From 588f25b988c775af3f9dfa9333e4ab94468a65d2 Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Fri, 11 Sep 2026 15:04:05 -0700 Subject: [PATCH 01/11] Add win-x64 executable NuGet package Package the signed self-contained Windows x64 executable in a separate NuGet package during the official release pipeline. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/sbom-tool-main-build.yaml | 88 +++++++++++++---------- src/Microsoft.Sbom.Tool.Win-x64/README.md | 13 ++++ 2 files changed, 62 insertions(+), 39 deletions(-) create mode 100644 src/Microsoft.Sbom.Tool.Win-x64/README.md diff --git a/pipelines/sbom-tool-main-build.yaml b/pipelines/sbom-tool-main-build.yaml index 66fbc2fbc..3d35a0e71 100644 --- a/pipelines/sbom-tool-main-build.yaml +++ b/pipelines/sbom-tool-main-build.yaml @@ -104,37 +104,6 @@ extends: - powershell: 'Get-ChildItem -Recurse -Filter *.csproj -Path src | ForEach-Object { dotnet pack $_.FullName -c $(BuildConfiguration) --no-restore --no-build -o $(Build.ArtifactStagingDirectory)/nuget --include-symbols -p:SymbolPackageFormat=snupkg }' displayName: 'Pack NuGet package' - - task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@5 - displayName: 'Sign packages' - inputs: - ConnectedServiceName: 'SBOM Tool CI ESRP' - AppRegistrationClientId: '51c11fce-97e9-4671-9176-0fc328a9dd17' - AppRegistrationTenantId: '33e01921-4d64-4f8c-a055-5bdaffd5e33d' - AuthAKVName: 'Sbom-Esrp-Secrets' - AuthCertName: 'SBOM-CI-ESRP-Auth-Cert' - AuthSignCertName: 'SBOM-CI-ESRP-Signing-Cert' - FolderPath: '$(Build.ArtifactStagingDirectory)' - Pattern: '*.nupkg' - signConfigType: inlineSignParams - inlineOperation: | - [ - { - "keyCode": "CP-401405", - "operationSetCode": "NuGetSign", - "parameters": [ ], - "toolName": "sign", - "toolVersion": "1.0" - }, - { - "keyCode": "CP-401405", - "operationSetCode": "NuGetVerify", - "parameters": [ ], - "toolName": "sign", - "toolVersion": "1.0" - } - ] - condition: and(succeeded(), startswith(variables['Build.SourceBranch'], 'refs/tags/')) - - task: DotNetCoreCLI@2 displayName: 'Build self-contained binary' inputs: @@ -188,15 +157,56 @@ extends: - powershell: | cd $(Build.ArtifactStagingDirectory)/win $version = (ls $(BinaryNameWindows) -r | Select-Object -ExpandProperty VersionInfo).ProductVersion - echo "##vso[task.setvariable variable=Version;isOutput=true]$version" - displayName: 'Set variable version' - - - powershell: | - cd $(Build.ArtifactStagingDirectory)/win - $version = (ls $(BinaryNameWindows) -r | Select-Object -ExpandProperty VersionInfo).ProductVersion - echo "##vso[task.setvariable variable=Version;isOutput=true]$version" + echo "##vso[task.setvariable variable=Version]$version" $version | Out-File $(Build.ArtifactStagingDirectory)/version.txt - displayName: 'Write version file' + displayName: 'Set version' + + - task: NuGetToolInstaller@1 + displayName: 'Install NuGet' + inputs: + versionSpec: 6.x + + - task: NuGetCommand@2 + displayName: 'Pack win-x64 executable' + inputs: + command: pack + packagesToPack: $(Build.SourcesDirectory)/src/Microsoft.Sbom.Tool.Win-x64/Microsoft.Sbom.Tool.Win-x64.nuspec + packDestination: $(Build.ArtifactStagingDirectory)/nuget + versioningScheme: byEnvVar + versionEnvVar: Version + basePath: $(Build.ArtifactStagingDirectory)/win + buildProperties: PackageReadmePath=$(Build.SourcesDirectory)\src\Microsoft.Sbom.Tool.Win-x64\README.md + + - task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@5 + displayName: 'Sign packages' + inputs: + ConnectedServiceName: 'SBOM Tool CI ESRP' + AppRegistrationClientId: '51c11fce-97e9-4671-9176-0fc328a9dd17' + AppRegistrationTenantId: '33e01921-4d64-4f8c-a055-5bdaffd5e33d' + AuthAKVName: 'Sbom-Esrp-Secrets' + AuthCertName: 'SBOM-CI-ESRP-Auth-Cert' + AuthSignCertName: 'SBOM-CI-ESRP-Signing-Cert' + FolderPath: '$(Build.ArtifactStagingDirectory)' + Pattern: '*.nupkg' + signConfigType: inlineSignParams + inlineOperation: | + [ + { + "keyCode": "CP-401405", + "operationSetCode": "NuGetSign", + "parameters": [ ], + "toolName": "sign", + "toolVersion": "1.0" + }, + { + "keyCode": "CP-401405", + "operationSetCode": "NuGetVerify", + "parameters": [ ], + "toolName": "sign", + "toolVersion": "1.0" + } + ] + condition: and(succeeded(), startswith(variables['Build.SourceBranch'], 'refs/tags/')) - powershell: | del $(Build.ArtifactStagingDirectory)\CodeSignSummary-*.md diff --git a/src/Microsoft.Sbom.Tool.Win-x64/README.md b/src/Microsoft.Sbom.Tool.Win-x64/README.md new file mode 100644 index 000000000..a245cfc4d --- /dev/null +++ b/src/Microsoft.Sbom.Tool.Win-x64/README.md @@ -0,0 +1,13 @@ +# Microsoft SBOM Tool for win-x64 + +This package contains the self-contained Windows x64 executable for +[Microsoft SBOM Tool](https://github.com/microsoft/sbom-tool). + +The executable is installed at: + +```text +tools/win-x64/sbom-tool-win-x64.exe +``` + +See the [Microsoft SBOM Tool documentation](https://github.com/microsoft/sbom-tool#readme) +for command-line usage. From bd6beca5872b91598a19837fb6ca5af3787d31f0 Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Fri, 11 Sep 2026 15:04:58 -0700 Subject: [PATCH 02/11] Add win-x64 package specification Define the metadata and file layout for the Microsoft.Sbom.Tool.Win-x64 package. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- .../Microsoft.Sbom.Tool.Win-x64.nuspec | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 src/Microsoft.Sbom.Tool.Win-x64/Microsoft.Sbom.Tool.Win-x64.nuspec diff --git a/src/Microsoft.Sbom.Tool.Win-x64/Microsoft.Sbom.Tool.Win-x64.nuspec b/src/Microsoft.Sbom.Tool.Win-x64/Microsoft.Sbom.Tool.Win-x64.nuspec new file mode 100644 index 000000000..b14894ccc --- /dev/null +++ b/src/Microsoft.Sbom.Tool.Win-x64/Microsoft.Sbom.Tool.Win-x64.nuspec @@ -0,0 +1,22 @@ + + + + Microsoft.Sbom.Tool.Win-x64 + $version$ + Microsoft + Microsoft + true + MIT + https://github.com/microsoft/sbom-tool + + https://github.com/microsoft/sbom-tool/releases + README.md + Self-contained win-x64 executable for Microsoft SBOM Tool. + Copyright Microsoft Corporation. All rights reserved. + sbom spdx cli win-x64 + + + + + + From 93e27c6634fa712e4c27c232545e8e413003ec56 Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Mon, 14 Sep 2026 17:26:22 -0700 Subject: [PATCH 03/11] Restore packages through internal feed Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/build-test-tool-template.yaml | 8 ++++++-- pipelines/sbom-tool-main-build.yaml | 2 -- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/pipelines/build-test-tool-template.yaml b/pipelines/build-test-tool-template.yaml index de11505d8..e7ce5da71 100644 --- a/pipelines/build-test-tool-template.yaml +++ b/pipelines/build-test-tool-template.yaml @@ -4,12 +4,16 @@ steps: inputs: useGlobalJson: true + - task: NuGetAuthenticate@1 + displayName: 'Authenticate to Azure Artifacts' + - task: DotNetCoreCLI@2 displayName: 'Restore solution' inputs: command: restore - feedsToUse: config - nugetConfigPath: nuget.config + feedsToUse: select + vstsFeed: AzureDevOps/ManifestTool + includeNuGetOrg: false verbosityRestore: Normal - task: DotNetCoreCLI@2 diff --git a/pipelines/sbom-tool-main-build.yaml b/pipelines/sbom-tool-main-build.yaml index 3d35a0e71..a1f3dcfa4 100644 --- a/pipelines/sbom-tool-main-build.yaml +++ b/pipelines/sbom-tool-main-build.yaml @@ -31,8 +31,6 @@ variables: extends: template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines parameters: - featureFlags: - disableNetworkIsolation: true sdl: sourceAnalysisPool: name: sbom-windows-build-pool From 742aa7ef8aac702bfb59aed28134ad4d45b95b61 Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Tue, 15 Sep 2026 10:19:09 -0700 Subject: [PATCH 04/11] Prevent build from restoring public packages Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/build-test-tool-template.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pipelines/build-test-tool-template.yaml b/pipelines/build-test-tool-template.yaml index e7ce5da71..de9b4d20c 100644 --- a/pipelines/build-test-tool-template.yaml +++ b/pipelines/build-test-tool-template.yaml @@ -19,7 +19,7 @@ steps: - task: DotNetCoreCLI@2 displayName: Build inputs: - arguments: '-c $(BuildConfiguration)' + arguments: '-c $(BuildConfiguration) --no-restore' - task: DotNetCoreCLI@2 displayName: Run unit tests (with coverage on Windows) From 30cadf05f0f59fd4a8450b9a73080cc642949367 Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Tue, 15 Sep 2026 12:12:13 -0700 Subject: [PATCH 05/11] Prevent tests from restoring public packages Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/build-test-tool-template.yaml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/pipelines/build-test-tool-template.yaml b/pipelines/build-test-tool-template.yaml index de9b4d20c..27baa74c9 100644 --- a/pipelines/build-test-tool-template.yaml +++ b/pipelines/build-test-tool-template.yaml @@ -26,18 +26,14 @@ steps: condition: eq(variables['Agent.OS'], 'Windows_NT') inputs: command: 'test' - nobuild: true - configuration: '$(BuildConfiguration)' - arguments: '-- --report-trx --results-directory $(Agent.TempDirectory) --coverage --coverage-output $(Agent.TempDirectory)/coverage.cobertura.xml --coverage-output-format cobertura' + arguments: '-c $(BuildConfiguration) --no-build --no-restore -- --report-trx --results-directory $(Agent.TempDirectory) --coverage --coverage-output $(Agent.TempDirectory)/coverage.cobertura.xml --coverage-output-format cobertura' - task: DotNetCoreCLI@2 displayName: Run unit tests (without coverage on non-Windows) condition: ne(variables['Agent.OS'], 'Windows_NT') inputs: command: 'test' - nobuild: true - configuration: '$(BuildConfiguration)' - arguments: '-- --report-trx --results-directory $(Agent.TempDirectory)' + arguments: '-c $(BuildConfiguration) --no-build --no-restore -- --report-trx --results-directory $(Agent.TempDirectory)' # While DotNetCoreCLI docs say that it publishes both TRX and coverage, it doesn't actually publish coverage. # https://github.com/microsoft/azure-pipelines-tasks/issues/18254 From ed3b7e0455a4b68190def249dbf2636f6a017e13 Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Tue, 15 Sep 2026 21:37:45 -0700 Subject: [PATCH 06/11] Use internal feed for nested test restores Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/build-test-tool-template.yaml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/pipelines/build-test-tool-template.yaml b/pipelines/build-test-tool-template.yaml index 27baa74c9..2757f3cc8 100644 --- a/pipelines/build-test-tool-template.yaml +++ b/pipelines/build-test-tool-template.yaml @@ -7,13 +7,18 @@ steps: - task: NuGetAuthenticate@1 displayName: 'Authenticate to Azure Artifacts' + - pwsh: | + $configPath = "$(Build.SourcesDirectory)/nuget.config" + dotnet nuget remove source nuget.org --configfile $configPath + dotnet nuget add source "https://pkgs.dev.azure.com/mseng/AzureDevOps/_packaging/ManifestTool/nuget/v3/index.json" --name ManifestTool --configfile $configPath + displayName: 'Configure internal NuGet source' + - task: DotNetCoreCLI@2 displayName: 'Restore solution' inputs: command: restore - feedsToUse: select - vstsFeed: AzureDevOps/ManifestTool - includeNuGetOrg: false + feedsToUse: config + nugetConfigPath: nuget.config verbosityRestore: Normal - task: DotNetCoreCLI@2 From 981e0b6eaa5c0c2a41266e67c10387303c75bdfd Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Thu, 17 Sep 2026 14:12:42 -0700 Subject: [PATCH 07/11] Use supported macOS ARM64 image Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/sbom-tool-pr-build.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pipelines/sbom-tool-pr-build.yaml b/pipelines/sbom-tool-pr-build.yaml index 02bb44d9b..7bc4cbd80 100644 --- a/pipelines/sbom-tool-pr-build.yaml +++ b/pipelines/sbom-tool-pr-build.yaml @@ -52,8 +52,8 @@ extends: - job: Job_4 displayName: 'Build (macOS-arm64)' pool: - name: Azure Pipelines - image: macos-14-arm64 + name: GitHub-hosted Agents + image: macos-26-arm64 os: macOS steps: - template: pipelines/build-test-tool-template.yaml@self From 2b1f088af0fb64aba38a6e38cc715e4cbb5d353f Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Thu, 17 Sep 2026 14:34:37 -0700 Subject: [PATCH 08/11] Pass PAYG macOS image selector through 1ESPT Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/sbom-tool-pr-build.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pipelines/sbom-tool-pr-build.yaml b/pipelines/sbom-tool-pr-build.yaml index 7bc4cbd80..fc892536f 100644 --- a/pipelines/sbom-tool-pr-build.yaml +++ b/pipelines/sbom-tool-pr-build.yaml @@ -53,7 +53,7 @@ extends: displayName: 'Build (macOS-arm64)' pool: name: GitHub-hosted Agents - image: macos-26-arm64 + vmImage: macos-26-arm64 os: macOS steps: - template: pipelines/build-test-tool-template.yaml@self From 95e74077b02d61236673f08d52e7f77c7d595b5c Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Thu, 17 Sep 2026 15:20:46 -0700 Subject: [PATCH 09/11] Use supported macOS image in PR builds Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/sbom-tool-pr-build.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pipelines/sbom-tool-pr-build.yaml b/pipelines/sbom-tool-pr-build.yaml index fc892536f..50734ab28 100644 --- a/pipelines/sbom-tool-pr-build.yaml +++ b/pipelines/sbom-tool-pr-build.yaml @@ -52,8 +52,8 @@ extends: - job: Job_4 displayName: 'Build (macOS-arm64)' pool: - name: GitHub-hosted Agents - vmImage: macos-26-arm64 + name: Azure Pipelines + image: macos-latest os: macOS steps: - template: pipelines/build-test-tool-template.yaml@self From 827c49fb303b7facfeef8a4c8176a18fdc0eabf3 Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Thu, 17 Sep 2026 16:30:07 -0700 Subject: [PATCH 10/11] Use shared public package proxy feed Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/build-test-tool-template.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pipelines/build-test-tool-template.yaml b/pipelines/build-test-tool-template.yaml index 2757f3cc8..b5df4f4b2 100644 --- a/pipelines/build-test-tool-template.yaml +++ b/pipelines/build-test-tool-template.yaml @@ -10,7 +10,7 @@ steps: - pwsh: | $configPath = "$(Build.SourcesDirectory)/nuget.config" dotnet nuget remove source nuget.org --configfile $configPath - dotnet nuget add source "https://pkgs.dev.azure.com/mseng/AzureDevOps/_packaging/ManifestTool/nuget/v3/index.json" --name ManifestTool --configfile $configPath + dotnet nuget add source "https://pkgs.dev.azure.com/mseng/_packaging/SbomTool-PublicPackagesFeed/nuget/v3/index.json" --name SbomTool-PublicPackagesFeed --configfile $configPath displayName: 'Configure internal NuGet source' - task: DotNetCoreCLI@2 From f0506cdf78a739d457801f5c054954d388e158dc Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Fri, 18 Sep 2026 11:48:09 -0700 Subject: [PATCH 11/11] Validate osx-arm64 publishing in PR builds Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/sbom-tool-pr-build.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/pipelines/sbom-tool-pr-build.yaml b/pipelines/sbom-tool-pr-build.yaml index 50734ab28..f9b31629d 100644 --- a/pipelines/sbom-tool-pr-build.yaml +++ b/pipelines/sbom-tool-pr-build.yaml @@ -11,6 +11,7 @@ resources: variables: BuildConfiguration: 'Release' + MacOSArm64NetRuntime: 'osx-arm64' extends: template: v1/1ES.Unofficial.PipelineTemplate.yml@1esPipelines @@ -57,3 +58,13 @@ extends: os: macOS steps: - template: pipelines/build-test-tool-template.yaml@self + + - task: DotNetCoreCLI@2 + displayName: 'Build osx-arm64 self-contained binary' + inputs: + command: publish + publishWebProjects: false + projects: src/Microsoft.Sbom.Tool/Microsoft.Sbom.Tool.csproj + arguments: '-c $(BuildConfiguration) --no-restore --output $(Build.ArtifactStagingDirectory)/osx-arm64 --self-contained --runtime $(MacOSArm64NetRuntime) -p:PublishSingleFile=true -p:DebugType=None -f net8.0' + zipAfterPublish: false + modifyOutputPath: false