From 22243bc27133f8c8df6d3a8f12345a80221e0cb0 Mon Sep 17 00:00:00 2001
From: "Steve Lee (POWERSHELL HE/HIM) (from Dev Box)"
 <slee@ntdev.microsoft.com>
Date: Fri, 17 Jul 2026 12:54:49 -0700
Subject: [PATCH 01/10] Fix PMC publishing script and mapping

---
 .pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 | 4 ++--
 tools/packages.microsoft.com/mapping.json              | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
index f4036c2d8..b34ae6d14 100644
--- a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
+++ b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
@@ -16,7 +16,7 @@
     - PMC_METADATA: URL to the pmcMetadata.json file
 #>
 
-$env:NO_COLOR = 1
+$PSStyle.OutputRendering = 'PlainText'
 
 function Get-MappedRepositoryIds {
     param(
@@ -277,7 +277,7 @@ try {
     $skipPublish = $metadataContent.SkipPublish
 
     $channel = if ($releaseVersion.Contains('-')) { 'preview' } else { 'stable' }
-    $packageName = $channel -eq 'preview' ? 'dsc-preview' : 'dsc'
+    $packageName = 'dsc'
 
     Write-Verbose "Release version: $releaseVersion, Channel: $channel" -Verbose
 
diff --git a/tools/packages.microsoft.com/mapping.json b/tools/packages.microsoft.com/mapping.json
index bd2d77421..e11cb72fc 100644
--- a/tools/packages.microsoft.com/mapping.json
+++ b/tools/packages.microsoft.com/mapping.json
@@ -5,28 +5,28 @@
       "distribution": [
         "stable"
       ],
-      "PackageFormat": "PACKAGE_NAME_RELEASE_VERSION-1_x86_64.rpm"
+      "PackageFormat": "PACKAGE_NAME_RELEASE_VERSION-1.x86_64.rpm"
     },
     {
       "url": "microsoft-rhel9.0-prod",
       "distribution": [
         "stable"
       ],
-      "PackageFormat": "PACKAGE_NAME_RELEASE_VERSION-1_x86_64.rpm"
+      "PackageFormat": "PACKAGE_NAME_RELEASE_VERSION-1.x86_64.rpm"
     },
     {
       "url": "microsoft-rhel8.0-prod",
       "distribution": [
         "stable"
       ],
-      "PackageFormat": "PACKAGE_NAME_RELEASE_VERSION-1_aarch64.rpm"
+      "PackageFormat": "PACKAGE_NAME_RELEASE_VERSION-1.aarch64.rpm"
     },
     {
       "url": "microsoft-rhel9.0-prod",
       "distribution": [
         "stable"
       ],
-      "PackageFormat": "PACKAGE_NAME_RELEASE_VERSION-1_aarch64.rpm"
+      "PackageFormat": "PACKAGE_NAME_RELEASE_VERSION-1.aarch64.rpm"
     },
     {
       "url": "microsoft-debian-bullseye-prod",

From ac8dff1efe043a17bd6fb45909ecd032bd2c9cd6 Mon Sep 17 00:00:00 2001
From: "Steve Lee (POWERSHELL HE/HIM) (from Dev Box)"
 <slee@ntdev.microsoft.com>
Date: Fri, 17 Jul 2026 13:00:58 -0700
Subject: [PATCH 02/10] put back NO_COLOR

---
 .pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
index b34ae6d14..29b7b4fc1 100644
--- a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
+++ b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
@@ -16,6 +16,7 @@
     - PMC_METADATA: URL to the pmcMetadata.json file
 #>
 
+$env:NO_COLOR = 1
 $PSStyle.OutputRendering = 'PlainText'
 
 function Get-MappedRepositoryIds {

From b062beb24bb2d49671fc8fc79f855919a23955d5 Mon Sep 17 00:00:00 2001
From: Steve Lee <slee@microsoft.com>
Date: Mon, 20 Jul 2026 11:37:39 -0700
Subject: [PATCH 03/10] Fix rpm pkg name

---
 .pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 | 4 ----
 tools/packages.microsoft.com/mapping.json              | 8 ++++----
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
index 29b7b4fc1..1c28a915b 100644
--- a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
+++ b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
@@ -105,10 +105,6 @@ function Get-PackageObjects {
 
         $pkgName = $pkg.PackageFormat.Replace('PACKAGE_NAME', $PackageName).Replace('RELEASE_VERSION', $ReleaseVersion)
 
-        if ($pkgName.EndsWith('.rpm')) {
-            $pkgName = $pkgName.Replace($ReleaseVersion, $ReleaseVersion.Replace('-', '_'))
-        }
-
         $packagePath = "$script:dscPackagesFolder/$pkgName"
         if (-not (Test-Path -Path $packagePath)) {
             throw "Package path $packagePath does not exist"
diff --git a/tools/packages.microsoft.com/mapping.json b/tools/packages.microsoft.com/mapping.json
index e11cb72fc..2a657062f 100644
--- a/tools/packages.microsoft.com/mapping.json
+++ b/tools/packages.microsoft.com/mapping.json
@@ -5,28 +5,28 @@
       "distribution": [
         "stable"
       ],
-      "PackageFormat": "PACKAGE_NAME_RELEASE_VERSION-1.x86_64.rpm"
+      "PackageFormat": "PACKAGE_NAME-RELEASE_VERSION-1.x86_64.rpm"
     },
     {
       "url": "microsoft-rhel9.0-prod",
       "distribution": [
         "stable"
       ],
-      "PackageFormat": "PACKAGE_NAME_RELEASE_VERSION-1.x86_64.rpm"
+      "PackageFormat": "PACKAGE_NAME-RELEASE_VERSION-1.x86_64.rpm"
     },
     {
       "url": "microsoft-rhel8.0-prod",
       "distribution": [
         "stable"
       ],
-      "PackageFormat": "PACKAGE_NAME_RELEASE_VERSION-1.aarch64.rpm"
+      "PackageFormat": "PACKAGE_NAME-RELEASE_VERSION-1.aarch64.rpm"
     },
     {
       "url": "microsoft-rhel9.0-prod",
       "distribution": [
         "stable"
       ],
-      "PackageFormat": "PACKAGE_NAME_RELEASE_VERSION-1.aarch64.rpm"
+      "PackageFormat": "PACKAGE_NAME-RELEASE_VERSION-1.aarch64.rpm"
     },
     {
       "url": "microsoft-debian-bullseye-prod",

From a5c78141261ed6696322b3887aaeef7a75a9d76d Mon Sep 17 00:00:00 2001
From: Steve Lee <slee@microsoft.com>
Date: Mon, 20 Jul 2026 11:59:07 -0700
Subject: [PATCH 04/10] fix RPM version string

---
 .pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
index 1c28a915b..54b544da3 100644
--- a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
+++ b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
@@ -103,6 +103,11 @@ function Get-PackageObjects {
         $pkgRepo = $pkg.RepoId | Select-Object -First 1
         $pkgDistribution = $pkg.Distribution | Select-Object -First 1
 
+        if ($pkgName.EndsWith('.rpm')) {
+            # RPM requires no dashes in the version string, so replace any dashes with tildes
+            $ReleaseVersion = $ReleaseVersion.Replace('-', '~')
+        }
+
         $pkgName = $pkg.PackageFormat.Replace('PACKAGE_NAME', $PackageName).Replace('RELEASE_VERSION', $ReleaseVersion)
 
         $packagePath = "$script:dscPackagesFolder/$pkgName"

From 7841530bb8d4acfad6a0bbf861cab0ce4364e93a Mon Sep 17 00:00:00 2001
From: Steve Lee <slee@microsoft.com>
Date: Mon, 20 Jul 2026 14:27:07 -0700
Subject: [PATCH 05/10] Fix detection of rpm

---
 .pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
index 54b544da3..80c41fafe 100644
--- a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
+++ b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
@@ -103,7 +103,7 @@ function Get-PackageObjects {
         $pkgRepo = $pkg.RepoId | Select-Object -First 1
         $pkgDistribution = $pkg.Distribution | Select-Object -First 1
 
-        if ($pkgName.EndsWith('.rpm')) {
+        if ($pkg.PackageFormat.EndsWith('.rpm')) {
             # RPM requires no dashes in the version string, so replace any dashes with tildes
             $ReleaseVersion = $ReleaseVersion.Replace('-', '~')
         }
@@ -299,7 +299,7 @@ try {
     Write-Verbose "SkipPublish: $skipPublish" -Verbose
     Publish-PackageToPMC -PackageObject $packageObjects -ConfigPath $configPath -SkipPublish $skipPublish
 } catch {
-    Write-Error -ErrorAction Stop $_.Exception.Message
+    Write-Error -ErrorAction Stop (Get-Error | Out-String)
     return 1
 }
 

From 1ef48c64e9709d6b32d0911f11e3a58ed3b8348b Mon Sep 17 00:00:00 2001
From: Steve Lee <slee@microsoft.com>
Date: Mon, 20 Jul 2026 14:45:25 -0700
Subject: [PATCH 06/10] fix to not mutate original $packageVersion

---
 .pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
index 80c41fafe..677c86670 100644
--- a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
+++ b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
@@ -103,12 +103,13 @@ function Get-PackageObjects {
         $pkgRepo = $pkg.RepoId | Select-Object -First 1
         $pkgDistribution = $pkg.Distribution | Select-Object -First 1
 
+        $pkgReleaseVersion = $ReleaseVersion
         if ($pkg.PackageFormat.EndsWith('.rpm')) {
             # RPM requires no dashes in the version string, so replace any dashes with tildes
-            $ReleaseVersion = $ReleaseVersion.Replace('-', '~')
+            $pkgReleaseVersion = $pkgReleaseVersion.Replace('-', '~')
         }
 
-        $pkgName = $pkg.PackageFormat.Replace('PACKAGE_NAME', $PackageName).Replace('RELEASE_VERSION', $ReleaseVersion)
+        $pkgName = $pkg.PackageFormat.Replace('PACKAGE_NAME', $PackageName).Replace('RELEASE_VERSION', $pkgReleaseVersion)
 
         $packagePath = "$script:dscPackagesFolder/$pkgName"
         if (-not (Test-Path -Path $packagePath)) {

From 907106d5518d923c220d77c8d3e4a59f02b377a6 Mon Sep 17 00:00:00 2001
From: Steve Lee <slee@microsoft.com>
Date: Tue, 21 Jul 2026 16:07:27 -0700
Subject: [PATCH 07/10] add more test tracing

---
 .../ServiceGroupRoot/Shell/Run/Run.ps1        | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
index 677c86670..2c562bf33 100644
--- a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
+++ b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
@@ -17,6 +17,7 @@
 #>
 
 $env:NO_COLOR = 1
+$env:TERM = 'dumb'
 $PSStyle.OutputRendering = 'PlainText'
 
 function Get-MappedRepositoryIds {
@@ -152,6 +153,9 @@ function Publish-PackageToPMC {
         $packageType = $extension -replace '^\.'
 
         $packageListJson = pmc --config $ConfigPath package $packageType list --file $packagePath
+        if ($LASTEXITCODE -ne 0) {
+            throw "pmc package $packageType list failed with exit code $LASTEXITCODE; --config '$ConfigPath' package $packageType list --file '$packagePath'"
+        }
         $list = $packageListJson | ConvertFrom-Json
 
         $packageId = @()
@@ -163,6 +167,9 @@ function Publish-PackageToPMC {
             $uploadResult = $null
             try {
                 $uploadResult = pmc --config $ConfigPath package upload $packagePath --type $packageType
+                if ($LASTEXITCODE -ne 0) {
+                    throw "pmc package upload failed with exit code $LASTEXITCODE; --config '$ConfigPath' package upload '$packagePath' --type '$packageType'"
+                }
             } catch {
                 $errorMessages.Add("Uploading package $($finalPackage.PackageName) to $pkgRepo failed. See errors above for details.")
                 continue
@@ -181,8 +188,14 @@ function Publish-PackageToPMC {
             try {
                 if ($packageType -eq 'rpm') {
                     $rawUpdateResponse = pmc --config $ConfigPath repo package update $pkgRepo --add-packages $packageId
+                    if ($LASTEXITCODE -ne 0) {
+                        throw "pmc repo package update failed with exit code $LASTEXITCODE; --config '$ConfigPath' repo package update '$pkgRepo' --add-packages '$packageId'"
+                    }
                 } elseif ($packageType -eq 'deb') {
                     $rawUpdateResponse = pmc --config $ConfigPath repo package update $pkgRepo $distribution --add-packages $packageId
+                    if ($LASTEXITCODE -ne 0) {
+                        throw "pmc repo package update failed with exit code $LASTEXITCODE; --config '$ConfigPath' repo package update '$pkgRepo' '$distribution' --add-packages '$packageId'"
+                    }
                 } else {
                     throw "Unsupported package type: $packageType"
                 }
@@ -201,6 +214,9 @@ function Publish-PackageToPMC {
             $rawPublishResponse = $null
             try {
                 $rawPublishResponse = pmc --config $ConfigPath repo publish $pkgRepo
+                if ($LASTEXITCODE -ne 0) {
+                    throw "pmc repo publish failed with exit code $LASTEXITCODE; --config '$ConfigPath' repo publish '$pkgRepo'"
+                }
             } catch {
                 $errorMessages.Add("Final publish for package $($finalPackage.PackageName) to $pkgRepo failed. See errors above for details.")
                 continue
@@ -287,6 +303,9 @@ try {
     # Get PMC repository list
     Write-Verbose "Getting PMC repository list" -Verbose
     $rawResponse = pmc --config $configPath repo list --limit 800
+    if ($LASTEXITCODE -ne 0) {
+        throw "pmc repo list failed with exit code $LASTEXITCODE; --config '$configPath' repo list --limit 800"
+    }
     $response = $rawResponse | ConvertFrom-Json
     Write-Verbose "PMC repo list: limit=$($response.limit), count=$($response.count)" -Verbose
     $repoList = $response.results

From aab474bd364702be15846ea5bfde3b36986834bf Mon Sep 17 00:00:00 2001
From: Steve Lee <slee@microsoft.com>
Date: Tue, 21 Jul 2026 16:12:15 -0700
Subject: [PATCH 08/10] address feedback

---
 .pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
index 2c562bf33..f63bf1ed8 100644
--- a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
+++ b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
@@ -171,7 +171,7 @@ function Publish-PackageToPMC {
                     throw "pmc package upload failed with exit code $LASTEXITCODE; --config '$ConfigPath' package upload '$packagePath' --type '$packageType'"
                 }
             } catch {
-                $errorMessages.Add("Uploading package $($finalPackage.PackageName) to $pkgRepo failed. See errors above for details.")
+                $errorMessages.Add("Uploading package $($finalPackage.PackageName) to $pkgRepo failed: $($_.Exception.Message)")
                 continue
             }
 
@@ -200,7 +200,7 @@ function Publish-PackageToPMC {
                     throw "Unsupported package type: $packageType"
                 }
             } catch {
-                $errorMessages.Add("Update for package $($finalPackage.PackageName) to $pkgRepo failed. See errors above for details.")
+                $errorMessages.Add("Update for package $($finalPackage.PackageName) to $pkgRepo failed: $($_.Exception.Message)")
                 continue
             }
 
@@ -218,7 +218,7 @@ function Publish-PackageToPMC {
                     throw "pmc repo publish failed with exit code $LASTEXITCODE; --config '$ConfigPath' repo publish '$pkgRepo'"
                 }
             } catch {
-                $errorMessages.Add("Final publish for package $($finalPackage.PackageName) to $pkgRepo failed. See errors above for details.")
+                $errorMessages.Add("Final publish for package $($finalPackage.PackageName) to $pkgRepo failed: $($_.Exception.Message)")
                 continue
             }
 

From a31b94f9ee36f8451ed9251147c87de31a9cfa53 Mon Sep 17 00:00:00 2001
From: Steve Lee <slee@microsoft.com>
Date: Wed, 22 Jul 2026 11:31:33 -0700
Subject: [PATCH 09/10] sign linux pkg

---
 .pipelines/DSC-Official-PMC.yml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.pipelines/DSC-Official-PMC.yml b/.pipelines/DSC-Official-PMC.yml
index bb8067999..0e7a63f66 100644
--- a/.pipelines/DSC-Official-PMC.yml
+++ b/.pipelines/DSC-Official-PMC.yml
@@ -25,6 +25,9 @@ variables:
     value: 'onebranch.azurecr.io/linux/ubuntu-2204:latest'
   - name: RepoRoot
     value: '$(Build.SourcesDirectory)/DSC'
+  - group: DSC-packages.microsoft.com
+  - name: SigningProfile
+    value: $(pgp_linux_cert_id)
 
 resources:
   repositories:
@@ -114,6 +117,13 @@ extends:
             Copy-Item ./bin/*.deb "$(ob_outputDirectory)"
           displayName: 'Build x86_64-unknown-linux-musl'
           condition: succeeded()
+        - task: onebranch.pipeline.signing@1
+          displayName: Sign deb and rpm packages
+          inputs:
+            command: 'sign'
+            signing_profile: '$(SigningProfile)'
+            files_to_sign: '**/*.rpm;**/*.deb'
+            search_root: '$(ob_outputDirectory)'
 
       - job: BuildLinuxArm64Musl
         dependsOn: SetPackageVersion
@@ -165,6 +175,13 @@ extends:
             Copy-Item ./bin/*.deb "$(ob_outputDirectory)"
           displayName: 'Build aarch64-unknown-linux-musl'
           condition: succeeded()
+        - task: onebranch.pipeline.signing@1
+          displayName: Sign deb and rpm packages
+          inputs:
+            command: 'sign'
+            signing_profile: '$(SigningProfile)'
+            files_to_sign: '**/*.rpm;**/*.deb'
+            search_root: '$(ob_outputDirectory)'
 
     - stage: PrepPackagesForEv2PMC
       displayName: Publish Linux Packages to packages.microsoft.com
@@ -195,7 +212,6 @@ extends:
             value: $(RepoRoot)/.config/suppress.json
           - name: ob_sdl_tsa_configFile
             value: $(RepoRoot)/.config/tsaoptions.json
-          - group: 'DSC-packages.microsoft.com'
         steps:
         - checkout: self
           lfs: false

From 548f49d960fdc4acb19840ec3423448d15fb79ed Mon Sep 17 00:00:00 2001
From: Steve Lee <slee@microsoft.com>
Date: Wed, 22 Jul 2026 16:21:04 -0700
Subject: [PATCH 10/10] remove ErrorAction

---
 .pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1 b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
index f63bf1ed8..93b3d5c6f 100644
--- a/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
+++ b/.pipelines/EV2Specs/ServiceGroupRoot/Shell/Run/Run.ps1
@@ -319,7 +319,7 @@ try {
     Write-Verbose "SkipPublish: $skipPublish" -Verbose
     Publish-PackageToPMC -PackageObject $packageObjects -ConfigPath $configPath -SkipPublish $skipPublish
 } catch {
-    Write-Error -ErrorAction Stop (Get-Error | Out-String)
+    Write-Error (Get-Error | Out-String)
     return 1
 }