Skip to content

Use locked VSCE installs and verify VSIX signatures #14706

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Sean McManus (sean-mcmanus) wants to merge 2 commits into
base: main
Choose a base branch
from
+26 −8
Draft

Use locked VSCE installs and verify VSIX signatures #14706

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0ff4963
Harden extension packaging verification
sean-mcmanus Aug 24, 2026
5600360
Merge branch 'main' into seanmcm/devbox2-wsl/agent61/harden-extension…
sean-mcmanus Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions Build/package/jobs_package_vsix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,9 +48,9 @@ jobs:
script: |
export SRC_DIR=$(echo $BUILD_SOURCESDIRECTORY | sed 's|\\|/|g')
cd "$SRC_DIR/${{ parameters.srcDir }}"
npm install
npm ci --include=dev --include=optional
if [ $? -ne 0 ]; then
echo "npm install failed, sleeping for 30s before retrying..."
echo "npm ci failed, sleeping for 30s before retrying..."
sleep 30
exit 1
fi
Expand All @@ -59,10 +59,6 @@ jobs:
- script: mkdir $(Build.ArtifactStagingDirectory)\vsix
displayName: Create Staging Directory

- script: npm install --no-save --ignore-scripts=false --include=optional --force @vscode/vsce@3.9.2
displayName: Install vsce
workingDirectory: $(Build.SourcesDirectory)\${{ parameters.srcDir }}

- script: npm rebuild @vscode/vsce-sign --ignore-scripts=false
displayName: Rebuild vsce-sign binary
workingDirectory: $(Build.SourcesDirectory)\${{ parameters.srcDir }}
Expand Down Expand Up @@ -93,3 +89,7 @@ jobs:
inputs:
solution: $(Build.SourcesDirectory)\Build\signing\SignVsix.proj
msbuildArguments: /p:SignType=${{ parameters.signType }}

- script: npx vsce verify-signature -i $(Build.ArtifactStagingDirectory)\vsix\${{ parameters.vsixName }}.vsix -m $(Build.ArtifactStagingDirectory)\vsix\${{ parameters.vsixName }}.manifest -s $(Build.ArtifactStagingDirectory)\vsix\${{ parameters.vsixName }}.signature.p7s
displayName: Verify VSIX signature
workingDirectory: $(Build.SourcesDirectory)\${{ parameters.srcDir }}
1 change: 1 addition & 0 deletions Build/publish/cpptools_extension_pack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,4 +40,5 @@ extends:
- template: /Build/publish/jobs_publish_vsix.yml@self
parameters:
vsixName: cpptools-extension-pack
srcDir: ExtensionPack

1 change: 1 addition & 0 deletions Build/publish/cpptools_themes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,4 +40,5 @@ extends:
- template: /Build/publish/jobs_publish_vsix.yml@self
parameters:
vsixName: cpptools-themes
srcDir: Themes

20 changes: 18 additions & 2 deletions Build/publish/jobs_publish_vsix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@ parameters:
- name: vsixName
type: string
default: ''
- name: srcDir
type: string
default: ''

jobs:
- job: Publish
Expand All @@ -16,11 +19,16 @@ jobs:
targetPath: $(Build.StagingDirectory)\vsix

steps:
- checkout: self

- task: NodeTool@0
displayName: Use Node 22.x
inputs:
versionSpec: 22.x

- script: IF EXIST %SYSTEMDRIVE%\Users\%USERNAME%\.npmrc del %SYSTEMDRIVE%\Users\%USERNAME%\.npmrc
displayName: Delete .npmrc if it exists

- task: AzureCLI@2
displayName: Generate AAD_TOKEN
inputs:
Expand All @@ -31,16 +39,24 @@ jobs:
$aadToken = az account get-access-token --query accessToken --resource $(AzureGuid) -o tsv
Write-Host "##vso[task.setvariable variable=AAD_TOKEN;issecret=true]$aadToken"

- script: npm install --no-save --ignore-scripts=false --include=optional --force @vscode/vsce@3.9.2
displayName: Install vsce
- script: npm ci --include=dev --include=optional
displayName: Install dependencies
workingDirectory: $(Build.SourcesDirectory)\${{ parameters.srcDir }}

- script: npm rebuild @vscode/vsce-sign --ignore-scripts=false
displayName: Rebuild vsce-sign binary
workingDirectory: $(Build.SourcesDirectory)\${{ parameters.srcDir }}

- script: if not exist node_modules\@vscode\vsce-sign\bin\vsce-sign.exe (echo Missing vsce-sign.exe && exit 1)
displayName: Verify vsce-sign binary exists
workingDirectory: $(Build.SourcesDirectory)\${{ parameters.srcDir }}

- script: npx vsce verify-signature -i $(Build.StagingDirectory)\vsix\${{ parameters.vsixName }}.vsix -m $(Build.StagingDirectory)\vsix\${{ parameters.vsixName }}.manifest -s $(Build.StagingDirectory)\vsix\${{ parameters.vsixName }}.signature.p7s
displayName: Verify VSIX signature
workingDirectory: $(Build.SourcesDirectory)\${{ parameters.srcDir }}

- script: npx vsce publish --skip-duplicate -i $(Build.StagingDirectory)\vsix\${{ parameters.vsixName }}.vsix --manifestPath $(Build.StagingDirectory)\vsix\${{ parameters.vsixName }}.manifest --signaturePath $(Build.StagingDirectory)\vsix\${{ parameters.vsixName }}.signature.p7s
displayName: Publish to Marketplace
workingDirectory: $(Build.SourcesDirectory)\${{ parameters.srcDir }}
env:
VSCE_PAT: $(AAD_TOKEN)
Loading