Signs packages prior to publishing

[#63]

.gitignore

@@ -274,3 +274,6 @@ dummy-service-backend.db
 
 # OS X Finder state
 \.DS_Store
+
+# local tools
+/tools/

azure-pipelines.yml

@@ -44,7 +44,7 @@ jobs:
     vmImage: 'Windows-2019'
   steps:
   - task: 'DotNetCoreCLI@2'
-    displayName: 'Pack'
+    displayName: 'Build'
     inputs:
       command: 'pack'
       packagesToPack: '$(Solution).sln'
@@ -56,8 +56,17 @@ jobs:
     inputs:
       command: 'test'
       projects: '$(Solution).sln'
+  - task: PowerShell@2
+    displayName: 'Sign'
+    inputs:
+      filePath: build/sign-packages.ps1
+    env:
+      SignClientUser: $(SignClientUser)
+      SignClientSecret: $(SignClientSecret)
+      ArtifactDirectory: $(Build.ArtifactStagingDirectory)
+    condition: and(succeeded(), not(eq(variables['build.reason'], 'PullRequest')), not(eq(variables['SignClientSecret'], '')), not(eq(variables['SignClientUser'], '')))
   - task: 'PublishBuildArtifacts@1'
-    displayName: 'Publish Artifacts'
+    displayName: 'Publish'
     inputs:
       PathtoPublish: '$(Build.ArtifactStagingDirectory)'
       ArtifactName: 'Packages'

build/appsettings.json

@@ -0,0 +1,13 @@
+{
+  "SignClient": {
+    "AzureAd": {
+      "AADInstance": "https://login.microsoftonline.com/",
+      "ClientId": "c248d68a-ba6f-4aa9-8a68-71fe872063f8",
+      "TenantId": "16076fdc-fcc1-4a15-b1ca-32c9a255900e"
+    },
+    "Service": {
+      "Url": "https://codesign.dotnetfoundation.org/",
+      "ResourceId": "https://SignService/3c30251f-36f3-490b-a955-520addb85001"
+    }
+  }
+}

build/sign-packages.ps1

@@ -0,0 +1,22 @@
+#!/usr/bin/env pwsh
+
+$baseDir = "$PSScriptRoot/.."
+$toolDir = "$baseDir/tools"
+$appSettings = "$PSScriptRoot/appsettings.json"
+if ($null -eq $ArtifactDirectory) {
+    $ArtifactDirectory = "."
+}
+
+if ([string]::IsNullOrEmpty($Env:SignClientSecret)) {
+    Write-Host "SignClientSecret not set, exiting"
+    Exit 1
+}
+
+New-Item -ItemType Directory -Force -Path $toolDir
+dotnet tool install --tool-path $toolDir signclient
+
+$nupkgs = Get-ChildItem $ArtifactDirectory/Steeltoe*.*nupkg -recurse | Select-Object -ExpandProperty FullName
+foreach ($nupkg in $nupkgs) {
+    Write-Host "signing $nupkg"
+    & $toolDir/SignClient 'sign' -c $appSettings -i $nupkg -r $Env:SignClientUser -s $Env:SignClientSecret -n 'Steeltoe' -d 'Steeltoe' -u 'https://github.com/SteeltoeOSS'
+}