Conversation
ghost
added
the
needs-area-label
There was a problem hiding this comment.
Pull Request Overview
This PR updates the MacOS code-signing pipeline configuration to use a PME identity in line with recent security requirements.
- Updates service connection and authentication configuration
- Switches from certificate-based authentication to MSI-based authentication
- Replaces existing client and tenant identifiers with PME-specific values
Comments suppressed due to low confidence (2)
eng/pipelines/common/macos-sign-with-entitlements.yml:32
- The removal of the 'AuthCertName' parameter appears to be a deliberate change for MSI-based authentication; please confirm that no parts of the pipeline depend on certificate-based authentication.
- AuthCertName: 'DotNetCore-ESRP-AuthCert'
eng/pipelines/common/macos-sign-with-entitlements.yml:34
- Ensure that switching to MSI authentication and updating related client IDs align with the PME requirements and that all dependent processes are adjusted accordingly.
+ UseMSIAuthentication: true
|
/ba-g continued OOMs from crypto tests - unrelated to PME portion that doesn't get exercised in CI. |
|
/backport to release/8.0-staging |
|
Started backporting to release/8.0-staging: https://github.com/dotnet/runtime/actions/runs/15057412876 |
|
/backport to release/8.0 |
|
/backport to release/9.0 |
|
Started backporting to release/8.0: https://github.com/dotnet/runtime/actions/runs/15057416852 |
|
Started backporting to release/9.0: https://github.com/dotnet/runtime/actions/runs/15057417574 |
Contributes to dotnet/arcade-services#4611
Updates the MacOS signing to use a PME identity in accordance with a corresponding TSG
dotnet-runtime-officialbuild: https://dev.azure.com/dnceng/internal/_build/results?buildId=2702879&view=resultsExample of the identity being used for publishing: https://dev.azure.com/dnceng/internal/_build/results?buildId=2702156&view=results