[release/v7.4.16] Fix *nix permissions and use certificate_logical_to_actual by adityapatwardhan · Pull Request #27452 · PowerShell/PowerShell

The tarball staging path used `Copy-Item`, which on *nix doesn't preserve
the source file mode, so `pwsh` ended up 644 in the `.tar.gz`. The Debian,
RPM, and macOS PKG paths explicitly `chmod` everything to 644 and then bump
`pwsh` back to 755, which silently demoted `createdump` (the .NET helper
that produces crash minidumps) along with it. Now we `chmod 755` both
executables in all package staging paths, guarded by `Test-Path` since
fxdependent builds don't bundle `createdump`.

Also added regression tests which check the permissions of `pwsh` inside
the Linux and macOS tarballs before we upload them.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… group

The `CP-…` key codes used for ESRP signing are now set from ADO via the
`certificate_logical_to_actual` variable group. The templates reference
the following variables instead of literal codes:

- `$(authenticode_cert_id)`
- `$(authenticode_test_cert_id)`
- `$(nuget_cert_id)`
- `$(apple_cert_id)`
- `$(pgp_linux_cert_id)`
- `$(pgp_release_cert_id)`

`nupkg.yml`, `mac-package-build.yml`, and `linux-package-build.yml` pick
up the new group import. `linux-package-build.yml` also now selects the
PGP signing profile based on whether `jobName` starts with `mariner`, so
`PowerShell-Packages-Stages.yml` no longer threads a `signingProfile`
parameter in for the two Mariner jobs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

It's been this way for a couple years which means we've been passing...something else?