Skip to content

Commit 577147e

Browse files
pjcollinsgrendello
pjcollins
and
grendello
authored
[ci] Migrate to the 1ES template (#135)
* [ci] Migrate to the 1ES template Context: https://aka.ms/1espt The build pipeline has been updated to extend the 1ES pipeline template, which will keep the pipeline up to date with the latest compliance and security requirements. Compliance tasks and scans will run automatically as part of artifact upload steps, which are now referred to as "outputs". Template outputs have replaced all instances of the `PublishPipelineArtifact` task. * Use self template reference * Test 1es-sign-artifacts yaml branch * Set compiler/linker flags * Test removal of xz submodule * Update flags * Update flags * Test template pivot * Add scan suppressions * Use main templates branch * Import more suppressions * Bump to xz 5.4.6 * Update .gdn * Use github.com/tukaani-project/xz * Update suppressions path * Update conditions and cl/link flags * Update cl/link flags * Update flags * Try a different way to pass args to submodules * Disable a warning we can't do much about * Update gdnsuppress: * Update build_windows, gdnsuppress * Update gdnsuppress * Update build images * Install latest 7.0 sdk for test lanes * Use latest 7.0 sdk --------- Co-authored-by: Marek Habersack <grendel@twistedcode.net>
1 parent 7abbbf4 commit 577147e

File tree

7 files changed

+568
-307
lines changed

7 files changed

+568
-307
lines changed

‎.gdn/.gdnsettings

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"files": { },
3+
"folders": { },
4+
"overwriteLogs": true,
5+
"telemetryFlushTimeout": 10,
6+
"variables": { }
7+
}

‎.gdn/.gdnsuppress

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
{
2+
"hydrated": false,
3+
"properties": {
4+
"helpUri": "https://eng.ms/docs/microsoft-security/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/microsoft-guardian/general/suppressions",
5+
"hydrationStatus": "This file does not contain identifying data. It is safe to check into your repo. To hydrate this file with identifying data, run `guardian hydrate --help` and follow the guidance."
6+
},
7+
"version": "1.0.0",
8+
"suppressionSets": {
9+
"default": {
10+
"name": "default",
11+
"createdDate": "2024-02-13 23:43:02Z",
12+
"lastUpdatedDate": "2024-02-15 20:19:17Z"
13+
}
14+
},
15+
"results": {
16+
"106ebf57147abe7cd400e99216306929d7fa316d10e3d30dc218c74b9bd7795e": {
17+
"signature": "106ebf57147abe7cd400e99216306929d7fa316d10e3d30dc218c74b9bd7795e",
18+
"alternativeSignatures": [
19+
"f7e9384d5be4600dadfdbeceff23d1468f682e9d6998ce6d54f9379bbe1e535a"
20+
],
21+
"memberOf": [
22+
"default"
23+
],
24+
"justification": "Reference to an external vcpkg .ps1 file.",
25+
"createdDate": "2024-02-13 23:43:02Z"
26+
},
27+
"cb309d5a322c6d545bc8304bc6bc21953f5d953dcc2ef54f9f66e9d2a41cd5af": {
28+
"signature": "cb309d5a322c6d545bc8304bc6bc21953f5d953dcc2ef54f9f66e9d2a41cd5af",
29+
"alternativeSignatures": [
30+
"ff4304de20e5d510170ae65c7fe48212f33fcfa5c0a3d8a45eee175c04101153"
31+
],
32+
"memberOf": [
33+
"default"
34+
],
35+
"justification": "Suppressing BA2007 triggered by the addition of -wd4996 required to build external bzip2 dependency with /sdl flag.",
36+
"createdDate": "2024-02-15 19:39:18Z"
37+
},
38+
"47d725f1446c35b0410c9774133d814fd3200f89bc0857bd81df4ac73ffcb90e": {
39+
"signature": "47d725f1446c35b0410c9774133d814fd3200f89bc0857bd81df4ac73ffcb90e",
40+
"alternativeSignatures": [
41+
"4394b51c48c696764500c59f00680af353a9a744a82906347a413359f9cfd452"
42+
],
43+
"memberOf": [
44+
"default"
45+
],
46+
"justification": "Suppressing BA2007 triggered by the addition of -wd4996 required to build external bzip2 dependency with /sdl flag.",
47+
"createdDate": "2024-02-15 19:39:18Z"
48+
},
49+
"5f3b04604481e5a1f6a33d01a244db1fc6b2fd02b3b078cf7dfe6cc04e076276": {
50+
"signature": "5f3b04604481e5a1f6a33d01a244db1fc6b2fd02b3b078cf7dfe6cc04e076276",
51+
"alternativeSignatures": [
52+
"ba25311c4c43e2873bee240e8c4c68682272eb5bc58c97339791be287e8c96a2"
53+
],
54+
"memberOf": [
55+
"default"
56+
],
57+
"justification": "Suppressing BA2007 triggered by the addition of -wd4996 required to build external bzip2 dependency with /sdl flag.",
58+
"createdDate": "2024-02-15 19:39:18Z"
59+
},
60+
"39b5eea31b6779ed59ae6854d2c15e17ceb93e3067a87138748fc8f02d734625": {
61+
"signature": "39b5eea31b6779ed59ae6854d2c15e17ceb93e3067a87138748fc8f02d734625",
62+
"alternativeSignatures": [
63+
"59a87f4e078c6ab72fe39adc6139c86d18cddbcd40221114c4a683666bcaadf4"
64+
],
65+
"memberOf": [
66+
"default"
67+
],
68+
"justification": "Unable to resolve BA2007 for external lzsbuild/deps/win32 file 'example.exe'.",
69+
"createdDate": "2024-02-15 20:19:17Z"
70+
},
71+
"4b61adeeb4b0237fbe2352c290a84dc686067351e66810c27192c6a00d9ecbc7": {
72+
"signature": "4b61adeeb4b0237fbe2352c290a84dc686067351e66810c27192c6a00d9ecbc7",
73+
"alternativeSignatures": [
74+
"cf7a67d41e8f7415d089d7007de01417f73c41b842480682686b6b326042ef12"
75+
],
76+
"memberOf": [
77+
"default"
78+
],
79+
"justification": "Unable to resolve BA2007 for external lzsbuild/deps/win32 file 'minigzip.exe'.",
80+
"createdDate": "2024-02-15 20:19:17Z"
81+
},
82+
"14d9bf44b59382ea3316fb01edba5c49251fac10cfa0b0e1c5e4053ea2daf7a7": {
83+
"signature": "14d9bf44b59382ea3316fb01edba5c49251fac10cfa0b0e1c5e4053ea2daf7a7",
84+
"alternativeSignatures": [
85+
"34132c90cef21d1559d791ca3374054b3498293e9af99ebaf0a97ebdf2117359"
86+
],
87+
"memberOf": [
88+
"default"
89+
],
90+
"justification": "Unable to resolve BA2007 for external lzsbuild/deps/win32 file 'zlib.dll'.",
91+
"createdDate": "2024-02-15 20:19:17Z"
92+
},
93+
"32c95027d0378e43655c6ae1d1d94d175b5ae0a80f7a09ab5ef877c82c8613cf": {
94+
"signature": "32c95027d0378e43655c6ae1d1d94d175b5ae0a80f7a09ab5ef877c82c8613cf",
95+
"alternativeSignatures": [
96+
"3b8cc35f6043d60895fc2b58aa0e340f26168e7276e77d32a2290ce8f52e87a7"
97+
],
98+
"memberOf": [
99+
"default"
100+
],
101+
"justification": "Unable to resolve BA2007 for external lzsbuild/deps/win64 file 'example.exe'.",
102+
"createdDate": "2024-02-15 20:19:17Z"
103+
},
104+
"714c09b687b522c384ad4f562ad7fc22b4a3cc486f4e111da2ef9f9f7049bbd9": {
105+
"signature": "714c09b687b522c384ad4f562ad7fc22b4a3cc486f4e111da2ef9f9f7049bbd9",
106+
"alternativeSignatures": [
107+
"c319ab28b12c0772a32e11a1b8adfbf5d31d940c26f65d547508fbbe067479c7"
108+
],
109+
"memberOf": [
110+
"default"
111+
],
112+
"justification": "Unable to resolve BA2007 for external lzsbuild/deps/win64 file 'minigzip.exe'.",
113+
"createdDate": "2024-02-15 20:19:17Z"
114+
},
115+
"7d646d44fc117d94d024aeb65acccd6a6c78ea2f7a67a9925ec0720ca14fc16d": {
116+
"signature": "7d646d44fc117d94d024aeb65acccd6a6c78ea2f7a67a9925ec0720ca14fc16d",
117+
"alternativeSignatures": [
118+
"b6cd355613757ef82eba700719a1957211688374b0841271340c10a65ca913ba"
119+
],
120+
"memberOf": [
121+
"default"
122+
],
123+
"justification": "Unable to resolve BA2007 for external lzsbuild/deps/win64 file 'zlib.dll'.",
124+
"createdDate": "2024-02-15 20:19:17Z"
125+
},
126+
"075eeab70a88345e6e142f97544de5be84cb85c87ba36ec229a2a4df5d482337": {
127+
"signature": "075eeab70a88345e6e142f97544de5be84cb85c87ba36ec229a2a4df5d482337",
128+
"alternativeSignatures": [
129+
"4cc6ffe05f61e35bd7fa57a5a4b4f82d050e684f11e15ce6eade601aa86d2b11"
130+
],
131+
"memberOf": [
132+
"default"
133+
],
134+
"justification": "Unable to resolve BA2007 for external lzsbuild/deps/winarm64 file 'example.exe'.",
135+
"createdDate": "2024-02-15 20:19:17Z"
136+
},
137+
"f9e7e5e304a91532f7615d252ba18ea11e52ba6eb28cd78f872a480423351256": {
138+
"signature": "f9e7e5e304a91532f7615d252ba18ea11e52ba6eb28cd78f872a480423351256",
139+
"alternativeSignatures": [
140+
"13987557036db098921cee21a62d8dc557c4e4136a10220442388eb2f9f18607"
141+
],
142+
"memberOf": [
143+
"default"
144+
],
145+
"justification": "Unable to resolve BA2007 for external lzsbuild/deps/winarm64 file 'minigzip.exe'.",
146+
"createdDate": "2024-02-15 20:19:17Z"
147+
},
148+
"0ed7f92df9b8d3bf93cf6898af876e9e159b351ce0b2afeb6f153b453be5cdf9": {
149+
"signature": "0ed7f92df9b8d3bf93cf6898af876e9e159b351ce0b2afeb6f153b453be5cdf9",
150+
"alternativeSignatures": [
151+
"d2dc95e0c5edbdb8ddf1de2e9585c7d55cc1a529edc5c3319da8ed818dc72abf"
152+
],
153+
"memberOf": [
154+
"default"
155+
],
156+
"justification": "Unable to resolve BA2007 for external lzsbuild/deps/winarm64 file 'zlib.dll'.",
157+
"createdDate": "2024-02-15 20:19:17Z"
158+
}
159+
}
160+
}

‎.gdn/.gitignore

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
## Ignore Guardian internal files
2+
.r/
3+
rc/
4+
rs/
5+
i/
6+
p/
7+
c/
8+
o/
9+
10+
## Ignore Guardian Local settings
11+
LocalSettings.gdn.json

‎.gitmodules

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,11 @@
1414
branch = master
1515
[submodule "external/xz"]
1616
path = external/xz
17-
url = https://git.tukaani.org/xz.git
18-
branch = master
19-
17+
url = https://github.com/tukaani-project/xz
2018
[submodule "zlib"]
2119
path = external/zlib
2220
url = https://github.com/madler/zlib.git
2321
branch = master
2422
[submodule "external/zstd"]
2523
path = external/zstd
2624
url = https://github.com/facebook/zstd.git
27-
[submodule "https://git.tukaani.org/xz.git"]
28-
url = external/xz

‎CMakeLists.txt

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,21 @@ if(UNIX)
228228
LINKER:-z,relro
229229
LINKER:-z,noexecstack
230230
LINKER:--no-undefined
231-
)
231+
)
232+
else()
233+
set(COMMON_COMPILE_OPTIONS
234+
/Qspectre
235+
/guard:cf
236+
/sdl
237+
/wd4996
238+
)
239+
240+
set(LINKER_OPTIONS
241+
LINKER:/PROFILE
242+
LINKER:/DYNAMICBASE
243+
LINKER:/CETCOMPAT
244+
LINKER:/guard:cf
245+
)
232246
endif()
233247

234248
if(APPLE AND BUILD_LIBZIP)
@@ -576,7 +590,6 @@ else()
576590
target_link_options(
577591
${PROJECT_NAME}
578592
PRIVATE
579-
/PROFILE
580593
/wholearchive:$<TARGET_FILE:zip>
581594
)
582595
endif()

0 commit comments

Comments
 (0)