[release/v7.6.2] Fix *nix permissions and use certificate_logical_to_actual - #27439
Merged
Dongbo Wang (daxian-dbw) merged 4 commits intoMay 13, 2026
Conversation
Copy link
Copy Markdown
Member
Sorry, something went wrong.
It's been this way for a couple years which means we've been passing...something else?
Dongbo Wang (daxian-dbw)
requested review from
a team and
Justin Chung (jshigetomi)
as code owners
May 13, 2026 22:09
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
This PR is described as a release backport for *nix tarball permissions and signing certificate abstraction, but the submitted diff only corrects the Linux package template’s signed artifact parameter name.
Changes:
- Renames the default parameter from signedeDrop to signedDrop.
Sorry, something went wrong.
Comment thread
.pipelines/templates/linux-package-build.yml
| parameters: | ||
| unsignedDrop: 'drop_linux_build_linux_x64' | ||
| signedeDrop: 'drop_linux_sign_linux_x64' | ||
| signedDrop: 'drop_linux_sign_linux_x64' |
We still need to apply the template signing so that Guardian tasks pass and so that script files are signed. After doing what's essentially Windows signing, we sign and harden the binaries for macOS. Then we do the same for the PKG installer, and finally notarize it. The ESRP signing service requires a zip of files for Apple signing at all stages. Now that we can use it via the OneBranch signing task we no longer need the service connection or variable group that was trying to set it up. Notarization requires the BundleId from Get-MacOSPackageIdentifierInfo. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… group The `CP-…` key codes used for ESRP signing are now set from ADO via the `certificate_logical_to_actual` variable group. The templates reference the following variables instead of literal codes: - `$(authenticode_cert_id)` - `$(authenticode_test_cert_id)` - `$(nuget_cert_id)` - `$(apple_cert_id)` - `$(pgp_linux_cert_id)` - `$(pgp_release_cert_id)` `nupkg.yml`, `mac-package-build.yml`, and `linux-package-build.yml` pick up the new group import. `linux-package-build.yml` also now selects the PGP signing profile based on whether `jobName` starts with `mariner`, so `PowerShell-Packages-Stages.yml` no longer threads a `signingProfile` parameter in for the two Mariner jobs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The tarball staging path used `Copy-Item`, which on *nix doesn't preserve the source file mode, so `pwsh` ended up 644 in the `.tar.gz`. The Debian, RPM, and macOS PKG paths explicitly `chmod` everything to 644 and then bump `pwsh` back to 755, which silently demoted `createdump` (the .NET helper that produces crash minidumps) along with it. Now we `chmod 755` both executables in all package staging paths, guarded by `Test-Path` since fxdependent builds don't bundle `createdump`. Also added regression tests which check the permissions of `pwsh` inside the Linux and macOS tarballs before we upload them. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copy link
Copy Markdown
Member
Author
|
Andy's two PRs below were "rebase merged", which is unexpected and caused all commits from those PRs to get into the master branch without squashing. The backport logic assumes squashing merge always, so it only picks up the last commit.
To fix the backporting, I manually cherry-picked all missing commits into this PR, even though the commit ab700d1 actually belongs to #27347. |
Sorry, something went wrong.
9 tasks
Andy Jordan (andyleejordan)
approved these changes
May 13, 2026
Dongbo Wang (daxian-dbw)
merged commit b1fbe52
into
PowerShell:release/v7.6.2
May 13, 2026
37 checks passed
Dongbo Wang (daxian-dbw)
deleted the
backport/release/v7.6.2/27385-36673f6d4
branch
May 13, 2026 23:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #27385 to release/v7.6.2
Triggered by Dongbo Wang (@daxian-dbw) on behalf of Andy Jordan (@andyleejordan)
Original CL Label: CL-BuildPackaging
/cc @PowerShell/powershell-maintainers
Impact
REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.
Tooling Impact
Abstracts signing certificate codes into the certificate_logical_to_actual variable group across mac, linux, nupkg, and windows pipeline templates. Fixes tarball packaging to restore executable permissions on pwsh and createdump before archiving.
Customer Impact
Fixes a two-year-old bug (issue #23968) where the pwsh binary inside Linux/macOS tarballs was not executable. Users downloading the tarball and running ./pwsh would get a permission error.
Regression
REQUIRED: Check exactly one box.
This is not a regression.
Testing
Regression test added that inspects the tarball contents before upload and throws if pwsh is not executable (-..x pattern). Covers the fix for issue #23968. Signing cert abstraction validated via the original PR pipeline run.
Risk
REQUIRED: Check exactly one box.
Adds chmod 755 calls before tarball packaging and a regression test verifying executable bit. Signing cert variables are abstracted via a variable group. No behavioral change to existing packages that already set permissions correctly.