[release/v7.6.2] Fix *nix permissions and use `certificate_logical_to_actual` by daxian-dbw · Pull Request #27439 · PowerShell/PowerShell

We still need to apply the template signing so that Guardian tasks pass
and so that script files are signed. After doing what's essentially
Windows signing, we sign and harden the binaries for macOS. Then we do
the same for the PKG installer, and finally notarize it. The ESRP
signing service requires a zip of files for Apple signing at all stages.
Now that we can use it via the OneBranch signing task we no longer need
the service connection or variable group that was trying to set it up.
Notarization requires the BundleId from Get-MacOSPackageIdentifierInfo.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… group

The `CP-…` key codes used for ESRP signing are now set from ADO via the
`certificate_logical_to_actual` variable group. The templates reference
the following variables instead of literal codes:

- `$(authenticode_cert_id)`
- `$(authenticode_test_cert_id)`
- `$(nuget_cert_id)`
- `$(apple_cert_id)`
- `$(pgp_linux_cert_id)`
- `$(pgp_release_cert_id)`

`nupkg.yml`, `mac-package-build.yml`, and `linux-package-build.yml` pick
up the new group import. `linux-package-build.yml` also now selects the
PGP signing profile based on whether `jobName` starts with `mariner`, so
`PowerShell-Packages-Stages.yml` no longer threads a `signingProfile`
parameter in for the two Mariner jobs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The tarball staging path used `Copy-Item`, which on *nix doesn't preserve
the source file mode, so `pwsh` ended up 644 in the `.tar.gz`. The Debian,
RPM, and macOS PKG paths explicitly `chmod` everything to 644 and then bump
`pwsh` back to 755, which silently demoted `createdump` (the .NET helper
that produces crash minidumps) along with it. Now we `chmod 755` both
executables in all package staging paths, guarded by `Test-Path` since
fxdependent builds don't bundle `createdump`.

Also added regression tests which check the permissions of `pwsh` inside
the Linux and macOS tarballs before we upload them.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>