From 8a350dd262295963ad9fcfbcfe7b1d15bd234c86 Mon Sep 17 00:00:00 2001
From: Ryan Newington <ryan@lithiumblue.com>
Date: Wed, 1 Feb 2023 09:18:16 +1100
Subject: [PATCH] Update azure-pipelines.yml for Azure Pipelines

---
 azure-pipelines.yml | 78 +++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 76 insertions(+), 2 deletions(-)

diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index 52d1214..ba114b2 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -26,10 +26,84 @@ steps:
     projects: 'src/Lithnet.CredentialProvider/Lithnet.CredentialProvider.csproj'
     zipAfterPublish: false
 
+- task: DotNetCoreCLI@2
+  inputs:
+    command: 'custom'
+    custom: 'tool'
+    arguments: 'update --global NuGetKeyVaultSignTool'
+  displayName: Install NugetKeyVaultSignTool
+
+- task: DotNetCoreCLI@2
+  inputs:
+    command: 'custom'
+    custom: 'tool'
+    arguments: 'update --global azuresigntool'
+  displayName: Install AzureSignTool
+
+- task: PowerShell@2
+  displayName: 'Sign files with AzureSignTool'
+  inputs:
+    targetType: 'inline'
+    script: |
+      $files = @()
+      $files += (Get-ChildItem -Path "$(Build.ArtifactStagingDirectory)\Lithnet*.dll").FullName
+
+      write-host "Signing $($files.Length) files:"
+      write-output $files
+
+      $cmdargs = @(
+        "sign",
+        "-d", "Lithnet Windows Credential Provider",
+        "-kvu", "$(akv.url)",
+        "-kvi", "$(akv.applicationID)",
+        "-kvs", "$(akv.secret)",
+        "-kvt", "$(akv.tenantId)",
+        "-kvc", "$(akv.certificateName)",
+        "-tr", "http://timestamp.digicert.com",
+        "-td", "sha256"
+      )
+
+      $cmdargs += $files
+      
+      & AzureSignTool $cmdargs
+
+    failOnStderr: true
+    showWarnings: true
+
+- task: PowerShell@2
+  displayName: 'Sign Nuget package'
+  inputs:
+    targetType: 'inline'
+    script: |
+      $files = @()
+      $files += (Get-ChildItem -Path "$(Build.ArtifactStagingDirectory)\Lithnet*.dll").FullName
+
+      write-host "Signing $($files.Length) files:"
+      write-output $files
+
+      $cmdargs = @(
+        "sign", "$(Build.ArtifactStagingDirectory)\*.nupkg)"
+        "-fd", "sha256",
+        "-kvu", "$(akv.url)",
+        "-kvi", "$(akv.applicationID)",
+        "-kvs", "$(akv.secret)",
+        "-kvt", "$(akv.tenantId)",
+        "-kvc", "$(akv.certificateName)",
+        "-tr", "http://timestamp.digicert.com",
+        "-td", "sha256"
+      )
+
+      $cmdargs += $files
+      
+      & NuGetKeyVaultSignTool $cmdargs
+
+    failOnStderr: true
+    showWarnings: true
+
 - task: DotNetCoreCLI@2
   displayName: dotnet push
   inputs:
     command: 'push'
     packagesToPush: '$(Build.ArtifactStagingDirectory)/*.nupkg'
-    nuGetFeedType: 'internal'
-    publishVstsFeed: '91a552bc-359d-4f28-bdbd-f36f71cfdf81'
+    nuGetFeedType: 'external'
+    publishFeedCredentials: 'WindowsCredentialProviderNuget'