Aspire cli: Add AOT builds for Linux, and macOS (#10275)

radical · eerhardt · web-flow · commit da81496b0571 · 2025-07-11T02:32:11.000Z
Add AOT builds for Linux, and macOS

## What?

This PR adds AOT builds for Linux, and macOS on the internal builds. On macOS the binaries are appropriately signed, and notarized making them usable after downloading.

## How?

This is done by having separate OS-specific jobs just to build the AOTed aspire cli. And these upload the archives for use by a "joining" Windows job which builds windows binaries, and publishes all the archives. Checksum (`sha512`) files are also generated for the archives which can be used to verify the archive when downloading.

This is the current supported matrix:

| Runtime Identifier | AOTed |
|-------------------|-------------|
| `win-x64` | ✅ |
| `win-arm64` | ✅ |
| `win-x86` | ❌ |
| `linux-x64` | ✅ |
| `linux-arm64` | ❌ |
| `linux-musl-x64` | ❌ |
| `osx-x64` | ✅ |
| `osx-arm64` | ✅ |

- `win-x86` - Native AOT is not supported for this
- `linux-arm64`, `linux-musl-x64` - will be added in a follow up PR

For the non-aot cases a self-contained executable is generated.

## Tests

To catch missing archives due to any reason on the CI build

--
* Addresses review feedback from @ eerhardt
* Addresses review feedback from @ joperezr

Co-authored-by: Eric Erhardt &lt;eric.erhardt@microsoft.com&gt;
diff --git a/docs/contributing.md b/docs/contributing.md
@@ -31,6 +31,14 @@ Or, if you are using Visual Studio:
 
 Make sure you [build the repo](#build-the-repo) from command line at least once. Then use `./start-code.sh` (macOS and Linux) or `.\start-code.cmd` to start VS Code.
 
+## Native build
+
+The default build includes native builds for `Aspire.Cli` which produces Native AOT binaries for some platforms. These projects are in `eng/clipack/Aspire.Cli.*`.
+
+By default it builds the cli native project for the current Runtime Identifier. A specific RIDs can be specified too by setting `$(TargetRids)` to a colon separated list like `/p:TargetRids=osx-x64:osx-arm64`.
+
+Native build can be disabled with `/p:SkipNativeBuild=true`. And to only the native bits use `/p:SkipManagedBuild=true`.
+
 ## View Dashboard
 
 When you start the sample app in Visual Studio, it will automatically open your browser to show the dashboard.
diff --git a/eng/Build.props b/eng/Build.props
@@ -1,9 +1,17 @@
-<Project>
-  <ItemGroup Condition="'$(DotNetBuildFromSource)' != 'true' and '$(DotNetBuild)' != 'true'">
+<Project TreatAsLocalProperty="TargetRids">
+  <PropertyGroup>
+    <BuildRid>$([System.Runtime.InteropServices.RuntimeInformation]::RuntimeIdentifier)</BuildRid>
+
+    <!-- Use a colon separate list of RIDs here, like osx-x64:osx-arm64 .
+         It is helpful to allow building the non-aot cli builds on a single CI job -->
+    <TargetRids Condition="'$(TargetRids)' == ''">$(BuildRid)</TargetRids>
+  </PropertyGroup>
+
+  <ItemGroup Condition="'$(SkipManagedBuild)' != 'true'">
     <ProjectToBuild Include="$(RepoRoot)src\**\*.csproj" Exclude="$(RepoRoot)src\Aspire.ProjectTemplates\templates\**\*.csproj" />
     <ProjectToBuild Include="$(RepoRoot)eng\dcppack\**\*.csproj" />
     <ProjectToBuild Include="$(RepoRoot)eng\dashboardpack\**\*.csproj" />
-    <ProjectToBuild Include="$(RepoRoot)eng\clipack\**\*.csproj" />
+
     <ProjectToBuild Include="$(RepoRoot)playground\**\*.csproj" />
 
     <!-- `$(SkipTestProjects)` allows skipping test projects from being
@@ -12,6 +20,20 @@
     <ProjectToBuild Include="$(RepoRoot)tests\**\*.csproj" Condition="'$(SkipTestProjects)' != 'true'" />
   </ItemGroup>
 
+  <!-- Native build only -->
+  <ItemGroup Condition="'$(SkipNativeBuild)' != 'true'">
+    <!-- Add Aspire.Cli project here for native-only builds so it gets picked
+         up Restore, because Aspire.Cli.$(RID).csproj uses MSBuild task to build
+         instead of a ProjectReference -->
+    <ProjectToBuild Condition="'$(SkipManagedBuild)' == 'true'" Include="$(RepoRoot)src\Aspire.Cli\Aspire.Cli.csproj" />
+
+    <!-- Skip any unknown target rids.
+         TODO: Map unknown rids to the available native projects -->
+    <_TargetRidItem Include="$(TargetRids.Split(':'))" />
+    <_NativeProjectToBuild Include="@(_TargetRidItem -> '$(RepoRoot)eng\clipack\Aspire.Cli.%(Identity).csproj')" />
+    <ProjectToBuild Include="@(_NativeProjectToBuild->Exists())" />
+  </ItemGroup>
+
   <!-- When building from source, we want to use the live repo contents as opposed to cloning the repo. -->
   <PropertyGroup Condition="'$(ArcadeBuildFromSource)' == 'true' or '$(DotNetBuildRepo)' == 'true'">
     <CopySrcInsteadOfClone>true</CopySrcInsteadOfClone>
diff --git a/eng/Publishing.props b/eng/Publishing.props
@@ -23,10 +23,28 @@
     <_InstallersToPublish Include="$(ArtifactsDir)**\*.wixpack.zip" Condition="'$(PostBuildSign)' == 'true'" />
     <_InstallerManifestFilesToPublish Include="$(ArtifactsDir)VSSetup\$(Configuration)\Insertion\**\*.zip" />
     <_DashboardFilesToPublish Include="$(DashboardPublishedArtifactsOutputDir)\**\*.zip" />
-    <_CliFilesToPublish Include="$(ArtifactsShippingPackagesDir)\aspire-cli-*" />
   </ItemGroup>
 
   <Target Name="_PublishBlobItems">
+    <!-- Validate list of aspire-cli packages on disk vs expected ones.
+         And do this first to fail early -->
+    <ItemGroup>
+      <_ArchiveFiles Include="$(ArtifactsPackagesDir)\**\aspire-cli-*.zip" />
+      <_ArchiveFiles Include="$(ArtifactsPackagesDir)\**\aspire-cli-*.tar.gz" />
+
+      <_CliPackProjects Include="$(RepoRoot)eng\clipack\Aspire.Cli.*.csproj" />
+      <_ExpectedRids Include="@(_CliPackProjects->'%(Filename)'->Replace('Aspire.Cli.', ''))" />
+
+      <!-- Extract the rid from filenames like aspire-cli-linux-x64-9.0-dev.tar.gz and aspire-cli-linux-arm64-9.4.0-preview.1.25358.11.zip -->
+      <_FoundRidInCliArchiveFile Include="$([System.Text.RegularExpressions.Regex]::Match(%(_ArchiveFiles.FileName), 'aspire-cli-(.*)-\d+.*').Groups[1].Value)" />
+
+      <_MissingRids Include="@(_ExpectedRids)" Exclude="@(_FoundRidInCliArchiveFile)" />
+      <_UnexpectedRids Include="@(_FoundRidInCliArchiveFile)" Exclude="@(_ExpectedRids)" />
+    </ItemGroup>
+
+    <Warning Condition="@(_UnexpectedRids->Count()) > 0" Text="Found unexpected CLI archives for @(_UnexpectedRids, ',') . These are all the cli archives found - @(_ArchiveFiles, ', ')" />
+    <Error Condition="@(_MissingRids->Count()) > 0" Text="Missing CLI archive(s) for runtime identifiers: @(_MissingRids, ', '). These are all the cli archives found - @(_ArchiveFiles, ', ')" />
+
     <!--
       For blob items for the Dashboard, we want to make sure that the version we get back is not stable, even when the repo is producing stable versions.
       This is because we want to be able to re-spin the build if necessary without hitting issues of blob items clashing with each other. For this reason,
@@ -39,6 +57,17 @@
       <Output TaskParameter="TargetOutputs" PropertyName="_PackageVersion" />
     </MSBuild>
 
+    <!-- Generate checksums for aspire-cli packages -->
+    <ItemGroup>
+      <_CliFileToPublish Include="@(_ArchiveFiles)" />
+      <GenerateChecksumItems Include="@(_CliFileToPublish)" DestinationPath="%(FullPath).sha512" />
+    </ItemGroup>
+
+    <GenerateChecksums Items="@(GenerateChecksumItems)" />
+    <ItemGroup>
+      <_CliFileToPublish Include="@(GenerateChecksumItems->'%(DestinationPath)')" />
+    </ItemGroup>
+
     <ItemGroup>
       <ItemsToPushToBlobFeed Include="@(_InstallersToPublish)">
         <IsShipping>true</IsShipping>
@@ -55,7 +84,7 @@
         <PublishFlatContainer>true</PublishFlatContainer>
         <RelativeBlobPath>$(_UploadPathRoot)/$(_PackageVersion)/%(Filename)%(Extension)</RelativeBlobPath>
       </ItemsToPushToBlobFeed>
-      <ItemsToPushToBlobFeed Include="@(_CliFilesToPublish)">
+      <ItemsToPushToBlobFeed Include="@(_CliFileToPublish)">
         <IsShipping>false</IsShipping>
         <PublishFlatContainer>true</PublishFlatContainer>
         <RelativeBlobPath>$(_UploadPathRoot)/$(_PackageVersion)/%(Filename)%(Extension)</RelativeBlobPath>
diff --git a/eng/Signing.props b/eng/Signing.props
@@ -34,6 +34,10 @@
     <FileSignInfo Include="OpenTelemetry.Exporter.OpenTelemetryProtocol.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="OpenTelemetry.Extensions.Hosting.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="Semver.dll" CertificateName="3PartySHA2" />
+
+    <FileSignInfo Condition="$([System.OperatingSystem]::IsWindows())" Include="aspire.exe" CertificateName="MicrosoftDotNet500" />
+    <FileSignInfo Condition="$([System.OperatingSystem]::IsLinux())" Include="aspire" CertificateName="MicrosoftDotNet500" />
+    <FileSignInfo Condition="$([System.OperatingSystem]::IsMacOS())" Include="aspire" CertificateName="MacDeveloperHardenWithNotarization" />
   </ItemGroup>
 
   <PropertyGroup>
@@ -45,6 +49,8 @@
     <ItemsToSign Include="$(ArtifactsPackagesDir)**\*.wixpack.zip" Condition="'$(PostBuildSign)' != 'true'" />
     <ItemsToSignPostBuild Include="$(VisualStudioSetupInsertionPath)\**\*.msi" Condition="'$(PostBuildSign)' == 'true'" />
     <ItemsToSign Include="$(VisualStudioSetupInsertionPath)\**\*.zip" Condition="'$(PostBuildSign)' != 'true'" />
+    <ItemsToSign Include="$(ArtifactsPackagesDir)**\aspire-cli-*.zip" />
+    <ItemsToSign Include="$(ArtifactsPackagesDir)**\aspire-cli-*.tar.gz" />
     <ItemsToSignPostBuild Include="$(VisualStudioSetupInsertionPath)\**\*.zip" Condition="'$(PostBuildSign)' == 'true'" />
   </ItemGroup>
 </Project>
diff --git a/eng/clipack/Common.projitems b/eng/clipack/Common.projitems
@@ -3,10 +3,11 @@
     <TargetFramework>$(DefaultTargetFramework)</TargetFramework>
 
     <ArchiveName>aspire-cli-$(CliRuntime)</ArchiveName>
-    <ArchiveFormat Condition="$(CliRuntime.StartsWith('linux-'))">tar.gz</ArchiveFormat>
-    <ArchiveFormat Condition="!$(CliRuntime.StartsWith('linux-'))">zip</ArchiveFormat>
+    <ArchiveFormat Condition="'$(ArchiveFormat)' == '' and $(CliRuntime.StartsWith('win-'))">zip</ArchiveFormat>
+    <ArchiveFormat Condition="'$(ArchiveFormat)' == ''">tar.gz</ArchiveFormat>
 
-    <!-- Publish native AOT if running on the target platfrom -->
+    <!-- PublishNativeAot is explicitly set to false in the projects for cases where we don't want to AOT at all.
+         For the rest, publish native AOT if running on the target platfrom -->
     <PublishNativeAot Condition="'$(PublishNativeAot)' == '' and $([System.OperatingSystem]::IsWindows()) and $(CliRuntime.StartsWith('win-'))">true</PublishNativeAot>
     <PublishNativeAot Condition="'$(PublishNativeAot)' == '' and $([System.OperatingSystem]::IsLinux()) and $(CliRuntime.StartsWith('linux-'))">true</PublishNativeAot>
     <PublishNativeAot Condition="'$(PublishNativeAot)' == '' and $([System.OperatingSystem]::IsMacOS()) and $(CliRuntime.StartsWith('osx-'))">true</PublishNativeAot>
@@ -48,6 +49,10 @@
         Properties="@(AdditionalProperties)"
         RemoveProperties="OutputPath;TargetFramework" />
 
+    <PropertyGroup>
+      <_OutputBinaryPath>$(OutputPath)/aspire</_OutputBinaryPath>
+    </PropertyGroup>
+
     <!-- TODO: avoid generating the file instead of manually deleting it here -->
     <Delete Files="$(OutputPath)\aspire.xml" Condition="Exists('$(OutputPath)\aspire.xml')" />
 
diff --git a/eng/pipelines/azure-pipelines.yml b/eng/pipelines/azure-pipelines.yml
@@ -112,11 +112,43 @@ extends:
 
     stages:
 
+    - stage: build_sign_native
+      displayName: Build+Sign native packages
+
+      jobs:
+      - template: /eng/pipelines/templates/build_sign_native.yml@self
+        parameters:
+          agentOs: macos
+          targetRidsForSameOS:
+            - osx-arm64
+            - osx-x64
+          codeSign: true
+          teamName: $(_TeamName)
+          extraBuildArgs: >-
+            /p:Configuration=$(_BuildConfig)
+            $(_SignArgs)
+            $(_OfficialBuildIdArgs)
+
+      - template: /eng/pipelines/templates/build_sign_native.yml@self
+        parameters:
+          agentOs: linux
+          targetRidsForSameOS:
+            - linux-x64
+          # no need to sign ELF binaries on linux
+          codeSign: false
+          teamName: $(_TeamName)
+          extraBuildArgs: >-
+            /p:Configuration=$(_BuildConfig)
+            $(_SignArgs)
+            $(_OfficialBuildIdArgs)
+
     # ----------------------------------------------------------------
     # This stage performs build, test, packaging
     # ----------------------------------------------------------------
     - stage: build
       displayName: Build
+      dependsOn:
+      - build_sign_native
       jobs:
       - template: /eng/common/templates-official/jobs/jobs.yml@self
         parameters:
@@ -160,6 +192,21 @@ extends:
                 clean: true
 
             steps:
+              - task: DownloadPipelineArtifact@2
+                displayName: 🟣Download All Native Archives
+                inputs:
+                  itemPattern: |
+                    **/aspire-cli-*.zip
+                    **/aspire-cli-*.tar.gz
+                  targetPath: '$(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)'
+
+              - task: PowerShell@2
+                displayName: 🟣List artifacts packages contents
+                inputs:
+                  targetType: 'inline'
+                  script: |
+                    Get-ChildItem -Path "$(Build.SourcesDirectory)\artifacts\packages" -File -Recurse | Select-Object FullName, @{Name="Size(MB)";Expression={[math]::Round($_.Length/1MB,2)}} | Format-Table -AutoSize
+
               - template: /eng/pipelines/templates/BuildAndTest.yml
                 parameters:
                   dotnetScript: $(Build.SourcesDirectory)/dotnet.cmd
@@ -169,40 +216,14 @@ extends:
                   repoLogPath: $(Build.Arcade.LogsPath)
                   repoTestResultsPath: $(Build.Arcade.TestResultsPath)
                   isWindows: true
-
-          - ${{ if eq(variables._RunAsPublic, True) }}:
-            - job: Linux
-              ${{ if or(startswith(variables['Build.SourceBranch'], 'refs/heads/release/'), startswith(variables['Build.SourceBranch'], 'refs/heads/internal/release/'), eq(variables['Build.Reason'], 'Manual')) }}:
-                # If the build is getting signed, then the timeout should be increased.
-                timeoutInMinutes: 120
-              ${{ else }}:
-                # timeout accounts for wait times for helix agents up to 30mins
-                timeoutInMinutes: 90
-
-              pool:
-                name: NetCore1ESPool-Internal
-                image: 1es-mariner-2
-                os: linux
-
-              variables:
-                - name: _buildScript
-                  value: $(Build.SourcesDirectory)/build.sh --ci
-
-              preSteps:
-                - checkout: self
-                  fetchDepth: 1
-                  clean: true
-
-              steps:
-                - template: /eng/pipelines/templates/BuildAndTest.yml
-                  parameters:
-                    dotnetScript: $(Build.SourcesDirectory)/dotnet.sh
-                    buildScript: $(_buildScript)
-                    buildConfig: $(_BuildConfig)
-                    repoArtifactsPath: $(Build.Arcade.ArtifactsPath)
-                    repoLogPath: $(Build.Arcade.LogsPath)
-                    repoTestResultsPath: $(Build.Arcade.TestResultsPath)
-                    isWindows: false
+                  targetRids:
+                    # aot
+                    - win-x64
+                    - win-arm64
+                    # non-aot - single file builds
+                    - win-x86
+                    - linux-arm64
+                    - linux-musl-x64
 
       - ${{ if and(notin(variables['Build.Reason'], 'PullRequest'), eq(variables['Build.SourceBranch'], 'refs/heads/main')) }}:
         - template: /eng/common/templates-official/job/onelocbuild.yml@self
diff --git a/eng/pipelines/templates/BuildAndTest.yml b/eng/pipelines/templates/BuildAndTest.yml
@@ -16,6 +16,9 @@ parameters:
     type: string
   - name: dotnetScript
     type: string
+  - name: targetRids
+    type: object
+    default: ''
   - name: runHelixTests
     type: boolean
     default: false
@@ -38,14 +41,15 @@ steps:
               /bl:${{ parameters.repoLogPath }}/build.binlog
               $(_OfficialBuildIdArgs)
               $(_InternalBuildArgs)
+              /p:TargetRids=${{ join(':', parameters.targetRids) }}
               /p:SkipTestProjects=true
-      displayName: Build
+      displayName: 🟣Build
 
     - script: ${{ parameters.dotnetScript }}
               build
               tests/workloads.proj
               /p:SkipPackageCheckForTemplatesTesting=true
-      displayName: Prepare sdks for templates testing
+      displayName: 🟣Prepare sdks for templates testing
 
     - script: ${{ parameters.buildScript }}
               -build
@@ -63,7 +67,7 @@ steps:
         DEV_TEMP: $(Build.SourcesDirectory)\..
         DOTNET_ROOT: $(Build.SourcesDirectory)\.dotnet
         TEST_LOG_PATH: $(Build.SourcesDirectory)\artifacts\log\$(_BuildConfig)\Aspire.Templates.Tests
-      displayName: Run Template tests
+      displayName: 🟣Run Template tests
 
   # Public pipeline - helix tests
   - ${{ if eq(parameters.runAsPublic, 'true') }}:
diff --git a/eng/pipelines/templates/build_sign_native.yml b/eng/pipelines/templates/build_sign_native.yml
@@ -0,0 +1,81 @@
+parameters:
+  # values: windows/mac/linux
+  agentOs: 'windows'
+  targetRidsForSameOS:
+    - linux-x64
+  extraBuildArgs: ''
+  codeSign: false
+  teamName: ''
+
+jobs:
+
+- ${{ each targetRid in parameters.targetRidsForSameOS }}:
+  - template: /eng/common/templates-official/jobs/jobs.yml@self
+    parameters:
+      enableMicrobuild: ${{ eq(parameters.codeSign, true) }}
+      enableMicrobuildForMacAndLinux: ${{ and(eq(parameters.codeSign, true), ne(parameters.agentOs, 'windows')) }}
+      enableTelemetry: true
+      # Publish build logs
+      enablePublishBuildArtifacts: true
+
+      jobs:
+      - job: BuildNative_${{ replace(targetRid, '-', '_') }}
+        displayName: ${{ replace(targetRid, '-', '_') }}
+        timeoutInMinutes: 40
+
+        variables:
+        - TeamName: ${{ parameters.teamName }}
+        - ${{ if eq(parameters.codeSign, true) }}:
+          - _buildArgs: '--sign'
+        - ${{ else }}:
+          - _buildArgs: ''
+
+        - ${{ if eq(parameters.agentOs, 'windows') }}:
+          - scriptName: build.cmd
+        - ${{ else }}:
+          - scriptName: build.sh
+
+        pool:
+          ${{ if eq(parameters.agentOs, 'windows') }}:
+            name: NetCore1ESPool-Internal
+            image: windows.vs2022preview.amd64
+            os: windows
+          ${{ if eq(parameters.agentOs, 'linux') }}:
+            name: NetCore1ESPool-Internal
+            image: 1es-mariner-2
+            os: linux
+          ${{ if eq(parameters.agentOs, 'macos') }}:
+            name: Azure Pipelines
+            vmImage: macOS-latest-internal
+            os: macOS
+
+        preSteps:
+          - checkout: self
+            fetchDepth: 1
+            clean: true
+
+          # Installing Microbuild plugin fails due to https://github.com/dotnet/arcade/issues/15946#issuecomment-3045780552
+          # because of the preview sdk. To fix that `restore` from `global.json` so the above step
+          # does not have to install anything.
+          - script: $(Build.SourcesDirectory)/$(scriptName) -restore /p:Configuration=$(_BuildConfig)
+            displayName: 🟣Restore
+
+        steps:
+          - script: >-
+              $(Build.SourcesDirectory)/$(scriptName)
+              --ci
+              --build
+              --restore
+              /p:SkipManagedBuild=true
+              /p:TargetRids=${{ targetRid }}
+              $(_buildArgs)
+              ${{ parameters.extraBuildArgs }}
+              /bl:$(Build.Arcade.LogsPath)Build.binlog
+            displayName: 🟣Build native packages
+
+          - task: 1ES.PublishBuildArtifacts@1
+            displayName: 🟣Publish Artifacts
+            condition: always()
+            inputs:
+              PathtoPublish: '$(Build.Arcade.ArtifactsPath)packages/'
+              ArtifactName: native_archives_${{ replace(targetRid, '-', '_') }}
