CodeSign Mac packages in nuget pipeline (#16291)

### Description 1. Updated Mac package workflow for easily debugging. 2. Changed Archive type from tgz to zip since zip is supported by ESRP. 3. .../dylib.dSYM/Contents/Resources/DWARF/libonnxruntime.1.16.0.dylib is a debug symbol file, so it couldn't be signed. ### Motivation and Context It‘s required from VS code. Mac binaries in nuget should be signed
2026-07-22 19:23:30 +00:00 · 2023-06-10 06:35:47 +08:00 · 2023-06-10 06:35:47 +08:00 · 3b5a8352c1
commit 3b5a8352c1
parent 1a22d245e2
4 changed files with 146 additions and 61 deletions
--- a/tools/ci_build/github/azure-pipelines/templates/c-api-cpu.yml
+++ b/tools/ci_build/github/azure-pipelines/templates/c-api-cpu.yml
@ -57,6 +57,9 @@ stages:
  parameters:
    AllowReleasedOpsetOnly: 1
    BuildForAllArchs: true
+    SpecificArtifact: ${{ parameters.SpecificArtifact }}
+    BuildId: ${{ parameters.BuildId }}
+    DoEsrp: ${{ parameters.DoEsrp }}

 - stage: Android_Java_API_AAR_Packaging_Mobile
  dependsOn: []
@ -203,7 +206,7 @@ stages:
 - stage: Jar_Packaging
  dependsOn:
  - Linux_C_API_Packaging_CPU
-  - MacOS_C_API_Packaging_CPU
+  - MacOS_C_API_Package_Publish
  - Windows_Packaging_CPU_x86_${{ parameters.BuildVariant }}
  - Windows_Packaging_CPU_x64_${{ parameters.BuildVariant }}
  - Windows_Packaging_CPU_arm_${{ parameters.BuildVariant }}
@ -287,7 +290,7 @@ stages:
  dependsOn:
  - Setup
  - Linux_C_API_Packaging_CPU
-  - MacOS_C_API_Packaging_CPU
+  - MacOS_C_API_Package_Publish
  - Windows_Packaging_CPU_x86_${{ parameters.BuildVariant }}
  - Windows_Packaging_CPU_x64_${{ parameters.BuildVariant }}
  - Windows_Packaging_CPU_arm_${{ parameters.BuildVariant }}
@ -523,10 +526,11 @@ stages:
    - task: mspremier.PostBuildCleanup.PostBuildCleanup-task.PostBuildCleanup@3
      displayName: 'Clean Agent Directories'
      condition: always()
+
 - stage: Nodejs_Packaging_CPU
  dependsOn:
  - Linux_C_API_Packaging_CPU
-  - MacOS_C_API_Packaging_CPU
+  - MacOS_C_API_Package_Publish
  - Windows_Packaging_CPU_x64_${{ parameters.BuildVariant }}
  - Windows_Packaging_CPU_arm64_${{ parameters.BuildVariant }}
  condition: succeeded()
--- a/tools/ci_build/github/azure-pipelines/templates/mac-cpu-packaging-pipeline.yml
+++ b/tools/ci_build/github/azure-pipelines/templates/mac-cpu-packaging-pipeline.yml
@ -22,78 +22,103 @@ parameters:
  type: boolean
  default: false

+- name: DoESRP
+  displayName: Do ESRP
+  type: boolean
+  default: false
+
+# these 2 parameters are used for debugging.
+- name: SpecificArtifact
+  displayName: Use Specific Artifact (Debugging only)
+  type: boolean
+  default: false
+
+- name: BuildId
+  displayName: Pipeline BuildId, you could find it in the URL
+  type: string
+  default: '0'
+
 stages:
 - stage: MacOS_C_API_Packaging_CPU
  dependsOn: []
  jobs:
-  - ${{ if eq(parameters.BuildForAllArchs, true) }}:
    - template: mac-cpu-packing-jobs.yml
      parameters:
        MacosArch: 'x86_64'
        AllowReleasedOpsetOnly: ${{ parameters.AllowReleasedOpsetOnly }}
        AdditionalBuildFlags: ${{ parameters.AdditionalBuildFlags }}
        WithCache: ${{ parameters.WithCache }}
-    - template: mac-cpu-packing-jobs.yml
-      parameters:
-        MacosArch: 'arm64'
-        AllowReleasedOpsetOnly: ${{ parameters.AllowReleasedOpsetOnly }}
-        AdditionalBuildFlags: ${{ parameters.AdditionalBuildFlags }}
-        WithCache: ${{ parameters.WithCache }}
-    - template: mac-cpu-packing-jobs.yml
-      parameters:
-        MacosArch: 'universal2'
-        AllowReleasedOpsetOnly: ${{ parameters.AllowReleasedOpsetOnly }}
-        AdditionalBuildFlags: ${{ parameters.AdditionalBuildFlags }}
-        WithCache: ${{ parameters.WithCache }}
-    - job: MacOS_C_API_Package_Publish_All
-      dependsOn:
-      - MacOS_C_API_Packaging_CPU_x86_64
-      - MacOS_C_API_Packaging_CPU_arm64
-      - MacOS_C_API_Packaging_CPU_universal2
+
+    - ${{ if eq(parameters.BuildForAllArchs, true) }}:
+      - template: mac-cpu-packing-jobs.yml
+        parameters:
+          MacosArch: 'arm64'
+          AllowReleasedOpsetOnly: ${{ parameters.AllowReleasedOpsetOnly }}
+          AdditionalBuildFlags: ${{ parameters.AdditionalBuildFlags }}
+          WithCache: ${{ parameters.WithCache }}
+      - template: mac-cpu-packing-jobs.yml
+        parameters:
+          MacosArch: 'universal2'
+          AllowReleasedOpsetOnly: ${{ parameters.AllowReleasedOpsetOnly }}
+          AdditionalBuildFlags: ${{ parameters.AdditionalBuildFlags }}
+          WithCache: ${{ parameters.WithCache }}
+
+- stage: MacOS_C_API_Package_Publish
+  dependsOn: MacOS_C_API_Packaging_CPU
+  jobs:
+    - job: MacOS_C_API_Package_Publish
      pool:
-        vmImage: 'macOS-13'
+        ${{ if eq(parameters.DoESRP, true)}}:
+          vmImage: 'macOS-12'
+        ${{ else }}:
+          vmImage: 'macOS-13'
      steps:
-      - task: DownloadPipelineArtifact@2
-        inputs:
-          artifact: 'onnxruntime-osx-x86_64'
-          targetPath: '$(Build.ArtifactStagingDirectory)'
-      - task: DownloadPipelineArtifact@2
-        inputs:
-          artifact: 'onnxruntime-osx-arm64'
-          targetPath: '$(Build.ArtifactStagingDirectory)'
-      - task: DownloadPipelineArtifact@2
-        inputs:
-          artifact: 'onnxruntime-osx-universal2'
-          targetPath: '$(Build.ArtifactStagingDirectory)'
-      - task: PublishPipelineArtifact@1
-        inputs:
-          targetPath: '$(Build.ArtifactStagingDirectory)'
-          artifact: 'onnxruntime-osx'
-          condition: 'succeededOrFailed()'
-      - template: component-governance-component-detection-steps.yml
-        parameters:
-          condition: 'succeeded'
-  - ${{ if ne(parameters.BuildForAllArchs, true) }}:
-    - template: mac-cpu-packing-jobs.yml
-      parameters:
-        MacosArch: 'x86_64'
-        AllowReleasedOpsetOnly: ${{ parameters.AllowReleasedOpsetOnly }}
-        AdditionalBuildFlags: ${{ parameters.AdditionalBuildFlags }}
-        WithCache: ${{ parameters.WithCache }}
-    - job: MacOS_C_API_Package_Publish_x86_64
-      dependsOn: MacOS_C_API_Packaging_CPU_x86_64
-      pool:
-        vmImage: 'macOS-13'
-      steps:
-      - task: DownloadPipelineArtifact@2
-        inputs:
-          artifact: 'onnxruntime-osx-x86_64'
-          targetPath: '$(Build.ArtifactStagingDirectory)'
+      - checkout: none
+      - template: flex-downloadPipelineArtifact.yml
+        parameters:
+          StepName: 'Download Pipeline onnxruntime-osx-x86_64'
+          ArtifactName: 'onnxruntime-osx-x86_64'
+          TargetPath: '$(Build.ArtifactStagingDirectory)'
+          SpecificArtifact: ${{ parameters.specificArtifact }}
+          BuildId: ${{ parameters.BuildId }}
+
+      - ${{ if eq(parameters.BuildForAllArchs, true) }}:
+        - template: flex-downloadPipelineArtifact.yml
+          parameters:
+            StepName: 'Download Pipeline onnxruntime-osx-arm64'
+            ArtifactName: 'onnxruntime-osx-arm64'
+            TargetPath: '$(Build.ArtifactStagingDirectory)'
+            SpecificArtifact: ${{ parameters.specificArtifact }}
+            BuildId: ${{ parameters.BuildId }}
+        - template: flex-downloadPipelineArtifact.yml
+          parameters:
+            StepName: 'Download Pipeline onnxruntime-osx-universal2'
+            ArtifactName: 'onnxruntime-osx-universal2'
+            TargetPath: '$(Build.ArtifactStagingDirectory)'
+            SpecificArtifact: ${{ parameters.specificArtifact }}
+            BuildId: ${{ parameters.BuildId }}
+
+      - ${{ if eq(parameters.DoESRP, true)}}:
+        - template: mac-esrp-dylib.yml
+          parameters:
+            FolderPath: '$(Build.ArtifactStagingDirectory)'
+            DisplayName: 'ESRP - Sign Mac'
+            DoEsrp: true
+            Pattern: '*.zip'
+        - bash: |
+            set -ex
+            find $(Build.ArtifactStagingDirectory) -name "*.zip" -exec unzip {} -d $(Agent.TempDirectory)/macpackage \;
+            find $(Agent.TempDirectory)/macpackage -name "*.dylib" -exec codesign -dvvv {} \;
+            find $(Agent.TempDirectory)/macpackage -name "*.dylib" -exec ls -l {} \;
+            rm -rf $(Agent.TempDirectory)/macpackage
+          displayName: 'Verify code signing'
+
      - task: PublishPipelineArtifact@1
        inputs:
          targetPath: '$(Build.ArtifactStagingDirectory)'
          artifact: 'onnxruntime-osx'
          condition: 'succeededOrFailed()'
+
      - template: component-governance-component-detection-steps.yml
        parameters:
          condition: 'succeeded'
--- a/tools/ci_build/github/azure-pipelines/templates/mac-cpu-packaging-steps.yml
+++ b/tools/ci_build/github/azure-pipelines/templates/mac-cpu-packaging-steps.yml
@ -68,9 +68,8 @@ steps:
  inputs:
    rootFolderOrFile: '$(Build.BinariesDirectory)/onnxruntime-osx-${{ parameters.MacosArch }}-$(OnnxRuntimeVersion)'
    includeRootFolder: true
-    archiveType: 'tar' # Options: zip, 7z, tar, wim
-    tarCompression: 'gz'
-    archiveFile: '$(Build.ArtifactStagingDirectory)/onnxruntime-osx-${{ parameters.MacosArch }}-$(OnnxRuntimeVersion).tgz'
+    archiveType: 'zip' # Options: zip, 7z, tar, wim
+    archiveFile: '$(Build.ArtifactStagingDirectory)/onnxruntime-osx-${{ parameters.MacosArch }}-$(OnnxRuntimeVersion).zip'
    replaceExistingArchive: true

 - script: |
--- a/tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml
+++ b/tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml
@ -0,0 +1,57 @@
+parameters:
+- name: DoEsrp
+  type: boolean
+  default: true
+
+- name: FolderPath
+  type: string
+  default: ''
+
+- name: DisplayName
+  type: string
+  default: ''
+
+- name: Pattern
+  type: string
+  default: '*.zip'
+
+steps:
+- task: EsrpCodeSigning@3
+  displayName: ${{ parameters.DisplayName }}
+  condition: and(succeeded(), eq('${{ parameters.DoEsrp }}', true))
+  inputs:
+    ConnectedServiceName: 'OnnxRuntime CodeSign 20190817'
+    FolderPath: ${{ parameters.FolderPath }}
+    Pattern: ${{ parameters.Pattern }}
+    signConfigType: inlineSignParams
+    inlineOperation: |
+      [
+        {
+          "keyCode": "CP-401337-Apple",
+          "operationSetCode": "MacAppDeveloperSign",
+          "parameters": [
+            {
+              "parameterName": "OpusName",
+              "parameterValue": "Microsoft"
+            },
+            {
+              "parameterName": "OpusInfo",
+              "parameterValue": "http://www.microsoft.com"
+            },
+            {
+              "parameterName": "PageHash",
+              "parameterValue": "/NPH"
+            },
+            {
+              "parameterName": "FileDigest",
+              "parameterValue": "/fd sha256"
+            },
+            {
+              "parameterName": "TimeStamp",
+              "parameterValue": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
+            }
+          ],
+          "toolName": "sign",
+          "toolVersion": "1.0"
+        }
+      ]