From 8c89301ebab09d8aa949efc3043b704df973124a Mon Sep 17 00:00:00 2001 From: MerlinBot Date: Fri, 7 Feb 2025 21:44:29 +0000 Subject: [PATCH 1/2] This pull request includes baselines **with an expiration date of 180 days from now** automatically generated for your 1ES PT-based pipelines. Complete this pull request as soon as possible to make sure that your pipeline becomes compliant. Longer delays in completing this PR can trigger additional emails or S360 alerts in the future. 1ES PT Auto-baselining feature helps capture existing violations in your repo and ensures to break your pipeline only for newly introduced SDL violations after baselining. Running SDL tools in break mode is required for your pipeline to be compliant. Go to https://aka.ms/1espt-autobaselining for more details. **Please do not Abandon this PR.** Please reach out to 1ES PT for support. More details: https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/1es-pipeline-templates/support --- .../1espt/PipelineAutobaseliningConfig.yml | 23 +++ .config/guardian/.gdnbaselines | 155 ++++++++++++++++++ 2 files changed, 178 insertions(+) create mode 100644 .config/1espt/PipelineAutobaseliningConfig.yml create mode 100644 .config/guardian/.gdnbaselines diff --git a/.config/1espt/PipelineAutobaseliningConfig.yml b/.config/1espt/PipelineAutobaseliningConfig.yml new file mode 100644 index 00000000..f94ccddf --- /dev/null +++ b/.config/1espt/PipelineAutobaseliningConfig.yml @@ -0,0 +1,23 @@ +## DO NOT MODIFY THIS FILE MANUALLY. This is part of auto-baselining from 1ES Pipeline Templates. Go to [https://aka.ms/1espt-autobaselining] for more details. + +pipelines: + 525: + retail: + source: + credscan: + lastModifiedDate: 2024-04-05 + eslint: + lastModifiedDate: 2024-04-05 + psscriptanalyzer: + lastModifiedDate: 2024-04-05 + armory: + lastModifiedDate: 2024-04-05 + policheck: + lastModifiedDate: 2024-09-17 + binary: + credscan: + lastModifiedDate: 2024-04-05 + binskim: + lastModifiedDate: 2025-01-25 + spotbugs: + lastModifiedDate: 2024-04-05 diff --git a/.config/guardian/.gdnbaselines b/.config/guardian/.gdnbaselines new file mode 100644 index 00000000..682b41c8 --- /dev/null +++ b/.config/guardian/.gdnbaselines @@ -0,0 +1,155 @@ +{ + "properties": { + "helpUri": "https://eng.ms/docs/microsoft-security/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/microsoft-guardian/general/baselines" + }, + "version": "1.0.0", + "baselines": { + "default": { + "name": "default", + "createdDate": "2024-04-05 17:53:53Z", + "lastUpdatedDate": "2024-04-05 17:53:53Z" + } + }, + "results": { + "789cf67c8d4cd2fdd206bfba5058f673deec8f09557f1ecbcb9753e02a6f81ab": { + "signature": "789cf67c8d4cd2fdd206bfba5058f673deec8f09557f1ecbcb9753e02a6f81ab", + "alternativeSignatures": [], + "target": "MicroBuild/Plugins/nuget.config", + "line": 9, + "memberOf": [ + "default" + ], + "tool": "credscan", + "ruleId": "CSCAN-GENERAL0060", + "createdDate": "2024-04-05 17:53:53Z", + "expirationDate": "2024-09-22 17:57:29Z", + "justification": "This error is baselined with an expiration date of 180 days from 2024-04-05 17:57:29Z" + }, + "d53e0926c71c90172942edd165284e747846e11a2bee3ca8fd8f32575b224593": { + "signature": "d53e0926c71c90172942edd165284e747846e11a2bee3ca8fd8f32575b224593", + "alternativeSignatures": [], + "target": "MicroBuild/Plugins/MicroBuild.Plugins.Signing.1.1.913/build/tools/dlabnugetcert.pfx", + "line": 1, + "memberOf": [ + "default" + ], + "tool": "credscan", + "ruleId": "CSCAN-GENERAL0020", + "createdDate": "2024-04-05 17:53:53Z", + "expirationDate": "2024-09-22 17:57:29Z", + "justification": "This error is baselined with an expiration date of 180 days from 2024-04-05 17:57:29Z" + }, + "e170f3a23081e920943abc701a4e54324b4eff5e17ed7a51646395dbe94f59c1": { + "signature": "e170f3a23081e920943abc701a4e54324b4eff5e17ed7a51646395dbe94f59c1", + "alternativeSignatures": [], + "target": "MicroBuild/Plugins/MicroBuild.Plugins.Signing.1.1.913/build/tools/dynamicsha1.pfx", + "line": 1, + "memberOf": [ + "default" + ], + "tool": "credscan", + "ruleId": "CSCAN-GENERAL0020", + "createdDate": "2024-04-05 17:53:53Z", + "expirationDate": "2024-09-22 17:57:29Z", + "justification": "This error is baselined with an expiration date of 180 days from 2024-04-05 17:57:29Z" + }, + "c511df2a1a3a5294c36c9805c10256d91671f8d33ac076318fc469e6e5775e5d": { + "signature": "c511df2a1a3a5294c36c9805c10256d91671f8d33ac076318fc469e6e5775e5d", + "alternativeSignatures": [], + "target": "MicroBuild/Plugins/MicroBuild.Plugins.Signing.1.1.913/build/tools/dynamicsha2.pfx", + "line": 1, + "memberOf": [ + "default" + ], + "tool": "credscan", + "ruleId": "CSCAN-GENERAL0020", + "createdDate": "2024-04-05 17:53:53Z", + "expirationDate": "2024-09-22 17:57:29Z", + "justification": "This error is baselined with an expiration date of 180 days from 2024-04-05 17:57:29Z" + }, + "9df8e8b00de1638f97776824f2713a352462001308d07c0bd764f6f4dde90c14": { + "signature": "9df8e8b00de1638f97776824f2713a352462001308d07c0bd764f6f4dde90c14", + "alternativeSignatures": [], + "target": "MicroBuild/Plugins/MicroBuild.Plugins.Signing.1.1.913/build/tools/testdlab.pfx", + "line": 1, + "memberOf": [ + "default" + ], + "tool": "credscan", + "ruleId": "CSCAN-GENERAL0020", + "createdDate": "2024-04-05 17:53:53Z", + "expirationDate": "2024-09-22 17:57:29Z", + "justification": "This error is baselined with an expiration date of 180 days from 2024-04-05 17:57:29Z" + }, + "5120fcb93cf4277f3cbae37ae1a6d800d31c413c726e6e0269240184039a941e": { + "signature": "5120fcb93cf4277f3cbae37ae1a6d800d31c413c726e6e0269240184039a941e", + "alternativeSignatures": [], + "target": "MicroBuild/Plugins/MicroBuild.Plugins.Signing.1.1.913/build/tools/testdlabsha2.pfx", + "line": 1, + "memberOf": [ + "default" + ], + "tool": "credscan", + "ruleId": "CSCAN-GENERAL0020", + "createdDate": "2024-04-05 17:53:53Z", + "expirationDate": "2024-09-22 17:57:29Z", + "justification": "This error is baselined with an expiration date of 180 days from 2024-04-05 17:57:29Z" + }, + "cebbc96c2a6f1edc3afcb167aa55fd6a9f89b62af067057d9582ea217dd2a75a": { + "signature": "cebbc96c2a6f1edc3afcb167aa55fd6a9f89b62af067057d9582ea217dd2a75a", + "alternativeSignatures": [], + "target": "MicroBuild/Plugins/MicroBuild.Plugins.Signing.1.1.913/build/tools/vsmsappx.pfx", + "line": 1, + "memberOf": [ + "default" + ], + "tool": "credscan", + "ruleId": "CSCAN-GENERAL0020", + "createdDate": "2024-04-05 17:53:53Z", + "expirationDate": "2024-09-22 17:57:29Z", + "justification": "This error is baselined with an expiration date of 180 days from 2024-04-05 17:57:29Z" + }, + "f4ffffdcce609b0409d6c3fec1d0eaadbb63f6088303ababf340993b84ebe2b4": { + "signature": "f4ffffdcce609b0409d6c3fec1d0eaadbb63f6088303ababf340993b84ebe2b4", + "alternativeSignatures": [], + "target": "MicroBuild/Plugins/MicroBuild.Plugins.Signing.1.1.913/build/tools/WinBlue.pfx", + "line": 1, + "memberOf": [ + "default" + ], + "tool": "credscan", + "ruleId": "CSCAN-GENERAL0020", + "createdDate": "2024-04-05 17:53:53Z", + "expirationDate": "2024-09-22 17:57:29Z", + "justification": "This error is baselined with an expiration date of 180 days from 2024-04-05 17:57:29Z" + }, + "3441729f19f1d38832fe6e5cc5823f19db219c0e15349fe4f74f1f54d0d22bde": { + "signature": "3441729f19f1d38832fe6e5cc5823f19db219c0e15349fe4f74f1f54d0d22bde", + "alternativeSignatures": [], + "target": "MicroBuild/Plugins/MicroBuild.Plugins.Signing.1.1.913/build/tools/WP223.pfx", + "line": 1, + "memberOf": [ + "default" + ], + "tool": "credscan", + "ruleId": "CSCAN-GENERAL0020", + "createdDate": "2024-04-05 17:53:53Z", + "expirationDate": "2024-09-22 17:57:29Z", + "justification": "This error is baselined with an expiration date of 180 days from 2024-04-05 17:57:29Z" + }, + "f6b2f8d6491d6f464bf00e2dbc9129558473ed1f541a017eda0f926e2e2f10d1": { + "signature": "f6b2f8d6491d6f464bf00e2dbc9129558473ed1f541a017eda0f926e2e2f10d1", + "alternativeSignatures": [], + "target": "MicroBuild/Plugins/MicroBuild.Plugins.Signing.1.1.913/build/tools/MobileTools/7Sign/tcb.pfx", + "line": 1, + "memberOf": [ + "default" + ], + "tool": "credscan", + "ruleId": "CSCAN-GENERAL0020", + "createdDate": "2024-04-05 17:53:53Z", + "expirationDate": "2024-09-22 17:57:29Z", + "justification": "This error is baselined with an expiration date of 180 days from 2024-04-05 17:57:29Z" + } + } +} \ No newline at end of file From 85f54148b536c303d8e5350210024adf59f31a3a Mon Sep 17 00:00:00 2001 From: Eduardo Villalpando Mello Date: Mon, 10 Feb 2025 09:01:45 -0800 Subject: [PATCH 2/2] Remove unused signing target Add files to ItemsToSign Sign .msi file too Update `ItemsToSign` Update certificate name UseDotNetCertificate Add .msi certificatename --- eng/Signing.props | 19 ++-- src/redist/redist.csproj | 9 +- src/redist/targets/GenerateLayout.targets | 1 - src/redist/targets/Signing.targets | 121 ---------------------- 4 files changed, 16 insertions(+), 134 deletions(-) delete mode 100644 src/redist/targets/Signing.targets diff --git a/eng/Signing.props b/eng/Signing.props index 8c58f1f0..5f91c439 100644 --- a/eng/Signing.props +++ b/eng/Signing.props @@ -1,13 +1,20 @@ - - true + true + + + + + + + + - + diff --git a/src/redist/redist.csproj b/src/redist/redist.csproj index 8e846dca..846ded9c 100644 --- a/src/redist/redist.csproj +++ b/src/redist/redist.csproj @@ -10,16 +10,13 @@ - + - - - - + - + \ No newline at end of file diff --git a/src/redist/targets/GenerateLayout.targets b/src/redist/targets/GenerateLayout.targets index 6e55c579..c3f4f44f 100644 --- a/src/redist/targets/GenerateLayout.targets +++ b/src/redist/targets/GenerateLayout.targets @@ -5,7 +5,6 @@ <_PublishSingleFileForRid>true <_PublishSingleFileForRid Condition="'$(RID)' == 'win-x86'">false <_GenerateLayoutDependsOnTargets>CleanLayoutPath;PublishDotnetCoreUninstallProject - <_GenerateLayoutDependsOnTargets Condition="'$(RID)' == 'win-x86'">CleanLayoutPath;PublishDotnetCoreUninstallProject;SignLayout diff --git a/src/redist/targets/Signing.targets b/src/redist/targets/Signing.targets deleted file mode 100644 index b98d63b8..00000000 --- a/src/redist/targets/Signing.targets +++ /dev/null @@ -1,121 +0,0 @@ - - - - - - - - - - - 3PartySHA2 - Microsoft400 - NuGet - - - - - - - - - - - - - - - - - - - - - - - - - false - - - - - - - - - - <_DryRun>true - <_DryRun Condition="'$(OfficialBuild)' == 'true'">false - - <_TestSign>false - <_TestSign Condition="'$(DotNetSignType)' == 'test'">true - - <_DesktopMSBuildRequired>false - <_DesktopMSBuildRequired Condition="'$(_DryRun)' != 'true' and '$(MSBuildRuntimeType)' == 'Core'">true - - - - - - - - - <_DesktopMSBuildPath Condition="$(_DesktopMSBuildRequired)">$(_VSInstallDir)\MSBuild\Current\Bin\msbuild.exe - - - - - - - - - $(ExternalCertificateId) - - - - $(InternalCertificateId) - - - - - %(CertificateName) - - - - - - - - - - - - - - - - - - $(InternalCertificateId) - - - - - - - - -