Fix *nix permissions and use certificate_logical_to_actual - #27354
Merged
Travis Plunk (TravisEz13) merged 2 commits intoMay 1, 2026
Merged
Conversation
Copy link
Copy Markdown
Member
Sorry, something went wrong.
The tarball staging path used `Copy-Item`, which on *nix doesn't preserve the source file mode, so `pwsh` ended up 644 in the `.tar.gz`. The Debian, RPM, and macOS PKG paths explicitly `chmod` everything to 644 and then bump `pwsh` back to 755, which silently demoted `createdump` (the .NET helper that produces crash minidumps) along with it. Now we `chmod 755` both executables in all package staging paths, guarded by `Test-Path` since fxdependent builds don't bundle `createdump`. Also added regression tests which check the permissions of `pwsh` inside the Linux and macOS tarballs before we upload them. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Andy Jordan (andyleejordan)
force-pushed
the
andyleejordan/nix-permissions
branch
from
bb5baaa to
43668dc
Compare
April 27, 2026 16:13
Copy link
Copy Markdown
Member
Author
|
*nix permissions in tarball are fixed: > ls
powershell-7.9.99-preview.22-linux-x64.tar.gz
@andys-macbook-air ~/Downloads
> $pkgPath = '*.tar.gz'
@andys-macbook-air ~/Downloads
> $entry = & tar -tzvf $pkgPath | Where-Object { $_ -match '\spwsh$' } | Select-Object -First 1
@andys-macbook-air ~/Downloads
> $entry
-rwxr-xr-x 0 root root 94672 Apr 27 11:03 pwsh
and @Andys-MacBook-Air ~/Downloads
% ls
powershell-7.9.99-preview.23-osx-arm64.tar.gz
@Andys-MacBook-Air ~/Downloads
% tar xf ./powershell-7.9.99-preview.23-osx-arm64.tar.gz
@Andys-MacBook-Air ~/Downloads
% ./pwsh
PowerShell 7.9.99-preview.22
@andys-macbook-air ~/Downloads
> $PSVersionTable
Name Value
---- -----
PSVersion 7.9.99-preview.22
PSEdition Core
GitCommitId 7.9.99-preview.22
OS macOS 26.4.1
Platform Unix
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.4
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
|
Sorry, something went wrong.
… group The `CP-…` key codes used for ESRP signing are now set from ADO via the `certificate_logical_to_actual` variable group. The templates reference the following variables instead of literal codes: - `$(authenticode_cert_id)` - `$(authenticode_test_cert_id)` - `$(nuget_cert_id)` - `$(apple_cert_id)` - `$(pgp_linux_cert_id)` - `$(pgp_release_cert_id)` `nupkg.yml`, `mac-package-build.yml`, and `linux-package-build.yml` pick up the new group import. `linux-package-build.yml` also now selects the PGP signing profile based on whether `jobName` starts with `mariner`, so `PowerShell-Packages-Stages.yml` no longer threads a `signingProfile` parameter in for the two Mariner jobs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Andy Jordan (andyleejordan)
force-pushed
the
andyleejordan/nix-permissions
branch
from
43668dc to
6bffb1b
Compare
April 27, 2026 18:37
Andy Jordan (andyleejordan)
changed the base branch from
master
to
andyleejordan/apple-notarization
April 27, 2026 18:39
12 tasks
Andy Jordan (andyleejordan)
marked this pull request as ready for review
April 27, 2026 19:52
Andy Jordan (andyleejordan)
requested review from
a team and
Justin Chung (jshigetomi)
as code owners
April 27, 2026 19:52
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
Updates packaging and pipeline signing to (1) restore executable permissions in *nix tarballs and (2) switch signing configuration to use logical certificate/profile variables sourced from the certificate_logical_to_actual variable group.
Changes:
- Ensure pwsh (and createdump) have executable permissions when building tarball/Unix packages.
- Add pipeline regression checks to validate pwsh is executable inside produced .tar.gz artifacts before uploading.
- Replace hardcoded signing certificate/profile identifiers with variables from certificate_logical_to_actual across pipeline templates.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file| File | Description |
|---|---|
| tools/packaging/packaging.psm1 | Restores executable permissions for pwsh and createdump in tarball and Unix package flows. |
| .pipelines/templates/windows-hosted-build.yml | Uses $(nuget_cert_id) instead of a hardcoded NuGet signing cert ID. |
| .pipelines/templates/stages/PowerShell-Packages-Stages.yml | Removes Mariner-specific signingProfile parameters (selection moved into the linux packaging template). |
| .pipelines/templates/shouldSign.yml | Switches Authenticode/MSIX cert selection to mapped variables. |
| .pipelines/templates/nupkg.yml | Adds certificate_logical_to_actual group and uses $(nuget_cert_id) for NuPkg signing. |
| .pipelines/templates/mac.yml | Uses $(apple_cert_id) for Apple signing KeyCode. |
| .pipelines/templates/mac-package-build.yml | Adds cert mapping group usage and validates pwsh executable bit in produced tarballs before upload; uses $(apple_cert_id) for signing/notarization. |
| .pipelines/templates/linux-package-build.yml | Adds cert mapping group usage, selects PGP signing profile based on Mariner vs non-Mariner jobs, and validates pwsh executable bit for tarballs. |
Sorry, something went wrong.
Comment thread
.pipelines/templates/linux-package-build.yml
Comment thread
.pipelines/templates/linux-package-build.yml
Travis Plunk (TravisEz13)
approved these changes
May 1, 2026
Travis Plunk (TravisEz13)
merged commit 5a0f767
into
andyleejordan/apple-notarization
May 1, 2026
50 of 55 checks passed
12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
Assignees
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary
Fixes #23968 (with regression tests) and finishes the certificate code abstraction.
PR Context
In the pipelines we for reasons have to zip up the macOS and Linux builds on Windows which strips the executable permissions. We already had logic in the package scripts to correctly restore those permissions before building the RPM, DEB, and PKG packages, but not before packaging the tarball. Per the bug, it's been sadly broken for two years. You'd download the tarball, try to run ./pwsh and it wouldn't be executable. Now it is, with a regression test that checks the actual file in the tarball before we upload it.
PR Checklist