diff --git a/tools/ci_build/github/azure-pipelines/templates/c-api-cpu.yml b/tools/ci_build/github/azure-pipelines/templates/c-api-cpu.yml index 511300cb41..88e98b2ead 100644 --- a/tools/ci_build/github/azure-pipelines/templates/c-api-cpu.yml +++ b/tools/ci_build/github/azure-pipelines/templates/c-api-cpu.yml @@ -57,6 +57,9 @@ stages: parameters: AllowReleasedOpsetOnly: 1 BuildForAllArchs: true + SpecificArtifact: ${{ parameters.SpecificArtifact }} + BuildId: ${{ parameters.BuildId }} + DoEsrp: ${{ parameters.DoEsrp }} - stage: Android_Java_API_AAR_Packaging_Mobile dependsOn: [] @@ -203,7 +206,7 @@ stages: - stage: Jar_Packaging dependsOn: - Linux_C_API_Packaging_CPU - - MacOS_C_API_Packaging_CPU + - MacOS_C_API_Package_Publish - Windows_Packaging_CPU_x86_${{ parameters.BuildVariant }} - Windows_Packaging_CPU_x64_${{ parameters.BuildVariant }} - Windows_Packaging_CPU_arm_${{ parameters.BuildVariant }} @@ -287,7 +290,7 @@ stages: dependsOn: - Setup - Linux_C_API_Packaging_CPU - - MacOS_C_API_Packaging_CPU + - MacOS_C_API_Package_Publish - Windows_Packaging_CPU_x86_${{ parameters.BuildVariant }} - Windows_Packaging_CPU_x64_${{ parameters.BuildVariant }} - Windows_Packaging_CPU_arm_${{ parameters.BuildVariant }} @@ -523,10 +526,11 @@ stages: - task: mspremier.PostBuildCleanup.PostBuildCleanup-task.PostBuildCleanup@3 displayName: 'Clean Agent Directories' condition: always() + - stage: Nodejs_Packaging_CPU dependsOn: - Linux_C_API_Packaging_CPU - - MacOS_C_API_Packaging_CPU + - MacOS_C_API_Package_Publish - Windows_Packaging_CPU_x64_${{ parameters.BuildVariant }} - Windows_Packaging_CPU_arm64_${{ parameters.BuildVariant }} condition: succeeded() diff --git a/tools/ci_build/github/azure-pipelines/templates/mac-cpu-packaging-pipeline.yml b/tools/ci_build/github/azure-pipelines/templates/mac-cpu-packaging-pipeline.yml index 790f5afb0d..1f908927e6 100644 --- a/tools/ci_build/github/azure-pipelines/templates/mac-cpu-packaging-pipeline.yml +++ b/tools/ci_build/github/azure-pipelines/templates/mac-cpu-packaging-pipeline.yml @@ -22,78 +22,103 @@ parameters: type: boolean default: false +- name: DoESRP + displayName: Do ESRP + type: boolean + default: false + +# these 2 parameters are used for debugging. +- name: SpecificArtifact + displayName: Use Specific Artifact (Debugging only) + type: boolean + default: false + +- name: BuildId + displayName: Pipeline BuildId, you could find it in the URL + type: string + default: '0' + stages: - stage: MacOS_C_API_Packaging_CPU dependsOn: [] jobs: - - ${{ if eq(parameters.BuildForAllArchs, true) }}: - template: mac-cpu-packing-jobs.yml parameters: MacosArch: 'x86_64' AllowReleasedOpsetOnly: ${{ parameters.AllowReleasedOpsetOnly }} AdditionalBuildFlags: ${{ parameters.AdditionalBuildFlags }} WithCache: ${{ parameters.WithCache }} - - template: mac-cpu-packing-jobs.yml - parameters: - MacosArch: 'arm64' - AllowReleasedOpsetOnly: ${{ parameters.AllowReleasedOpsetOnly }} - AdditionalBuildFlags: ${{ parameters.AdditionalBuildFlags }} - WithCache: ${{ parameters.WithCache }} - - template: mac-cpu-packing-jobs.yml - parameters: - MacosArch: 'universal2' - AllowReleasedOpsetOnly: ${{ parameters.AllowReleasedOpsetOnly }} - AdditionalBuildFlags: ${{ parameters.AdditionalBuildFlags }} - WithCache: ${{ parameters.WithCache }} - - job: MacOS_C_API_Package_Publish_All - dependsOn: - - MacOS_C_API_Packaging_CPU_x86_64 - - MacOS_C_API_Packaging_CPU_arm64 - - MacOS_C_API_Packaging_CPU_universal2 + + - ${{ if eq(parameters.BuildForAllArchs, true) }}: + - template: mac-cpu-packing-jobs.yml + parameters: + MacosArch: 'arm64' + AllowReleasedOpsetOnly: ${{ parameters.AllowReleasedOpsetOnly }} + AdditionalBuildFlags: ${{ parameters.AdditionalBuildFlags }} + WithCache: ${{ parameters.WithCache }} + - template: mac-cpu-packing-jobs.yml + parameters: + MacosArch: 'universal2' + AllowReleasedOpsetOnly: ${{ parameters.AllowReleasedOpsetOnly }} + AdditionalBuildFlags: ${{ parameters.AdditionalBuildFlags }} + WithCache: ${{ parameters.WithCache }} + +- stage: MacOS_C_API_Package_Publish + dependsOn: MacOS_C_API_Packaging_CPU + jobs: + - job: MacOS_C_API_Package_Publish pool: - vmImage: 'macOS-13' + ${{ if eq(parameters.DoESRP, true)}}: + vmImage: 'macOS-12' + ${{ else }}: + vmImage: 'macOS-13' steps: - - task: DownloadPipelineArtifact@2 - inputs: - artifact: 'onnxruntime-osx-x86_64' - targetPath: '$(Build.ArtifactStagingDirectory)' - - task: DownloadPipelineArtifact@2 - inputs: - artifact: 'onnxruntime-osx-arm64' - targetPath: '$(Build.ArtifactStagingDirectory)' - - task: DownloadPipelineArtifact@2 - inputs: - artifact: 'onnxruntime-osx-universal2' - targetPath: '$(Build.ArtifactStagingDirectory)' - - task: PublishPipelineArtifact@1 - inputs: - targetPath: '$(Build.ArtifactStagingDirectory)' - artifact: 'onnxruntime-osx' - condition: 'succeededOrFailed()' - - template: component-governance-component-detection-steps.yml - parameters: - condition: 'succeeded' - - ${{ if ne(parameters.BuildForAllArchs, true) }}: - - template: mac-cpu-packing-jobs.yml - parameters: - MacosArch: 'x86_64' - AllowReleasedOpsetOnly: ${{ parameters.AllowReleasedOpsetOnly }} - AdditionalBuildFlags: ${{ parameters.AdditionalBuildFlags }} - WithCache: ${{ parameters.WithCache }} - - job: MacOS_C_API_Package_Publish_x86_64 - dependsOn: MacOS_C_API_Packaging_CPU_x86_64 - pool: - vmImage: 'macOS-13' - steps: - - task: DownloadPipelineArtifact@2 - inputs: - artifact: 'onnxruntime-osx-x86_64' - targetPath: '$(Build.ArtifactStagingDirectory)' + - checkout: none + - template: flex-downloadPipelineArtifact.yml + parameters: + StepName: 'Download Pipeline onnxruntime-osx-x86_64' + ArtifactName: 'onnxruntime-osx-x86_64' + TargetPath: '$(Build.ArtifactStagingDirectory)' + SpecificArtifact: ${{ parameters.specificArtifact }} + BuildId: ${{ parameters.BuildId }} + + - ${{ if eq(parameters.BuildForAllArchs, true) }}: + - template: flex-downloadPipelineArtifact.yml + parameters: + StepName: 'Download Pipeline onnxruntime-osx-arm64' + ArtifactName: 'onnxruntime-osx-arm64' + TargetPath: '$(Build.ArtifactStagingDirectory)' + SpecificArtifact: ${{ parameters.specificArtifact }} + BuildId: ${{ parameters.BuildId }} + - template: flex-downloadPipelineArtifact.yml + parameters: + StepName: 'Download Pipeline onnxruntime-osx-universal2' + ArtifactName: 'onnxruntime-osx-universal2' + TargetPath: '$(Build.ArtifactStagingDirectory)' + SpecificArtifact: ${{ parameters.specificArtifact }} + BuildId: ${{ parameters.BuildId }} + + - ${{ if eq(parameters.DoESRP, true)}}: + - template: mac-esrp-dylib.yml + parameters: + FolderPath: '$(Build.ArtifactStagingDirectory)' + DisplayName: 'ESRP - Sign Mac' + DoEsrp: true + Pattern: '*.zip' + - bash: | + set -ex + find $(Build.ArtifactStagingDirectory) -name "*.zip" -exec unzip {} -d $(Agent.TempDirectory)/macpackage \; + find $(Agent.TempDirectory)/macpackage -name "*.dylib" -exec codesign -dvvv {} \; + find $(Agent.TempDirectory)/macpackage -name "*.dylib" -exec ls -l {} \; + rm -rf $(Agent.TempDirectory)/macpackage + displayName: 'Verify code signing' + - task: PublishPipelineArtifact@1 inputs: targetPath: '$(Build.ArtifactStagingDirectory)' artifact: 'onnxruntime-osx' condition: 'succeededOrFailed()' + - template: component-governance-component-detection-steps.yml parameters: condition: 'succeeded' diff --git a/tools/ci_build/github/azure-pipelines/templates/mac-cpu-packaging-steps.yml b/tools/ci_build/github/azure-pipelines/templates/mac-cpu-packaging-steps.yml index 0cb77e222a..1a188839cc 100644 --- a/tools/ci_build/github/azure-pipelines/templates/mac-cpu-packaging-steps.yml +++ b/tools/ci_build/github/azure-pipelines/templates/mac-cpu-packaging-steps.yml @@ -68,9 +68,8 @@ steps: inputs: rootFolderOrFile: '$(Build.BinariesDirectory)/onnxruntime-osx-${{ parameters.MacosArch }}-$(OnnxRuntimeVersion)' includeRootFolder: true - archiveType: 'tar' # Options: zip, 7z, tar, wim - tarCompression: 'gz' - archiveFile: '$(Build.ArtifactStagingDirectory)/onnxruntime-osx-${{ parameters.MacosArch }}-$(OnnxRuntimeVersion).tgz' + archiveType: 'zip' # Options: zip, 7z, tar, wim + archiveFile: '$(Build.ArtifactStagingDirectory)/onnxruntime-osx-${{ parameters.MacosArch }}-$(OnnxRuntimeVersion).zip' replaceExistingArchive: true - script: | diff --git a/tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml b/tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml new file mode 100644 index 0000000000..a9a0d87a30 --- /dev/null +++ b/tools/ci_build/github/azure-pipelines/templates/mac-esrp-dylib.yml @@ -0,0 +1,57 @@ +parameters: +- name: DoEsrp + type: boolean + default: true + +- name: FolderPath + type: string + default: '' + +- name: DisplayName + type: string + default: '' + +- name: Pattern + type: string + default: '*.zip' + +steps: +- task: EsrpCodeSigning@3 + displayName: ${{ parameters.DisplayName }} + condition: and(succeeded(), eq('${{ parameters.DoEsrp }}', true)) + inputs: + ConnectedServiceName: 'OnnxRuntime CodeSign 20190817' + FolderPath: ${{ parameters.FolderPath }} + Pattern: ${{ parameters.Pattern }} + signConfigType: inlineSignParams + inlineOperation: | + [ + { + "keyCode": "CP-401337-Apple", + "operationSetCode": "MacAppDeveloperSign", + "parameters": [ + { + "parameterName": "OpusName", + "parameterValue": "Microsoft" + }, + { + "parameterName": "OpusInfo", + "parameterValue": "http://www.microsoft.com" + }, + { + "parameterName": "PageHash", + "parameterValue": "/NPH" + }, + { + "parameterName": "FileDigest", + "parameterValue": "/fd sha256" + }, + { + "parameterName": "TimeStamp", + "parameterValue": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256" + } + ], + "toolName": "sign", + "toolVersion": "1.0" + } + ]