[release/v7.4.16] Fix *nix permissions and use certificate_logical_to_actual - #27452
Merged
Aditya Patwardhan (adityapatwardhan) merged 4 commits intoMay 15, 2026
Merged
Conversation
Copy link
Copy Markdown
Member
Sorry, something went wrong.
The tarball staging path used `Copy-Item`, which on *nix doesn't preserve the source file mode, so `pwsh` ended up 644 in the `.tar.gz`. The Debian, RPM, and macOS PKG paths explicitly `chmod` everything to 644 and then bump `pwsh` back to 755, which silently demoted `createdump` (the .NET helper that produces crash minidumps) along with it. Now we `chmod 755` both executables in all package staging paths, guarded by `Test-Path` since fxdependent builds don't bundle `createdump`. Also added regression tests which check the permissions of `pwsh` inside the Linux and macOS tarballs before we upload them. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… group The `CP-…` key codes used for ESRP signing are now set from ADO via the `certificate_logical_to_actual` variable group. The templates reference the following variables instead of literal codes: - `$(authenticode_cert_id)` - `$(authenticode_test_cert_id)` - `$(nuget_cert_id)` - `$(apple_cert_id)` - `$(pgp_linux_cert_id)` - `$(pgp_release_cert_id)` `nupkg.yml`, `mac-package-build.yml`, and `linux-package-build.yml` pick up the new group import. `linux-package-build.yml` also now selects the PGP signing profile based on whether `jobName` starts with `mariner`, so `PowerShell-Packages-Stages.yml` no longer threads a `signingProfile` parameter in for the two Mariner jobs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
It's been this way for a couple years which means we've been passing...something else?
Aditya Patwardhan (adityapatwardhan)
requested a review
from a team
as a code owner
May 14, 2026 19:47
Copilot started reviewing on behalf of
Aditya Patwardhan (adityapatwardhan)
May 14, 2026 19:47
View session
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
Backports release packaging/signing updates for v7.4.16 to restore executable permissions in Unix tarballs/packages and move signing configuration to certificate_logical_to_actual variables.
Changes:
- Restores executable permissions for pwsh and createdump in Unix packaging paths.
- Replaces hardcoded signing certificate/profile identifiers with variable-group-backed IDs.
- Adds tarball permission validation and macOS Apple signing/notarization steps.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file| File | Description |
|---|---|
| tools/packaging/packaging.psm1 | Sets executable permissions for pwsh and createdump during tarball and Unix package creation. |
| .pipelines/templates/windows-hosted-build.yml | Uses $(nuget_cert_id) for NuGet signing. |
| .pipelines/templates/stages/PowerShell-Packages-Stages.yml | Removes explicit Mariner signing profile overrides. |
| .pipelines/templates/shouldSign.yml | Uses logical certificate variables for Authenticode/MSIX signing. |
| .pipelines/templates/nupkg.yml | Adds certificate variable group and uses $(nuget_cert_id). |
| .pipelines/templates/mac.yml | Adds Apple signing of Mach-O binaries after existing signing output is produced. |
| .pipelines/templates/mac-package-build.yml | Adds certificate group usage, tarball permission validation, Apple cert variable use, and notarization. |
| .pipelines/templates/linux-package-build.yml | Fixes signed drop parameter naming, selects PGP profile from certificate variables, and validates tarball pwsh permissions. |
Sorry, something went wrong.
Comment thread
tools/packaging/packaging.psm1
Comment on lines
+801
to
+804
| # Included .NET executable for producing crash dumps | ||
| $createdumpInStaging = Join-Path $Staging 'createdump' | ||
| if (Test-Path -LiteralPath $createdumpInStaging) { | ||
| Start-NativeExecution { chmod 755 $createdumpInStaging } |
Andy Jordan (andyleejordan)
approved these changes
May 14, 2026
Aditya Patwardhan (adityapatwardhan)
enabled auto-merge (squash)
May 15, 2026 17:48
Aditya Patwardhan (adityapatwardhan)
merged commit 13e1c2f
into
release/v7.4.16
May 15, 2026
44 of 47 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #27385 to release/v7.4.16
Triggered by Aditya Patwardhan (@adityapatwardhan) on behalf of Andy Jordan (@andyleejordan)
Original CL Label: CL-BuildPackaging
/cc @PowerShell/powershell-maintainers
Impact
REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.
Tooling Impact
Updates build and packaging scripts to use new ESRP key variables and correct file permissions for release artifacts.
Customer Impact
Restores executable permissions for pwsh in tarballs, adds regression tests, and finalizes ESRP key abstraction. Addresses #23968 and internal build issues.
Regression
REQUIRED: Check exactly one box.
This is not a regression.
Testing
Validated by running full build and packaging pipelines for Linux and macOS. Regression tests added for tarball permissions. All artifacts verified for correct signing and permissions.
Risk
REQUIRED: Check exactly one box.
Changes are limited to packaging scripts and build pipelines. Extensively tested with new regression tests and verified in internal builds.