Merge pull request #97 (Update maint/maint-68 to 68.2.0.6)

This updates the maint/maint-68 branch to 68.2.0.6.
This will be done as a merge commit to keep the commit history.

build/azure-nuget.yml

@@ -3,10 +3,7 @@
 # no PR triggers
 pr: none
 
-# We need to set the version for the PackageES builds.
-name: $(BuildDefinitionName)-$(date:yyMM).$(date:dd)$(rev:rrr)
-
-# Code signing only runs on the MSCodeHub build pipeline.
+# Note: Code signing is only enabled for the manually triggered build pipeline in MSCodeHub.
 variables:
   codeSign: ${{ eq(variables['System.definitionId'], '1386') }}
   BuildConfiguration: 'Release'
@@ -245,13 +242,19 @@ stages:
   condition: and(succeeded(), eq(variables.codeSign, true))
   dependsOn: Build
   pool:
-    name: Package ES CodeHub Lab E
+    name: Azure Pipelines
+    vmImage: 'windows-2019'
   jobs:
   - job: CodeSignBits
-    timeoutInMinutes: 45
+    timeoutInMinutes: 60
     workspace:
       clean: all
-
+    variables:
+      signingPattern: |
+        icudt*.dll
+        icuuc*.dll
+        icuin*.dll
+
     # This matrix strategy lets us code-sign the architectures in parallel.
     strategy:
       matrix:
@@ -266,12 +269,6 @@ stages:
     - checkout: self
       lfs: true
       fetchDepth: 1
-    - task: PkgESSetupBuild@10
-      displayName: 'PkgES Setup Build'
-      inputs:
-        useDfs: false
-        productName: 'ms-icu-nuget'
-        disableOutputRedirect: true
 
     - task: PowerShell@2
       displayName: 'Set Version'
@@ -302,50 +299,76 @@ stages:
         scanType: 'Register'
         failOnAlert: true
 
-    - task: PkgESCodeSign@10
-      displayName: 'CodeSign MS-ICU DLLs'
-      env:
-        SYSTEM_ACCESSTOKEN: $(system.accesstoken)
-      inputs:
-        signConfigXml: 'build\nuget\SignConfig-ICU-Binaries-runtime.xml'
-        signTimeOut: 30
-        inPathRoot: '$(BUILD.ArtifactStagingDirectory)\bits\binaries-$(BuildPlatform)'
-        outPathRoot: '$(BUILD.ArtifactStagingDirectory)\bits\binaries-$(BuildPlatform)'
+    - task: EsrpCodeSigning@1
+      displayName: 'ESRP CodeSigning - CodeSign DLLs'
+      inputs:
+        ConnectedServiceName: 'ESRP Code Signing for MS-ICU'
+        FolderPath: '$(BUILD.ArtifactStagingDirectory)\bits\binaries-$(BuildPlatform)'
+        Pattern: $(signingPattern)
+        UseMinimatch: true
+        signConfigType: 'inlineSignParams'
+        inlineOperation: |
+          [
+            {
+              "keyCode": "CP-230012",
+              "operationSetCode": "SigntoolSign",
+              "parameters": [
+                {
+                  "parameterName": "OpusName",
+                  "parameterValue": "Microsoft"
+                },
+                {
+                  "parameterName": "OpusInfo",
+                  "parameterValue": "http://www.microsoft.com"
+                },
+                {
+                  "parameterName": "PageHash",
+                  "parameterValue": "/NPH"
+                },
+                {
+                  "parameterName": "FileDigest",
+                  "parameterValue": "/fd sha256"
+                },
+                {
+                  "parameterName": "TimeStamp",
+                  "parameterValue": "/tr \"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\" /td sha256"
+                }
+              ],
+              "toolName": "signtool.exe",
+            }
+          ]
+        SessionTimeout: '30'
+        MaxConcurrency: '20'
+        MaxRetryAttempts: '5'
 
     - task: PublishBuildArtifacts@1
       displayName: 'Publish: binaries signed'
       inputs:
         PathtoPublish: '$(Build.ArtifactStagingDirectory)\bits\binaries-$(BuildPlatform)'
         ArtifactName: 'win-$(BuildPlatform)'
 
-- stage: Nuget
+- stage: CreateNuget
   dependsOn:
   - Build
   - CodeSignBinaries
+  # This stage needs to depend on CodeSignBinaries for the Release-Nuget pipeline, but it will be skipped in the CI-Nuget pipeline.
   condition: and(in(dependencies.Build.result, 'Succeeded'), in(dependencies.CodeSignBinaries.result, 'Succeeded', 'Skipped'))
   pool:
-    name: Package ES CodeHub Lab E
+    name: Azure Pipelines
+    vmImage: 'windows-2019'
   variables:
     BuildPlatform: AnyCPU
 
   jobs:
-  - job: CreateNugetAndCodeSign
-    timeoutInMinutes: 45
+  - job: CreateNugetJob
+    timeoutInMinutes: 30
     workspace:
       clean: all
     steps:
     - checkout: self
       lfs: true
       fetchDepth: 1
 
-    - task: PkgESSetupBuild@10
-      displayName: 'PkgES Setup Build'
-      inputs:
-        useDfs: false
-        productName: 'ms-icu-nuget'
-        disableOutputRedirect: true
-      condition: and(succeeded(), eq(variables.codeSign, true))
-
     - task: PowerShell@2
       displayName: 'Set Version'
       inputs:
@@ -434,29 +457,103 @@ stages:
         Tree /F /A $(BUILD.ArtifactStagingDirectory)
       displayName: 'DIAG: dir'
 
+    - task: PublishBuildArtifacts@1
+      displayName: 'Publish: Nuget Packages'
+      inputs:
+        PathtoPublish: '$(BUILD.ArtifactStagingDirectory)\output\package'
+        ArtifactName: 'Nuget_Packages'
+
+- stage: CodeSignNuget
+  dependsOn:
+  - Build
+  - CodeSignBinaries
+  - CreateNuget
+  condition: and(eq(variables.codeSign, true), and(in(dependencies.CodeSignBinaries.result, 'Succeeded'), in(dependencies.CreateNuget.result, 'Succeeded')))
+  pool:
+    name: Azure Pipelines
+    vmImage: 'windows-2019'
+  variables:
+    BuildPlatform: AnyCPU
+
+  jobs:
+  - job: CodeSignNugetJob
+    timeoutInMinutes: 60
+    workspace:
+      clean: all
+    steps:
+    - checkout: self
+      lfs: true
+      fetchDepth: 1
+
+    - task: PowerShell@2
+      displayName: 'Set Version'
+      inputs:
+        targetType: filePath
+        filePath: './build/scripts/Set-ICUVersion.ps1'
+        arguments: '-icuVersionFile "$(BUILD.SOURCESDIRECTORY)\version.txt"'
+
+    - task: NuGetToolInstaller@1
+      displayName: 'Install NuGet'
+
+    - task: DownloadBuildArtifacts@0
+      displayName: 'Download Nuget'
+      inputs:
+        artifactName: 'Nuget_Packages'
+        downloadPath: '$(BUILD.ArtifactStagingDirectory)\nuget'
+
+    - powershell: |
+        Write-Host ""
+        Write-Host "$(BUILD.ArtifactStagingDirectory)"
+        Tree /F /A $(BUILD.ArtifactStagingDirectory)
+      displayName: 'DIAG: dir'
+    
     - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
       displayName: 'Component Governance Detection'
       inputs:
         alertWarningLevel: Medium
         scanType: 'Register'
         failOnAlert: true
 
-    - task: PkgESCodeSign@10
-      displayName: 'CodeSign MS-ICU Nuget'
-      env:
-          SYSTEM_ACCESSTOKEN: $(system.accesstoken)
-      inputs:
-        signConfigXml: 'build\nuget\SignConfig-ICU-Nuget.xml'
-        signTimeOut: 30
-        inPathRoot: '$(BUILD.ArtifactStagingDirectory)\output\package'
-        outPathRoot: '$(BUILD.ArtifactStagingDirectory)\output\package'
-      condition: and(succeeded(), eq(variables.codeSign, true))
-
+    - task: EsrpCodeSigning@1
+      inputs:
+        ConnectedServiceName: 'ESRP Code Signing for MS-ICU'
+        FolderPath: '$(BUILD.ArtifactStagingDirectory)\nuget\Nuget_Packages'
+        Pattern: |
+          *.nupkg
+        UseMinimatch: true
+        signConfigType: 'inlineSignParams'
+        inlineOperation: |
+          [
+            {
+              "KeyCode" : "CP-401405",
+              "OperationCode" : "NuGetSign",
+              "Parameters" : {},
+              "ToolName" : "sign",
+              "ToolVersion" : "1.0"
+            },
+            {
+                "KeyCode" : "CP-401405",
+                "OperationCode" : "NuGetVerify",
+                "Parameters" : {},
+                "ToolName" : "sign",
+                "ToolVersion" : "1.0"
+            }
+          ]
+        SessionTimeout: '30'
+        MaxConcurrency: '20'
+        MaxRetryAttempts: '5'
+
+    - powershell: |
+        Write-Host ""
+        Write-Host "$(BUILD.ArtifactStagingDirectory)"
+        Tree /F /A $(BUILD.ArtifactStagingDirectory)
+      displayName: 'DIAG: dir'
+    
     - task: PublishBuildArtifacts@1
       displayName: 'Publish: Nuget Packages'
       inputs:
-        PathtoPublish: '$(BUILD.ArtifactStagingDirectory)\output\package'
-        ArtifactName: 'Nuget_Packages'
+        PathtoPublish: '$(BUILD.ArtifactStagingDirectory)\nuget\Nuget_Packages'
+        ArtifactName: 'Nuget_Packages_Signed'
 
     # Publish the Windows Symbols to the public symbols server
     - task: PublishSymbols@2
@@ -473,15 +570,3 @@ stages:
       env:
         ArtifactServices_Symbol_AccountName: microsoftpublicsymbols
         ArtifactServices_Symbol_UseAAD: true
-
-    - task: PkgESSerializeForPostBuild@10
-      displayName: 'PkgES Post Build Serialization'
-      continueOnError: true
-      condition: and(succeeded(), eq(variables.codeSign, true))
-
-    - task: PkgESLateTasks@10
-      displayName: 'PkgES Finalize and Cleanup'
-      inputs:
-        enablePostBuild: false
-        enableLatest: false
-      condition: and(succeeded(), eq(variables.codeSign, true))

build/azure-pipelines.yml

@@ -396,3 +396,45 @@ jobs:
       env:
         CC: clang
         CXX: clang++
+
+#-------------------------------------------------------------------------
+
+- job: ICU4C_Clang_Valgrind_Ubuntu_1604
+  displayName: 'C: Linux Clang Valgrind (Ubuntu 16.04)'
+  timeoutInMinutes: 60
+  pool:
+    vmImage: 'Ubuntu 16.04'
+  steps:
+    - checkout: self
+      lfs: true
+      fetchDepth: 10
+    - script: |
+        set -ex
+        sudo apt -y update
+        sudo apt install -y valgrind
+      displayName: 'Install valgrind'
+      timeoutInMinutes: 5
+    - script: |
+        cd icu/icu4c/source && ./runConfigureICU --enable-debug Linux --disable-renaming && make -j2 tests
+      displayName: 'Build'
+      timeoutInMinutes: 10
+      env:
+        CC: clang
+        CXX: clang++
+    - script: |
+        cd icu/icu4c/source/test/intltest && LD_LIBRARY_PATH=../../lib:../../stubdata:../../tools/ctestfw:$LD_LIBRARY_PATH valgrind --tool=memcheck --error-exitcode=1 --leak-check=full --show-reachable=yes ./intltest
+      displayName: 'Valgrind intltest'
+      timeoutInMinutes: 45
+    - script: |
+        cd icu/icu4c/source/test/cintltst && LD_LIBRARY_PATH=../../lib:../../stubdata:../../tools/ctestfw:$LD_LIBRARY_PATH valgrind --tool=memcheck --error-exitcode=1 --leak-check=full --show-reachable=yes ./cintltst
+      displayName: 'Valgrind cintltst'
+      timeoutInMinutes: 15
+    - script: |
+        cd icu/icu4c/source/test/iotest && LD_LIBRARY_PATH=../../lib:../../stubdata:../../tools/ctestfw:$LD_LIBRARY_PATH valgrind --tool=memcheck --error-exitcode=1 --leak-check=full --show-reachable=yes ./iotest
+      displayName: 'Valgrind iotest'
+      timeoutInMinutes: 5
+    - script: |
+        cd icu/icu4c/source/tools/icuinfo && LD_LIBRARY_PATH=../../lib:../../stubdata:../../tools/ctestfw:$LD_LIBRARY_PATH valgrind --tool=memcheck --error-exitcode=1 --leak-check=full --show-reachable=yes ./icuinfo
+      displayName: 'Valgrind icuinfo'
+      timeoutInMinutes: 5
+#-------------------------------------------------------------------------

build/scripts/Create-Nuget-Runtime.ps1

@@ -108,9 +108,6 @@ foreach ($rid in $runtimeIdentifiers)
         if (Test-Path "$dllInput\bin" -PathType Container) {
             $dllInput = "$dllInput\bin"
         }
-        if ($codesign -eq 'true') {
-            $dllInput = "$dllInput\signed"
-        }
         $dllOutput = "$stagingLocation\runtimes\$rid\native"
         Copy-Item "$dllInput\*.dll" -Destination $dllOutput -Recurse
     }