Use vsce to verify vsix signatures (#1489)

eng/pipelines/templates/jobs/vsix/pack-and-sign-vsix.yml

@@ -40,92 +40,15 @@ jobs:
       Path: $(Build.ArtifactStagingDirectory)
       Pattern: '**/*.signature.p7s'
 
+  - task: Powershell@2
+    displayName: "Verify VSIX Signing"
+    inputs:
+      pwsh: true
+      filePath: $(Build.SourcesDirectory)/eng/scripts/Verify-VsixSignatures.ps1
+      arguments: >
+        -ArtifactsPath '$(Build.ArtifactStagingDirectory)'
+
   - template: /eng/common/pipelines/templates/steps/publish-1es-artifact.yml
     parameters:
       ArtifactPath: $(Build.ArtifactStagingDirectory)
       ArtifactName: packages_vsix_signed
-
-- job: VerifyVSIXSigning
-  displayName: "Verify VSIX Signing"
-  dependsOn: SignAndPackVSIX
-  pool:
-    name: $(WINDOWSPOOL) # Signing verification must happen on windows
-    image: $(WINDOWSVMIMAGE)
-    os: windows
-  variables:
-  - template: /eng/pipelines/templates/variables/image.yml
-  - template: /eng/pipelines/templates/variables/globals.yml
-  steps:
-  - checkout: none
-  - download: current
-    artifact: packages_vsix_signed
-    displayName: "Download signed MCP server VSIX files"
-  - pwsh: |
-      Write-Host "Verifying VSIX signing by parsing CodeSignSummary markdown files..."
-
-      $root = "$(Pipeline.Workspace)/packages_vsix_signed"
-      $summaries = Get-ChildItem -Path $root -Recurse -Filter 'CodeSignSummary-*.md'
-
-      if (-not $summaries) {
-        Write-Error "No CodeSignSummary-*.md files found under $root. Cannot verify signing."
-
-        exit 1
-      }
-
-      $allPassed = $true
-
-      foreach ($file in $summaries) {
-        Write-Host "Checking summary: $($file.FullName)"
-
-        $lines = Get-Content -Path $file.FullName
-
-        # Consider only table lines that start with '|'
-        $tableLines = $lines | Where-Object { $_ -match '^\s*\|' }
-
-        if (-not $tableLines) { continue }
-
-        # Header is the first non-separator table line
-        $headerLine = $tableLines | Where-Object { $_ -notmatch '^\s*\|[-\s]+\|\s*$' } | Select-Object -First 1
-
-        if (-not $headerLine) { continue }
-
-        $headers = ($headerLine -split '\|') | ForEach-Object { $_.Trim() } | Where-Object { $_ -ne '' }
-        $statusIdx = [Array]::IndexOf($headers, 'Status')
-        $componentIdx = [Array]::IndexOf($headers, 'Component')
-        $fileNameIdx = [Array]::IndexOf($headers, 'FileName')
-
-        if ($statusIdx -lt 0 -or $componentIdx -lt 0) {
-          Write-Host "Skipping file with unexpected header format: $($file.FullName)"
-
-          continue
-        }
-
-        # Data rows: all table lines except header and separator
-        $dataRows = $tableLines | Where-Object { $_ -notmatch '^\s*\|[-\s]+\|\s*$' -and $_ -ne $headerLine }
-
-        foreach ($row in $dataRows) {
-          $cols = ($row -split '\|') | ForEach-Object { $_.Trim() } | Where-Object { $_ -ne '' }
-
-          if ($cols.Count -lt $headers.Count) { continue }
-
-          $component = $cols[$componentIdx]
-          $status = $cols[$statusIdx]
-          $fname = if ($fileNameIdx -ge 0 -and $fileNameIdx -lt $cols.Count) { $cols[$fileNameIdx] } else { '' }
-
-          if ($component -eq 'Sign' -and $status -ne 'Pass') {
-            Write-Host "Signing failed: Status=$status Component=$component File=$fname (in $($file.Name))"
-
-            $allPassed = $false
-          }
-        }
-      }
-
-      if (-not $allPassed) {
-        Write-Error "One or more 'Sign' entries did not report 'Pass' in CodeSignSummary."
-
-        exit 1
-      }
-      else {
-        Write-Host "All 'Sign' entries report 'Pass'."
-      }
-    displayName: "Verify VSIX Signing"

eng/scripts/Verify-VsixSignatures.ps1

@@ -0,0 +1,51 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)]
+    [string] $ArtifactsPath
+)
+
+$ErrorActionPreference = "Stop"
+. "$PSScriptRoot/../common/scripts/common.ps1"
+
+$RepoRoot = $RepoRoot.Path.Replace('\', '/')
+$exitCode = 0
+
+if (!(Test-Path $ArtifactsPath)) {
+    LogError "Artifacts path $ArtifactsPath does not exist."
+    exit 1
+}
+
+Write-Host "Verifying VSIX signing using the vsce npm module..."
+
+$vsixToolsDirectory = "$RepoRoot/eng/vsix-tools"
+
+$originalLocation = Get-Location
+Set-Location $vsixToolsDirectory
+try {
+    Write-Host "Installing npm packages"
+    Invoke-LoggedCommand 'npm ci --omit=optional'
+
+    $vsixPaths = Get-ChildItem -Path $ArtifactsPath -Filter *.vsix -Recurse | Select-Object -ExpandProperty FullName
+    foreach ($vsixPath in $vsixPaths) {
+        Write-Host "Verifying VSIX signature for $vsixPath"
+
+        $manifestPath = [System.IO.Path]::ChangeExtension($vsixPath, ".manifest")
+        $p7sPath = [System.IO.Path]::ChangeExtension($vsixPath, ".signature.p7s")
+        
+        Invoke-LoggedCommand "npx --no @vscode/vsce verify-signature --packagePath '$vsixPath' --manifestPath '$manifestPath' --signaturePath '$p7sPath'" -DoNotExitOnFailedExitCode | Tee-Object -Variable output
+        # $output is an array of output lines; check if any line indicates success
+        $succeeded = $output -contains 'Signature verification result: Success'
+
+        if ($LASTEXITCODE -ne 0 -or !$succeeded) {
+            LogError "VSIX signature verification failed for $vsixPath"
+            $exitCode = $LASTEXITCODE
+        } else {
+            Write-Host "VSIX signature verification succeeded for $vsixPath"
+        }
+    }
+}
+finally {
+    Set-Location $originalLocation
+}
+
+exit $exitCode

eng/vsix-tools/package.json

@@ -0,0 +1,5 @@
+{
+    "devDependencies": {
+        "@vscode/vsce": "~3"
+    }
+}