Use Custom Validation Policy for vPack Pipeline - #27911
Merged
Justin Chung (jshigetomi) merged 2 commits intoAug 31, 2026
Merged
Conversation
… policy Port the v7.4.19 vPack signing changes (PR 41365, PR 41411, PR 41417) onto the current master pipeline structure, which already matches the state those PRs were built on (PR 41207/41209/41246 were superseded by PR 41365 and are not needed here). - obp-file-signing.yml: add `ThirdPartySigningProfile` and `SignAllBinariesWithThirdPartyProfile` parameters so a caller can force every file to be (re)signed with a single certificate instead of only the files missing an official signature. - PowerShell-vPack-Stages.yml: sign all vPack files (*.ps1, *.psm1, *.ps1xml, *.psd1, *.exe, *.dll) with the Windows build tools certificate, then validate the signed payload against a new repository-managed CodeSign policy that only trusts that certificate. Fail the build on any SARIF result other than `CodeSign.MatchingPolicy`. - PowerShell-vPack-Stages.yml: disable the injected CodeSign validator via `templateContext.sdl.codeSignValidation` and `ob_sdl_codeSignValidation_excludes` so official-build adapters that force it on do not conflict with the tools-only validation above. - .config/codesignpolicy.xml: add the new CodeSign policy that allows only the "Windows Internal Build Tools CodeSign" publisher. - PowerShell-vPack-Official.yml: remove the now-unused `useCustomPolicy` globalSdl flag, since the vPack job validates signatures itself. Related work items: #164495
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
Ports the vPack signing/validation flow from release/v7.4.19 to master so the vPack payload is re-signed with the Windows build tools certificate and validated against a tools-only CodeSign policy, while minimizing impact to other callers of shared signing templates.
Changes:
- Disable injected CodeSign validation for the vPack stage and explicitly re-sign + validate the full vPack payload using a repo-managed custom CodeSign policy.
- Extend
obp-file-signing.ymlto allow overriding the third-party signing profile and optionally signing all binaries with that profile. - Add a custom CodeSign policy XML that only permits the Windows Internal Build Tools CodeSign publisher; remove an unused/obsolete
globalSdl.useCustomPolicysetting from the vPack official pipeline.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
.pipelines/templates/stages/PowerShell-vPack-Stages.yml |
Disables injected CodeSign validation for vPack, signs all vPack files with tools cert, and validates against custom policy with SARIF post-processing. |
.pipelines/templates/obp-file-signing.yml |
Adds parameters to override third-party signing profile and to optionally sign all binaries with that profile. |
.pipelines/PowerShell-vPack-Official.yml |
Removes globalSdl.useCustomPolicy to align with explicit per-stage CodeSign validation. |
.config/codesignpolicy.xml |
Introduces a tools-only CodeSign policy used by the vPack validation step. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Discover the latest CodeSign validation SARIF beneath the task results root instead of assuming the task always writes to index 001. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 99e6a033-65fd-4a39-9a71-2ce9b7657c10
Aditya Patwardhan (adityapatwardhan)
approved these changes
Aug 31, 2026
Justin Chung (jshigetomi)
merged commit Aug 31, 2026
bc487bf
into
PowerShell:master
35 checks passed
This was referenced Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary
vPack code sign validation changed without notice. While we wait for one branch to administer a fix, we will use our own code sign validation policy.
PR Context
This PR will unblock our vPack pipeline.
PR Checklist
.h,.cpp,.cs,.ps1and.psm1files have the correct copyright headerWIP:or[ WIP ]to the beginning of the title and remove the prefix when the PR is ready.