如何在 Azure Pipelines 上签署 UWP 应用程序？

Question

关于为 UWP 设置 Azure Pipelines 的文档没有说明如何对包进行签名。它确实说证书文件应该位于存储库中，但没有解释如何使用该证书对包进行签名。

所以我的问题是如何在 Azure Pipelines 上签署 UWP 包？我应该创建一个 powershell 脚本来运行吗SignTool？

Answer 1

基本上，遵循这些任务就可以解决问题。

1. 创建证书
2. 下载证书
3. 安装证书
4. 建造
5. 复制
6. 公共文物
7. 如果有的话，分发到应用程序中心（可选）

这是 YAML 文件的完整内容，我已经对其进行了测试并在我的管道中运行。

# Universal Windows Platform

# Build a Universal Windows Platform project using Visual Studio.
# Add steps that test and distribute an app, save build artifacts, and more:
# https://aka.ms/yaml

# A pipeline with no CI trigger
trigger: none
pr: none
name: $(MajorVersion).$(MinorVersion).$(date:yy)$(DayOfYear)$(rev:.r)
pool:
  vmImage: 'windows-latest'

variables:
- group: uwp-pipeline
- name: solution
  value: '**/*.sln'
- name: buildPlatform
  value: 'x86|x64'
- name: buildConfiguration
  value: 'Release'
- name: appxPackageDir
  value: '$(build.artifactStagingDirectory)\AppxPackages\\'
- name: MajorVersion
  value: 1
- name: MinorVersion
  value: 0
- name: customBuildNumber
  value: '$(MajorVersion).$(MinorVersion).$(date:yy)$(DayOfYear)$(rev:.r)'

steps:
- task: NuGetToolInstaller@1

- task: NuGetCommand@2
  inputs:
    restoreSolution: '$(solution)'

- task: DownloadSecureFile@1
  name: mySecureFile
  displayName: 'Download CA certificate'
  inputs:
    secureFile: '$(signingCert.secureFilePath)'

- task: PowerShell@2
  inputs:
    targetType: 'inline'
    script: |
      Write-Host "Start adding the PFX file to the certificate store."

      $pfxpath = '$(mySecureFile.secureFilePath)'
      $password = '$(signingCert.password)'      

      Add-Type -AssemblyName System.Security
      $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
      $cert.Import($pfxpath, $password, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]"PersistKeySet")
      $store = new-object system.security.cryptography.X509Certificates.X509Store -argumentlist "MY", CurrentUser
      $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]"ReadWrite")
      $store.Add($cert)
      $store.Close()

- task: VersionAPPX@2
  inputs:
    Path: '$(Build.SourcesDirectory)'
    VersionNumber: '$(Build.BuildNumber)'
    InjectVersion: False
    VersionRegex: '(0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])(\.(0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])){3}'
    OutputVersion: 'OutputedVersion'

- task: VSBuild@1
  inputs:
    platform: 'x86'
    solution: '$(solution)'
    configuration: '$(buildConfiguration)'
    msbuildArgs: '/p:AppxBundlePlatforms="$(buildPlatform)" 
                  /p:AppxPackageDir="$(appxPackageDir)" 
                  /p:AppxBundle=Always 
                  /p:UapAppxPackageBuildMode=StoreUpload 
                  /p:AppxPackageSigningEnabled=true
                  /p:PackageCertificateThumbprint="$(signingCert.thumbprint)" 
                  /p:PackageCertificateKeyFile="$(mySecureFile.secureFilePath)"
                  /p:PackageCertificatePassword="$(signingCert.password)"'

- task: CopyFiles@2
  displayName: 'Copy Files to: $(build.artifactstagingdirectory)'
  inputs:
    SourceFolder: '$(system.defaultworkingdirectory)'
    Contents: '**\bin\$(BuildConfiguration)\**'
    TargetFolder: '$(build.artifactstagingdirectory)'

- task: PublishBuildArtifacts@1
  displayName: 'Publish Artifact: drop'
  inputs:
    PathtoPublish: '$(build.artifactstagingdirectory)'

- task: ArchiveFiles@2
  inputs:
    rootFolderOrFile: '$(build.artifactstagingdirectory)'
    includeRootFolder: true
    archiveType: 'zip'
    archiveFile: '$(Build.ArtifactStagingDirectory)/$(Build.BuildId).zip'
    replaceExistingArchive: true

- task: AppCenterDistribute@3
  inputs:
    serverEndpoint: 'release to app center'
    appSlug: '$(appSlug)'
    buildVersion: '$(Build.BuildNumber)'
    appFile: '$(Build.ArtifactStagingDirectory)/$(Build.BuildId).zip'
    releaseNotesOption: 'input'
    releaseNotesInput: 'New release!'
    destinationType: 'groups'
    distributionGroupId: '$(distributionGroupId)'

我已经写了一篇详细的文章，请随时阅读：UWP 应用程序登录、发布、分发、使用 Azure DevOps Pipeline 进行部署