From 81dacc97eac86fbd0f055aa857763db092470b48 Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Mon, 21 Sep 2026 14:32:31 -0700 Subject: [PATCH 1/4] Allow ESRP signing through network isolation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/sbom-tool-main-build.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pipelines/sbom-tool-main-build.yaml b/pipelines/sbom-tool-main-build.yaml index a1f3dcfa4..054488af0 100644 --- a/pipelines/sbom-tool-main-build.yaml +++ b/pipelines/sbom-tool-main-build.yaml @@ -31,6 +31,8 @@ variables: extends: template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines parameters: + settings: + networkIsolationPolicy: Permissive sdl: sourceAnalysisPool: name: sbom-windows-build-pool From c8e74d7b8d31abc767465bf7fa1d68ed9cc21207 Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Mon, 21 Sep 2026 14:40:31 -0700 Subject: [PATCH 2/4] Allow forced signing for branch validation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/sbom-tool-main-build.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pipelines/sbom-tool-main-build.yaml b/pipelines/sbom-tool-main-build.yaml index 054488af0..291725c5c 100644 --- a/pipelines/sbom-tool-main-build.yaml +++ b/pipelines/sbom-tool-main-build.yaml @@ -99,7 +99,7 @@ extends: "ToolVersion" : "1.0" } ] - condition: and(succeeded(), startswith(variables['Build.SourceBranch'], 'refs/tags/')) + condition: and(succeeded(), or(startswith(variables['Build.SourceBranch'], 'refs/tags/'), eq(variables['ForceSigning'], 'true'))) - powershell: 'Get-ChildItem -Recurse -Filter *.csproj -Path src | ForEach-Object { dotnet pack $_.FullName -c $(BuildConfiguration) --no-restore --no-build -o $(Build.ArtifactStagingDirectory)/nuget --include-symbols -p:SymbolPackageFormat=snupkg }' displayName: 'Pack NuGet package' @@ -149,7 +149,7 @@ extends: "ToolVersion" : "1.0" } ] - condition: and(succeeded(), startswith(variables['Build.SourceBranch'], 'refs/tags/')) + condition: and(succeeded(), or(startswith(variables['Build.SourceBranch'], 'refs/tags/'), eq(variables['ForceSigning'], 'true'))) - powershell: 'Rename-Item -Path $(Build.ArtifactStagingDirectory)\win\Microsoft.Sbom.Tool.exe -NewName $(BinaryNameWindows)' displayName: 'Rename binaries' @@ -206,7 +206,7 @@ extends: "toolVersion": "1.0" } ] - condition: and(succeeded(), startswith(variables['Build.SourceBranch'], 'refs/tags/')) + condition: and(succeeded(), or(startswith(variables['Build.SourceBranch'], 'refs/tags/'), eq(variables['ForceSigning'], 'true'))) - powershell: | del $(Build.ArtifactStagingDirectory)\CodeSignSummary-*.md From 965fbde5f99633b6d4244546f72280c72d9c2200 Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Mon, 21 Sep 2026 15:31:48 -0700 Subject: [PATCH 3/4] Use pipeline variable for forced signing Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/sbom-tool-main-build.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/pipelines/sbom-tool-main-build.yaml b/pipelines/sbom-tool-main-build.yaml index 291725c5c..117a7cd69 100644 --- a/pipelines/sbom-tool-main-build.yaml +++ b/pipelines/sbom-tool-main-build.yaml @@ -18,7 +18,6 @@ variables: BuildConfiguration: 'Release' OutputArtifactName: 'SBOMTool' Packaging.EnableSBOMSigning: 'true' - ForceSigning: 'false' WindowsNetRuntime: 'win-x64' MacOSNetRuntime: 'osx-x64' MacOSArm64NetRuntime: 'osx-arm64' From f9bc2fa07d95a9acc18fa501f3c8341d1cbd27c4 Mon Sep 17 00:00:00 2001 From: Renan Luciano Date: Mon, 21 Sep 2026 15:37:11 -0700 Subject: [PATCH 4/4] Remove temporary branch signing override Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2c93a44-6ced-404f-8ebf-3361fd45b62d --- pipelines/sbom-tool-main-build.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pipelines/sbom-tool-main-build.yaml b/pipelines/sbom-tool-main-build.yaml index 117a7cd69..054488af0 100644 --- a/pipelines/sbom-tool-main-build.yaml +++ b/pipelines/sbom-tool-main-build.yaml @@ -18,6 +18,7 @@ variables: BuildConfiguration: 'Release' OutputArtifactName: 'SBOMTool' Packaging.EnableSBOMSigning: 'true' + ForceSigning: 'false' WindowsNetRuntime: 'win-x64' MacOSNetRuntime: 'osx-x64' MacOSArm64NetRuntime: 'osx-arm64' @@ -98,7 +99,7 @@ extends: "ToolVersion" : "1.0" } ] - condition: and(succeeded(), or(startswith(variables['Build.SourceBranch'], 'refs/tags/'), eq(variables['ForceSigning'], 'true'))) + condition: and(succeeded(), startswith(variables['Build.SourceBranch'], 'refs/tags/')) - powershell: 'Get-ChildItem -Recurse -Filter *.csproj -Path src | ForEach-Object { dotnet pack $_.FullName -c $(BuildConfiguration) --no-restore --no-build -o $(Build.ArtifactStagingDirectory)/nuget --include-symbols -p:SymbolPackageFormat=snupkg }' displayName: 'Pack NuGet package' @@ -148,7 +149,7 @@ extends: "ToolVersion" : "1.0" } ] - condition: and(succeeded(), or(startswith(variables['Build.SourceBranch'], 'refs/tags/'), eq(variables['ForceSigning'], 'true'))) + condition: and(succeeded(), startswith(variables['Build.SourceBranch'], 'refs/tags/')) - powershell: 'Rename-Item -Path $(Build.ArtifactStagingDirectory)\win\Microsoft.Sbom.Tool.exe -NewName $(BinaryNameWindows)' displayName: 'Rename binaries' @@ -205,7 +206,7 @@ extends: "toolVersion": "1.0" } ] - condition: and(succeeded(), or(startswith(variables['Build.SourceBranch'], 'refs/tags/'), eq(variables['ForceSigning'], 'true'))) + condition: and(succeeded(), startswith(variables['Build.SourceBranch'], 'refs/tags/')) - powershell: | del $(Build.ArtifactStagingDirectory)\CodeSignSummary-*.md