedServiceName: 'OnnxrunTimeCodeSign_20240611' - AppRegistrationClientId: '53d54d02-978d-4305-8572-583cf6711c4f' - AppRegistrationTenantId: '72f988bf-86f1-41af-91ab-2d7cd011db47' - AuthAKVName: 'buildkeyvault' - AuthCertName: '53d54d02-SSL-AutoRotate' - AuthSignCertName: '53d54d02-978d-4305-8572-583cf6711c4f' + AppRegistrationClientId: '62b7cfed-4d25-454f-880e-010dc21455ac' + AppRegistrationTenantId: '975f013f-7f24-47e8-a7d3-abc4752bf346' + EsrpClientId: "53d54d02-978d-4305-8572-583cf6711c4f" + AuthAKVName: 'ortbuildkeyvault' + AuthSignCertName: 'esrpcodesign' signConfigType: inlineSignParams inlineOperation: | [ From c1b6c4df1e1fc17419c5c7be188846f07d7819c4 Mon Sep 17 00:00:00 2001 From: Changming Sun Date: Wed, 30 Apr 2025 13:01:57 -0700 Subject: [PATCH 2/2] update ESRP settings --- tools/ci_build/github/azure-pipelines/nuget-windows-ai.yml | 1 + tools/ci_build/github/azure-pipelines/templates/esrp_nuget.yml | 1 + .../azure-pipelines/templates/jar-maven-signing-linux.yml | 2 +- .../github/azure-pipelines/templates/jar-maven-signing-win.yml | 2 +- .../github/azure-pipelines/templates/mac-esrp-dylib.yml | 1 + .../ci_build/github/azure-pipelines/templates/win-esrp-dll.yml | 1 + 6 files changed, 6 insertions(+), 2 deletions(-) diff --git a/tools/ci_build/github/azure-pipelines/nuget-windows-ai.yml b/tools/ci_build/github/azure-pipelines/nuget-windows-ai.yml index aee0a8e9e7d80..753395151b620 100644 --- a/tools/ci_build/github/azure-pipelines/nuget-windows-ai.yml +++ b/tools/ci_build/github/azure-pipelines/nuget-windows-ai.yml @@ -260,6 +260,7 @@ extends: displayName: "Sign Nuget package" inputs: ConnectedServiceName: 'OnnxrunTimeCodeSign_20240611' + UseMSIAuthentication: true AppRegistrationClientId: '62b7cfed-4d25-454f-880e-010dc21455ac' AppRegistrationTenantId: '975f013f-7f24-47e8-a7d3-abc4752bf346' EsrpClientId: "53d54d02-978d-4305-8572-583cf6711c4f" diff --git a/tools/ci_build/github/azure-pipelines/templates/esrp_nuget.yml b/tools/ci_build/github/azure-pipelines/templates/esrp_nuget.yml index acb8173b3e07b..ffec479474721 100644 --- a/tools/ci_build/github/azure-pipelines/templates/esrp_nuget.yml +++ b/tools/ci_build/github/azure-pipelines/templates/esrp_nuget.yml @@ -9,6 +9,7 @@ steps: displayName: 'ESRP CodeSigning' inputs: ConnectedServiceName: 'OnnxrunTimeCodeSign_20240611' + UseMSIAuthentication: true AppRegistrationClientId: '62b7cfed-4d25-454f-880e-010dc21455ac' AppRegistrationTenantId: '975f013f-7f24-47e8-a7d3-abc4752bf346' EsrpClientId: "53d54d02-978d-4305-8572-583cf6711c4f" diff --git a/tools/ci_build/github/azure-pipelines/templates/jar-maven-signing-linux.yml b/tools/ci_build/github/azure-pipelines/templates/jar-maven-signing-linux.yml index d14952e544e5e..df2aff0634819 100644 --- a/tools/ci_build/github/azure-pipelines/templates/jar-maven-signing-linux.yml +++ b/tools/ci_build/github/azure-pipelines/templates/jar-maven-signing-linux.yml @@ -7,7 +7,7 @@ steps: displayName: 'Get GnuPG signing keys' inputs: #The value below is the name of an ADO service connection. - azureSubscription: 'OnnxrunTimeCodeSign_20240611' + azureSubscription: 'AIInfraBuildOnnxRuntimeOSS' KeyVaultName: 'ort-release' SecretsFilter: 'java-pgp-pwd,java-pgp-key' RunAsPreJob: false diff --git a/tools/ci_build/github/azure-pipelines/templates/jar-maven-signing-win.yml b/tools/ci_build/github/azure-pipelines/templates/jar-maven-signing-win.yml index 5681b3568bae1..ef845dc3bf243 100644 --- a/tools/ci_build/github/azure-pipelines/templates/jar-maven-signing-win.yml +++ b/tools/ci_build/github/azure-pipelines/templates/jar-maven-signing-win.yml @@ -6,7 +6,7 @@ steps: - task: AzureKeyVault@2 displayName: 'Get GnuPG signing keys' inputs: - azureSubscription: 'OnnxrunTimeCodeSign_20240611' + azureSubscription: 'AIInfraBuildOnnxRuntimeOSS' KeyVaultName: 'ort-release' SecretsFilter: 'java-pgp-pwd,java-pgp-key' RunAsPreJob: false diff --git a/tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml b/tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml index 29965b1500261..856f9a02bb13f 100644 --- a/tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml +++ b/tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml @@ -20,6 +20,7 @@ steps: displayName: 'ESRP CodeSigning' inputs: ConnectedServiceName: 'OnnxrunTimeCodeSign_20240611' + UseMSIAuthentication: true AppRegistrationClientId: '62b7cfed-4d25-454f-880e-010dc21455ac' AppRegistrationTenantId: '975f013f-7f24-47e8-a7d3-abc4752bf346' EsrpClientId: "53d54d02-978d-4305-8572-583cf6711c4f" diff --git a/tools/ci_build/github/azure-pipelines/templates/win-esrp-dll.yml b/tools/ci_build/github/azure-pipelines/templates/win-esrp-dll.yml index 055276635c5d5..0476bc74349bf 100644 --- a/tools/ci_build/github/azure-pipelines/templates/win-esrp-dll.yml +++ b/tools/ci_build/github/azure-pipelines/templates/win-esrp-dll.yml @@ -21,6 +21,7 @@ steps: condition: and(succeeded(), eq('${{ parameters.DoEsrp }}', true)) inputs: ConnectedServiceName: 'OnnxrunTimeCodeSign_20240611' + UseMSIAuthentication: true AppRegistrationClientId: '62b7cfed-4d25-454f-880e-010dc21455ac' AppRegistrationTenantId: '975f013f-7f24-47e8-a7d3-abc4752bf346' EsrpClientId: "53d54d02-978d-4305-8572-583cf6711c4f"