Enable 2.1 official builds in AzDO (#28829)

* Try some internal props

* Pass envs to dockerbuild

* Fix job name

* Re-pin

* Set env vars

* Set defaults

13 files changed, 894 insertions, 119 deletions

diff --git a/.azure/pipelines/ci.yml b/.azure/pipelines/ci.yml
index 99ce2823b0..1d8d04a6f5 100644
--- a/.azure/pipelines/ci.yml
+++ b/.azure/pipelines/ci.yml
@@ -7,22 +7,716 @@ pr:
     include:
     - '*'
 
+variables:
+- name: ASPNETCORE_TEST_LOG_MAXPATH
+  value: "200" # Keep test log file name length low enough for artifact zipping
+- name: DOTNET_HOME
+  value: $(Agent.BuildDirectory)/.dotnet
+- name: TeamName
+  value: AspNetCore
+- ${{ if eq(variables['System.TeamProject'], 'public') }}:
+  - name: BuildScriptArgs
+    value: ''
+- ${{ if ne(variables['System.TeamProject'], 'public') }}:
+  - name: BuildScriptArgs
+    value: '/p:BuildNumber=$(Build.BuildId)'
+  - name: SharedFxArgs
+    value: '/t:Prepare
+            /t:Restore
+            /t:GeneratePropsFiles
+            /t:BuildSharedFx'
+
 jobs:
 - template: jobs/default-build.yml
   parameters:
     jobName: Windows_Build
     jobDisplayName: "Build and test: Windows"
     agentOs: Windows
+    codeSign: true
     beforeBuild:
     - powershell: "& ./src/Servers/IIS/tools/UpdateIISExpressCertificate.ps1"
       displayName: Setup IISExpress test certificates
-- template: jobs/default-build.yml
-  parameters:
-    jobName: macOs_Build
-    jobDisplayName: "Build and test : macOS"
-    agentOs: macOS
-- template: jobs/default-build.yml
-  parameters:
-    jobName: Linux_Build
-    jobDisplayName: "Build and test : Linux"
-    agentOs: Linux
+# Unix test jobs only run on public CI builds
+- ${{ if eq(variables['System.TeamProject'], 'public') }}:
+  - template: jobs/default-build.yml
+    parameters:
+      jobName: MacOs_Build
+      jobDisplayName: "Build and test : MacOS"
+      agentOs: MacOS
+  - template: jobs/default-build.yml
+    parameters:
+      jobName: Linux_Build
+      jobDisplayName: "Build and test : Linux"
+      agentOs: Linux
+
+- ${{ if eq(variables['System.TeamProject'], 'internal') }}:
+  - job: Windows_SharedFx
+    displayName: Build Windows x64/x86 SharedFx
+    dependsOn: Windows_Build
+    timeoutInMinutes: 90
+    workspace:
+      clean: all
+    pool:
+      name: NetCoreInternal-Pool
+      queue: BuildPool.Server.Amd64.VS2017
+    variables:
+      _SignType: real
+      JAVA_HOME: $(Agent.BuildDirectory)\.tools\jdk
+    steps:
+    - checkout: self
+      clean: true
+    - task: NodeTool@0
+      displayName: Install Node 10.x
+      inputs:
+        versionSpec: 10.x
+    - powershell: ./eng/scripts/InstallJdk.ps1 '11.0.1'
+      displayName: Install JDK 11
+    - task: NuGetCommand@2
+      displayName: 'Clear NuGet caches'
+      condition: succeeded()
+      inputs:
+        command: custom
+        arguments: 'locals all -clear'
+    - task: MicroBuildSigningPlugin@2
+      displayName: Install MicroBuild Signing plugin
+      inputs:
+        signType: $(_SignType)
+        zipSources: false
+        feedSource: https://dnceng.pkgs.visualstudio.com/_packaging/MicroBuildToolset/nuget/v3/index.json
+    - task: DownloadBuildArtifacts@0
+      displayName: Download artifacts
+      inputs:
+        artifactName: artifacts-Windows-Release
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: CopyFiles@2
+      displayName: Copy artifacts to .deps/
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Windows-Release/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/
+    - script: .\build.cmd
+              -ci
+              /p:SignType=$(_SignType)
+              $(BuildScriptArgs)
+              $(SharedFxArgs)
+              /p:SharedFxRID=win-x64
+              /bl:artifacts/logs/SharedFx-win-x64.binlog
+      env:
+        PB_PackageVersionPropsUrl: $(PB_PackageVersionPropsUrl)
+        PB_AssetRootUrl: $(PB_AssetRootUrl)
+        PB_RestoreSource: $(PB_RestoreSource)
+        PB_PublishBlobFeedKey: $(PB_PublishBlobFeedKey)
+      displayName: Build win-x64 SharedFX
+    - powershell: eng\scripts\KillProcesses.ps1
+      displayName: Kill processes
+      condition: always()
+    - script: .\build.cmd
+              -ci
+              /p:SignType=$(_SignType)
+              $(BuildScriptArgs)
+              $(SharedFxArgs)
+              /p:SharedFxRID=win-x86
+              /bl:artifacts/logs/SharedFx-win-x86.binlog
+      env:
+        PB_PackageVersionPropsUrl: $(PB_PackageVersionPropsUrl)
+        PB_AssetRootUrl: $(PB_AssetRootUrl)
+        PB_RestoreSource: $(PB_RestoreSource)
+        PB_PublishBlobFeedKey: $(PB_PublishBlobFeedKey)
+      displayName: Build win-x86 SharedFX
+    - powershell: eng\scripts\KillProcesses.ps1
+      displayName: Kill processes
+      condition: always()
+    - script: .\build.cmd
+              -ci
+              /p:SignType=$(_SignType)
+              $(BuildScriptArgs)
+              /p:SkipArtifactInfoTargets=true
+              /p:DisableSignCheck=true
+              /t:DoCodeSigning
+              /bl:artifacts/logs/CodeSign.binlog
+      env:
+        PB_PackageVersionPropsUrl: $(PB_PackageVersionPropsUrl)
+        PB_AssetRootUrl: $(PB_AssetRootUrl)
+        PB_RestoreSource: $(PB_RestoreSource)
+        PB_PublishBlobFeedKey: $(PB_PublishBlobFeedKey)
+      displayName: Code Sign
+    - powershell: eng\scripts\KillProcesses.ps1
+      displayName: Kill processes
+      condition: always()
+    - task: MicroBuildCleanup@1
+      displayName: Cleanup MicroBuild tasks
+      condition: always()
+    - task: PublishBuildArtifacts@1
+      displayName: Upload artifacts
+      condition: eq(variables['system.pullrequest.isfork'], false)
+      continueOnError: true
+      inputs:
+        pathtoPublish: artifacts/
+        artifactName: artifacts-Windows-SharedFx
+        artifactType: Container
+        parallel: true
+    - task: PublishBuildArtifacts@1
+      displayName: Upload dependencies.g.props
+      condition: eq(variables['system.pullrequest.isfork'], false)
+      continueOnError: true
+      inputs:
+        pathtoPublish: .deps/dependencies.g.props
+        artifactName: artifacts-dependencies-props
+        artifactType: Container
+        parallel: true
+
+  - job: MacOs_SharedFx
+    displayName: Build Osx-x64 SharedFx
+    dependsOn: Windows_Build
+    timeoutInMinutes: 90
+    workspace:
+      clean: all
+    pool:
+      vmImage: macOS-10.14
+    steps:
+    - checkout: self
+      clean: true
+    - task: NodeTool@0
+      displayName: Install Node 10.x
+      inputs:
+        versionSpec: 10.x
+    - task: DownloadBuildArtifacts@0
+      displayName: Download artifacts
+      inputs:
+        artifactName: artifacts-Windows-Release
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: CopyFiles@2
+      displayName: Copy artifacts to .deps/
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Windows-Release/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/
+    - script: ./$(BuildDirectory)/build.sh
+              -ci
+              $(BuildScriptArgs)
+              $(SharedFxArgs)
+              /p:SharedFxRID=osx-x64
+              /bl:artifacts/logs/SharedFx-osx-x64.binlog
+      env:
+        PB_PackageVersionPropsUrl: $(PB_PackageVersionPropsUrl)
+        PB_AssetRootUrl: $(PB_AssetRootUrl)
+        PB_RestoreSource: $(PB_RestoreSource)
+        PB_PublishBlobFeedKey: $(PB_PublishBlobFeedKey)
+      displayName: Build osx-x64 SharedFX
+    - task: PublishBuildArtifacts@1
+      displayName: Upload artifacts
+      condition: eq(variables['system.pullrequest.isfork'], false)
+      continueOnError: true
+      inputs:
+        pathtoPublish: artifacts/
+        artifactName: artifacts-MacOs-SharedFx
+        artifactType: Container
+        parallel: true
+
+  - job: Linux_SharedFx
+    displayName: Build Linux x64/arm SharedFx
+    dependsOn: Windows_Build
+    timeoutInMinutes: 90
+    workspace:
+      clean: all
+    pool:
+      vmImage: ubuntu-16.04
+    steps:
+    - checkout: self
+      clean: true
+    - task: NodeTool@0
+      displayName: Install Node 10.x
+      inputs:
+        versionSpec: 10.x
+    - task: DownloadBuildArtifacts@0
+      displayName: Download artifacts
+      inputs:
+        artifactName: artifacts-Windows-Release
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: CopyFiles@2
+      displayName: Copy artifacts to .deps/
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Windows-Release/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/
+    - script: ./$(BuildDirectory)/build.sh
+              -ci
+              $(BuildScriptArgs)
+              $(SharedFxArgs)
+              /p:SharedFXRid=linux-x64
+              /bl:artifacts/logs/SharedFx-linux-x64.binlog
+      env:
+        PB_PackageVersionPropsUrl: $(PB_PackageVersionPropsUrl)
+        PB_AssetRootUrl: $(PB_AssetRootUrl)
+        PB_RestoreSource: $(PB_RestoreSource)
+        PB_PublishBlobFeedKey: $(PB_PublishBlobFeedKey)
+      displayName: Build linux-x64 SharedFX
+    - script: ./$(BuildDirectory)/build.sh
+              -ci
+              $(BuildScriptArgs)
+              $(SharedFxArgs)
+              /p:SharedFXRid=linux-arm
+              /p:IsLinuxArmSupported=true
+              /bl:artifacts/logs/SharedFx-linux-arm.binlog
+      env:
+        PB_PackageVersionPropsUrl: $(PB_PackageVersionPropsUrl)
+        PB_AssetRootUrl: $(PB_AssetRootUrl)
+        PB_RestoreSource: $(PB_RestoreSource)
+        PB_PublishBlobFeedKey: $(PB_PublishBlobFeedKey)
+      displayName: Build linux-arm SharedFX
+    - task: PublishBuildArtifacts@1
+      displayName: Upload artifacts
+      condition: eq(variables['system.pullrequest.isfork'], false)
+      continueOnError: true
+      inputs:
+        pathtoPublish: artifacts/
+        artifactName: artifacts-Linux-SharedFx
+        artifactType: Container
+        parallel: true
+
+  - job: Linux_Musl_SharedFx
+    displayName: Build Linux-musl-x64 SharedFx
+    dependsOn: Windows_Build
+    timeoutInMinutes: 90
+    workspace:
+      clean: all
+    pool:
+      vmImage: ubuntu-16.04
+    steps:
+    - checkout: self
+      clean: true
+    - task: NodeTool@0
+      displayName: Install Node 10.x
+      inputs:
+        versionSpec: 10.x
+    - task: DownloadBuildArtifacts@0
+      displayName: Download artifacts
+      inputs:
+        artifactName: artifacts-Windows-Release
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: CopyFiles@2
+      displayName: Copy artifacts to .deps/
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Windows-Release/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/
+    - script: ./$(BuildDirectory)/dockerbuild.sh
+              alpine
+              -ci
+              $(BuildScriptArgs)
+              /t:Prepare
+              /t:GeneratePropsFiles
+              /t:BuildSharedFx
+              /p:SharedFXRid=linux-musl-x64
+              /bl:artifacts/logs/SharedFx-linux-musl-x64.binlog
+      env:
+        PB_PackageVersionPropsUrl: $(PB_PackageVersionPropsUrl)
+        PB_AssetRootUrl: $(PB_AssetRootUrl)
+        PB_RestoreSource: $(PB_RestoreSource)
+        PB_PublishBlobFeedKey: $(PB_PublishBlobFeedKey)
+      displayName: Build linux-musl-x64 SharedFX
+    - bash: docker system prune -af
+      displayName: Docker prune
+    - task: PublishBuildArtifacts@1
+      displayName: Upload artifacts
+      condition: eq(variables['system.pullrequest.isfork'], false)
+      continueOnError: true
+      inputs:
+        pathtoPublish: artifacts/
+        artifactName: artifacts-Linux-Musl-SharedFx
+        artifactType: Container
+        parallel: true
+
+  - job: Windows_Installers
+    displayName: Build Windows Installers
+    dependsOn: Windows_SharedFx
+    timeoutInMinutes: 90
+    workspace:
+      clean: all
+    pool:
+      name: NetCoreInternal-Pool
+      queue: BuildPool.Server.Amd64.VS2017
+    variables:
+      _SignType: real
+      JAVA_HOME: $(Agent.BuildDirectory)\.tools\jdk
+    steps:
+    - checkout: self
+      clean: true
+    - task: NuGetCommand@2
+      displayName: 'Clear NuGet caches'
+      condition: succeeded()
+      inputs:
+        command: custom
+        arguments: 'locals all -clear'
+    - task: MicroBuildSigningPlugin@2
+      displayName: Install MicroBuild Signing plugin
+      inputs:
+        signType: $(_SignType)
+        zipSources: false
+        feedSource: https://dnceng.pkgs.visualstudio.com/_packaging/MicroBuildToolset/nuget/v3/index.json
+    - task: DownloadBuildArtifacts@0
+      displayName: Download artifacts
+      inputs:
+        artifactName: artifacts-Windows-SharedFx
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: DownloadBuildArtifacts@0
+      displayName: Download dependencies.g.props
+      inputs:
+        artifactName: artifacts-dependencies-props
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: CopyFiles@2
+      displayName: Copy SharedFx artifacts to .deps/
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Windows-SharedFx/Signed/SharedFX/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/fx/
+    - task: CopyFiles@2
+      displayName: Copy SharedFx artifacts to .deps/
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Windows-SharedFx/Signed/packages/
+        contents: 'Microsoft.AspNetCore.AspNetCoreModule*.nupkg'
+        targetFolder: $(Build.SourcesDirectory)/.deps/ANCM/
+    - task: CopyFiles@2
+      displayName: Copy dependencies.g.props to .deps/
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-dependencies-props/
+        contents: 'dependencies.g.props'
+        targetFolder: $(Build.SourcesDirectory)/.deps/
+    - powershell: src/Installers/Windows/build.ps1
+        -Config Release
+        -BuildNumber $(Build.BuildId)
+      env:
+        PB_PackageVersionPropsUrl: $(PB_PackageVersionPropsUrl)
+        PB_AssetRootUrl: $(PB_AssetRootUrl)
+        PB_RestoreSource: $(PB_RestoreSource)
+        PB_PublishBlobFeedKey: $(PB_PublishBlobFeedKey)
+      displayName: Run src/Installers/Windows/build.ps1
+    - powershell: eng\scripts\KillProcesses.ps1
+      displayName: Kill processes
+      condition: always()
+    - task: PublishBuildArtifacts@1
+      displayName: Upload artifacts
+      condition: eq(variables['system.pullrequest.isfork'], false)
+      continueOnError: true
+      inputs:
+        pathtoPublish: artifacts/
+        artifactName: artifacts-Windows-Installers
+        artifactType: Container
+        parallel: true
+
+  - job: Package_Archive
+    displayName: Build Package Archive
+    dependsOn: Windows_SharedFx
+    timeoutInMinutes: 90
+    workspace:
+      clean: all
+    pool:
+      name: NetCoreInternal-Pool
+      queue: BuildPool.Server.Amd64.VS2017
+    variables:
+      _SignType: real
+      JAVA_HOME: $(Agent.BuildDirectory)\.tools\jdk
+    steps:
+    - checkout: self
+      clean: true
+    - task: NuGetCommand@2
+      displayName: 'Clear NuGet caches'
+      condition: succeeded()
+      inputs:
+        command: custom
+        arguments: 'locals all -clear'
+    - task: DownloadBuildArtifacts@0
+      displayName: Download artifacts
+      inputs:
+        artifactName: artifacts-Windows-SharedFx
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: CopyFiles@2
+      displayName: Copy artifacts to .deps/
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Windows-SharedFx/Signed/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/Signed/
+    - script: .\build.cmd
+              -ci
+              $(BuildScriptArgs)
+              /p:SignType=$(_SignType)
+              /t:BuildFallbackArchive
+              /bl:artifacts/logs/PackageArchive.binlog
+      env:
+        PB_PackageVersionPropsUrl: $(PB_PackageVersionPropsUrl)
+        PB_AssetRootUrl: $(PB_AssetRootUrl)
+        PB_RestoreSource: $(PB_RestoreSource)
+        PB_PublishBlobFeedKey: $(PB_PublishBlobFeedKey)
+      displayName: Build Package Archive
+    - powershell: eng\scripts\KillProcesses.ps1
+      displayName: Kill processes
+      condition: always()
+    - task: PublishBuildArtifacts@1
+      displayName: Upload artifacts
+      condition: eq(variables['system.pullrequest.isfork'], false)
+      continueOnError: true
+      inputs:
+        pathtoPublish: artifacts/
+        artifactName: artifacts-Package-Archive
+        artifactType: Container
+        parallel: true
+
+  - job: SharedFX_Installers
+    displayName: Build SharedFX Installers
+    dependsOn: 
+      - Linux_SharedFx
+      - Linux_Musl_SharedFx
+      - MacOs_SharedFx
+      - Windows_SharedFx
+    timeoutInMinutes: 90
+    workspace:
+      clean: all
+    pool:
+      vmImage: ubuntu-16.04
+    steps:
+    - checkout: self
+      clean: true
+    - task: NodeTool@0
+      displayName: Install Node 10.x
+      inputs:
+        versionSpec: 10.x
+    - task: DownloadBuildArtifacts@0
+      displayName: Download Linux SharedFx artifacts
+      inputs:
+        artifactName: artifacts-Linux-SharedFx
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: DownloadBuildArtifacts@0
+      displayName: Download Linux Musl SharedFx artifacts
+      inputs:
+        artifactName: artifacts-Linux-Musl-SharedFx
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: DownloadBuildArtifacts@0
+      displayName: Download MacOs SharedFx artifacts
+      inputs:
+        artifactName: artifacts-MacOs-SharedFx
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: DownloadBuildArtifacts@0
+      displayName: Download Windows SharedFx artifacts
+      inputs:
+        artifactName: artifacts-Windows-SharedFx
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: CopyFiles@2
+      displayName: Copy Linux artifacts to .deps/
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Linux-SharedFx/runtime/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/Signed/SharedFx/
+    - task: CopyFiles@2
+      displayName: Copy Linux-Musl artifacts to .deps/
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Linux-Musl-SharedFx/runtime/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/Signed/SharedFx/
+    - task: CopyFiles@2
+      displayName: Copy MacOS artifacts to .deps/
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-MacOs-SharedFx/runtime/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/Signed/SharedFx/
+    - task: CopyFiles@2
+      displayName: Copy Windows SharedFx artifacts to .deps/
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Windows-SharedFx/Signed/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/Signed/
+    - script: ./$(BuildDirectory)/build.sh
+              -ci
+              $(BuildScriptArgs)
+              /t:BuildInstallers
+              /bl:artifacts/logs/SharedFx-Installers.binlog
+      env:
+        PB_PackageVersionPropsUrl: $(PB_PackageVersionPropsUrl)
+        PB_AssetRootUrl: $(PB_AssetRootUrl)
+        PB_RestoreSource: $(PB_RestoreSource)
+        PB_PublishBlobFeedKey: $(PB_PublishBlobFeedKey)
+      displayName: Build SharedFX Installers
+    - bash: docker system prune -af
+      displayName: Docker prune
+    - task: PublishBuildArtifacts@1
+      displayName: Upload artifacts
+      condition: eq(variables['system.pullrequest.isfork'], false)
+      continueOnError: true
+      inputs:
+        pathtoPublish: artifacts/
+        artifactName: artifacts-SharedFx-Installers
+        artifactType: Container
+        parallel: true
+
+  - job: Publish
+    displayName: Publish
+    dependsOn: 
+      - Windows_Installers
+      - SharedFX_Installers
+      - Package_Archive
+    timeoutInMinutes: 90
+    workspace:
+      clean: all
+    pool:
+      name: NetCoreInternal-Pool
+      queue: BuildPool.Server.Amd64.VS2017
+    variables:
+      _SignType: real
+      JAVA_HOME: $(Agent.BuildDirectory)\.tools\jdk
+    steps:
+    - checkout: self
+      clean: true
+    - task: NuGetCommand@2
+      displayName: 'Clear NuGet caches'
+      condition: succeeded()
+      inputs:
+        command: custom
+        arguments: 'locals all -clear'
+    - task: DownloadBuildArtifacts@0
+      displayName: Download Windows artifacts
+      inputs:
+        artifactName: artifacts-Windows-Release
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: DownloadBuildArtifacts@0
+      displayName: Download Linux SharedFx artifacts
+      inputs:
+        artifactName: artifacts-Linux-SharedFx
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: DownloadBuildArtifacts@0
+      displayName: Download Linux Musl SharedFx artifacts
+      inputs:
+        artifactName: artifacts-Linux-Musl-SharedFx
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: DownloadBuildArtifacts@0
+      displayName: Download MacOs SharedFx artifacts
+      inputs:
+        artifactName: artifacts-MacOs-SharedFx
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: DownloadBuildArtifacts@0
+      displayName: Download Windows SharedFx artifacts
+      inputs:
+        artifactName: artifacts-Windows-SharedFx
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: DownloadBuildArtifacts@0
+      displayName: Download Package Archive artifacts
+      inputs:
+        artifactName: artifacts-Package-Archive
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: DownloadBuildArtifacts@0
+      displayName: Download SharedFx installer artifacts
+      inputs:
+        artifactName: artifacts-SharedFx-Installers
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: DownloadBuildArtifacts@0
+      displayName: Download Windows installer artifacts
+      inputs:
+        artifactName: artifacts-Windows-Installers
+        downloadPath: $(Build.StagingDirectory)/downloaded_artifacts/
+    - task: CopyFiles@2
+      displayName: Copy Windows artifacts to .deps/assets
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Windows-Release/build/
+        contents: '**/*.tgz'
+        targetFolder: $(Build.SourcesDirectory)/.deps/assets/
+        flattenFolders: true
+    - task: CopyFiles@2
+      displayName: Copy Linux SharedFx artifacts to .deps/assets
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Linux-SharedFx/runtime/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/assets/
+    - task: CopyFiles@2
+      displayName: Copy Linux Musl SharedFx artifacts to .deps/assets
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Linux-Musl-SharedFx/runtime/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/assets/
+    - task: CopyFiles@2
+      displayName: Copy MacOs SharedFx artifacts to .deps/assets
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-MacOs-SharedFx/runtime/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/assets/
+    - task: CopyFiles@2
+      displayName: Copy Windows SharedFx artifacts to .deps/assets
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Windows-SharedFx/Signed/
+        contents: |
+          SharedFx/**
+          OobArchives/**
+        targetFolder: $(Build.SourcesDirectory)/.deps/assets/
+        flattenFolders: true
+    - task: CopyFiles@2
+      displayName: Copy Package Archive artifacts to .deps/assets
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Package-Archive/lzma/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/assets/
+    - task: CopyFiles@2
+      displayName: Copy SharedFx Installer artifacts to .deps/assets
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-SharedFx-Installers/installers/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/assets/
+    - task: CopyFiles@2
+      displayName: Copy Windows Installer artifacts to .deps/assets
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Windows-Installers/bin/Release/installers/
+        contents: |
+          en-US/*.msi
+          **/*.exe
+          **/*.wixlib
+          **/*.nupkg
+        targetFolder: $(Build.SourcesDirectory)/.deps/assets/
+        flattenFolders: true
+    - task: CopyFiles@2
+      displayName: Copy Linux SharedFx artifacts to .deps/packages
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Linux-SharedFx/symbols/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/packages/
+    - task: CopyFiles@2
+      displayName: Copy Linux Musl SharedFx artifacts to .deps/packages
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Linux-Musl-SharedFx/symbols/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/packages/
+    - task: CopyFiles@2
+      displayName: Copy MacOs SharedFx artifacts to .deps/packages
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-MacOs-SharedFx/symbols/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/packages/
+    - task: CopyFiles@2
+      displayName: Copy Windows SharedFx artifacts to .deps/packages
+      inputs:
+        sourceFolder: $(Build.StagingDirectory)/downloaded_artifacts/artifacts-Windows-SharedFx/Signed/Packages/
+        contents: '**'
+        targetFolder: $(Build.SourcesDirectory)/.deps/packages/
+    - task: DeleteFiles@1
+      displayName: Delete korebuild.json
+      inputs:
+        contents: korebuild.json
+    - script: .\build.cmd
+              -ci
+              $(BuildScriptArgs)
+              /t:Publish
+              /p:BuildBranch=$(Build.SourceBranchName)
+              /bl:artifacts/logs/Publish.binlog
+      env:
+        PB_PackageVersionPropsUrl: $(PB_PackageVersionPropsUrl)
+        PB_AssetRootUrl: $(PB_AssetRootUrl)
+        PB_RestoreSource: $(PB_RestoreSource)
+        PB_PublishBlobFeedKey: $(PB_PublishBlobFeedKey)
+      displayName: Publish
+    - powershell: eng\scripts\KillProcesses.ps1
+      displayName: Kill processes
+      condition: always()
+    - task: PublishBuildArtifacts@1
+      displayName: Upload logs
+      condition: eq(variables['system.pullrequest.isfork'], false)
+      continueOnError: true
+      inputs:
+        pathtoPublish: artifacts/logs
+        artifactName: artifacts-Publish
+        artifactType: Container
+        parallel: true
\ No newline at end of file
diff --git a/.azure/pipelines/jobs/default-build.yml b/.azure/pipelines/jobs/default-build.yml
index 2b8c2f8c6f..30739aef4b 100644
--- a/.azure/pipelines/jobs/default-build.yml
+++ b/.azure/pipelines/jobs/default-build.yml
@@ -8,7 +8,7 @@
 #   poolName: string
 #       The name of the Azure DevOps agent pool to use.
 #   agentOs: string
-#       Used in templates to define variables which are OS specific. Typically from the set { Windows, Linux, macOS }
+#       Used in templates to define variables which are OS specific. Typically from the set { Windows, Linux, MacOS }
 #   buildArgs: string
 #       Additional arguments to pass to the build.sh/cmd script.
 #       Note: -ci is always passed
@@ -41,7 +41,6 @@
 parameters:
   agentOs: 'Windows'
   poolName: ''
-  buildArgs: ''
   configuration: 'Release'
   beforeBuild: []
   afterBuild: []
@@ -72,7 +71,7 @@ jobs:
   pool:
     ${{ if ne(parameters.poolName, '') }}:
       name: ${{ parameters.poolName }}
-    ${{ if and(eq(parameters.poolName, ''), eq(parameters.agentOs, 'macOS')) }}:
+    ${{ if and(eq(parameters.poolName, ''), eq(parameters.agentOs, 'MacOS')) }}:
       vmImage: macOS-10.14
     ${{ if and(eq(parameters.poolName, ''), eq(parameters.agentOs, 'Linux')) }}:
       vmImage: ubuntu-16.04
@@ -85,13 +84,10 @@ jobs:
         queue: BuildPool.Server.Amd64.VS2017
   variables:
     AgentOsName: ${{ parameters.agentOs }}
-    ASPNETCORE_TEST_LOG_MAXPATH: "200" # Keep test log file name length low enough for artifact zipping
-    DOTNET_HOME: $(Agent.BuildDirectory)/.dotnet
     BuildScript: ${{ parameters.buildScript }}
-    BuildScriptArgs: ${{ parameters.buildArgs }}
     BuildConfiguration: ${{ parameters.configuration }}
     BuildDirectory: ${{ parameters.buildDirectory }}
-    TeamName: AspNetCore
+    BinlogArg: /bl:artifacts/logs/${{ parameters.agentOs }}.binlog
     ${{ if eq(parameters.agentOs, 'Windows') }}:
       JAVA_HOME: $(Agent.BuildDirectory)\.tools\jdk
     ${{ if or(ne(parameters.codeSign, 'true'), ne(variables['System.TeamProject'], 'internal'), in(variables['Build.Reason'], 'PullRequest')) }}:
@@ -99,6 +95,11 @@ jobs:
     ${{ if and(eq(parameters.codeSign, 'true'), eq(variables['System.TeamProject'], 'internal'), notin(variables['Build.Reason'], 'PullRequest')) }}:
       _SignType: real
     ${{ insert }}: ${{ parameters.variables }}
+    ${{ if eq(variables['System.TeamProject'], 'public') }}:
+      PB_PackageVersionPropsUrl: ''
+      PB_AssetRootUrl: ''
+      PB_RestoreSource: ''
+      PB_PublishBlobFeedKey: ''
   steps:
   - checkout: self
     clean: true
@@ -116,7 +117,7 @@ jobs:
         command: custom
         arguments: 'locals all -clear'
   - ${{ if and(eq(variables['System.TeamProject'], 'internal'), eq(parameters.agentOs, 'Windows'), eq(parameters.codeSign, 'true')) }}:
-    - task: MicroBuildSigningPlugin@1
+    - task: MicroBuildSigningPlugin@2
       displayName: Install MicroBuild Signing plugin
       condition: and(succeeded(), in(variables['_SignType'], 'test', 'real'))
       inputs:
@@ -125,13 +126,33 @@ jobs:
         feedSource: https://dnceng.pkgs.visualstudio.com/_packaging/MicroBuildToolset/nuget/v3/index.json
   - ${{ parameters.beforeBuild }}
   - ${{ if eq(parameters.agentOs, 'Windows') }}:
-    - script: .\$(BuildDirectory)\build.cmd -ci /p:SignType=$(_SignType) /p:Configuration=$(BuildConfiguration) $(BuildScriptArgs)
+    - script: .\$(BuildDirectory)\build.cmd
+              -ci
+              /p:SignType=$(_SignType)
+              /p:Configuration=$(BuildConfiguration)
+              /p:DisableSignCheck=true
+              $(BuildScriptArgs)
+              $(BinlogArg)
+      env:
+        PB_PackageVersionPropsUrl: $(PB_PackageVersionPropsUrl)
+        PB_AssetRootUrl: $(PB_AssetRootUrl)
+        PB_RestoreSource: $(PB_RestoreSource)
+        PB_PublishBlobFeedKey: $(PB_PublishBlobFeedKey)
       displayName: Run build.cmd
     - powershell: eng\scripts\KillProcesses.ps1
       displayName: Kill processes
       condition: always()
   - ${{ if ne(parameters.agentOs, 'Windows') }}:
-    - script: ./$(BuildDirectory)/build.sh -ci -p:Configuration=$(BuildConfiguration) $(BuildScriptArgs)
+    - script: ./$(BuildDirectory)/build.sh
+              -ci
+              -p:Configuration=$(BuildConfiguration)
+              $(BuildScriptArgs)
+              $(BinlogArg)
+      env:
+        PB_PackageVersionPropsUrl: $(PB_PackageVersionPropsUrl)
+        PB_AssetRootUrl: $(PB_AssetRootUrl)
+        PB_RestoreSource: $(PB_RestoreSource)
+        PB_PublishBlobFeedKey: $(PB_PublishBlobFeedKey)
       displayName: Run build.sh
     - script: eng/scripts/KillProcesses.sh
       displayName: Kill processes
@@ -165,4 +186,4 @@ jobs:
   - ${{ if and(eq(variables['System.TeamProject'], 'internal'), eq(parameters.agentOs, 'Windows')) }}:
     - task: MicroBuildCleanup@1
       displayName: Cleanup MicroBuild tasks
-      condition: always()
+      condition: always()
\ No newline at end of file
diff --git a/build/dependencies.props b/build/dependencies.props
index 4756c166b9..e6d5e89f19 100644
--- a/build/dependencies.props
+++ b/build/dependencies.props
@@ -4,7 +4,6 @@
     <!-- MicrosoftNETCoreApp21PackageVersion is assigned at the bottom so it can automatically pick up MicrosoftNETCoreAppPackageVersion in an orchestrated build. -->
     <MicrosoftNETCoreAppPackageVersion>2.1.23</MicrosoftNETCoreAppPackageVersion>
     <MicrosoftNETCoreDotNetAppHostPackageVersion>2.1.23</MicrosoftNETCoreDotNetAppHostPackageVersion>
-    <MicrosoftExtensionsConfigurationAzureKeyVaultPackageVersion>2.1.1</MicrosoftExtensionsConfigurationAzureKeyVaultPackageVersion>
   </PropertyGroup>
 
   <Import Project="$(DotNetPackageVersionPropsPath)" Condition="'$(DotNetPackageVersionPropsPath)' != ''" />
@@ -16,7 +15,7 @@
     <!-- Determined by build tools -->
     <InternalAspNetCoreSdkPackageVersion>$(KoreBuildVersion)</InternalAspNetCoreSdkPackageVersion>
     <InternalAspNetCoreSiteExtensionSdkPackageVersion>$(KoreBuildVersion)</InternalAspNetCoreSiteExtensionSdkPackageVersion>
-    <InternalAspNetCoreSdkPackageVersion Condition=" '$(KoreBuildVersion)' == '' ">2.1.7-build-20201119.1</InternalAspNetCoreSdkPackageVersion>
+    <InternalAspNetCoreSdkPackageVersion Condition=" '$(KoreBuildVersion)' == '' ">2.1.7-build-20201218.2</InternalAspNetCoreSdkPackageVersion>
   </PropertyGroup>
 
   <!-- These are package versions that should not be overridden or updated by automation. -->
@@ -31,6 +30,7 @@
     <MicrosoftExtensionsCachingSqlServerPackageVersion>2.1.2</MicrosoftExtensionsCachingSqlServerPackageVersion>
     <MicrosoftExtensionsCommandLineUtilsSourcesPackageVersion>2.1.1</MicrosoftExtensionsCommandLineUtilsSourcesPackageVersion>
     <MicrosoftExtensionsConfigurationAbstractionsPackageVersion>2.1.1</MicrosoftExtensionsConfigurationAbstractionsPackageVersion>
+    <MicrosoftExtensionsConfigurationAzureKeyVaultPackageVersion>2.1.1</MicrosoftExtensionsConfigurationAzureKeyVaultPackageVersion>
     <MicrosoftExtensionsConfigurationBinderPackageVersion>2.1.10</MicrosoftExtensionsConfigurationBinderPackageVersion>
     <MicrosoftExtensionsConfigurationCommandLinePackageVersion>2.1.1</MicrosoftExtensionsConfigurationCommandLinePackageVersion>
     <MicrosoftExtensionsConfigurationEnvironmentVariablesPackageVersion>2.1.1</MicrosoftExtensionsConfigurationEnvironmentVariablesPackageVersion>
diff --git a/build/repo.props b/build/repo.props
index e595d67e62..f3bcf33bf1 100644
--- a/build/repo.props
+++ b/build/repo.props
@@ -20,7 +20,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <SharedSourceDirectories Include="$(SharedSourcesFolder)Hosting.WebHostBuilderFactory\" />
+    <!-- Don't populate SharedSourceDirectories while doing Code Signing, otherwise we'll try to sign this nonexistant package -->
+    <SharedSourceDirectories Include="$(SharedSourcesFolder)Hosting.WebHostBuilderFactory\" Condition="'$(SkipArtifactInfoTargets)' != 'true'" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/build/repo.targets b/build/repo.targets
index c0d6650e27..937dbb1876 100644
--- a/build/repo.targets
+++ b/build/repo.targets
@@ -21,9 +21,9 @@
     <PackageDependsOn Condition="'$(TestOnly)' != 'true' AND '$(_ProjectsOnly)' != 'true'">$(PackageDependsOn);BuildMetapackages;BuildSiteExtension;CheckExpectedPackagesExist</PackageDependsOn>
     <TestDependsOn>$(TestDependsOn);TestProjects</TestDependsOn>
     <TestDependsOn Condition="'$(_ProjectsOnly)' != 'true'">$(TestDependsOn);_TestRepositories</TestDependsOn>
-    <GetArtifactInfoDependsOn>$(GetArtifactInfoDependsOn);GetProjectArtifactInfo</GetArtifactInfoDependsOn>
-    <GetArtifactInfoDependsOn>$(GetArtifactInfoDependsOn);ResolveSharedSourcesPackageInfo</GetArtifactInfoDependsOn>
-    <GetArtifactInfoDependsOn  Condition="'$(_ProjectsOnly)' != 'true'">$(GetArtifactInfoDependsOn);ResolveRepoInfo</GetArtifactInfoDependsOn>
+    <GetArtifactInfoDependsOn Condition="'$(SkipArtifactInfoTargets)' != 'true'">$(GetArtifactInfoDependsOn);GetProjectArtifactInfo</GetArtifactInfoDependsOn>
+    <GetArtifactInfoDependsOn Condition="'$(SkipArtifactInfoTargets)' != 'true'">$(GetArtifactInfoDependsOn);ResolveSharedSourcesPackageInfo</GetArtifactInfoDependsOn>
+    <GetArtifactInfoDependsOn Condition="'$(SkipArtifactInfoTargets)' != 'true' AND '$(_ProjectsOnly)' != 'true'">$(GetArtifactInfoDependsOn);ResolveRepoInfo</GetArtifactInfoDependsOn>
   </PropertyGroup>
 
   <Target Name="PrepareOutputPaths">
@@ -274,4 +274,63 @@
            Text="Repository %(Repository.Identity) is missing NuGetPackageVerifier.json. Expected file to exist in %(Repository.RootPath)NuGetPackageVerifier.json" />
   </Target>
 
-</Project>
+  <Target Name="DoCodeSigning" DependsOnTargets="_SetupCodeSign;CodeSign;_CopySignedFilesToArtifacts" />
+
+  <Target Name="_SetupCodeSign">
+    <PropertyGroup>
+      <!-- Make sure we're not disabling code signing -->
+      <DisableCodeSigning>false</DisableCodeSigning>
+    </PropertyGroup>
+
+    <ItemGroup>
+      <!-- We're passing a custom list of files - clear out the exclusion list so it doesn't interfere -->
+      <FilesToExcludeFromSigning Remove="@(FilesToExcludeFromSigning)" />
+
+      <!-- Make sure 3rd party binaries get 3rd party certificate -->
+      <CustomFileSignInfo Include="MsgPack.dll" CertificateName="3PartySHA2" />
+      <CustomFileSignInfo Include="MessagePack.dll" CertificateName="3PartySHA2" />
+      <CustomFileSignInfo Include="Newtonsoft.Json.Bson.dll" CertificateName="3PartySHA2" />
+      <CustomFileSignInfo Include="Newtonsoft.Json.dll" CertificateName="3PartySHA2" />
+      <CustomFileSignInfo Include="Remotion.Linq.dll" CertificateName="3PartySHA2" />
+      <CustomFileSignInfo Include="SQLitePCLRaw.batteries_green.dll" CertificateName="3PartySHA2" />
+      <CustomFileSignInfo Include="SQLitePCLRaw.batteries_v2.dll" CertificateName="3PartySHA2" />
+      <CustomFileSignInfo Include="SQLitePCLRaw.core.dll" CertificateName="3PartySHA2" />
+      <CustomFileSignInfo Include="SQLitePCLRaw.provider.e_sqlite3.dll" CertificateName="3PartySHA2" />
+      <CustomFileSignInfo Include="e_sqlite3.dll" CertificateName="3PartySHA2" />
+      <CustomFileSignInfo Include="StackExchange.Redis.StrongName.dll" CertificateName="3PartySHA2" />
+      <CustomFileSignInfo Include="System.Interactive.Async.dll" CertificateName="3PartySHA2" />
+      <!--
+      Map file extensions to a code-sign cert.
+      "None" means don't sign the file itself, but still scan the contents for signable files.
+      -->
+      <CustomFileExtensionSignInfo Include=".ps1;.psd1;.psm1;.psc1" CertificateName="Microsoft400" />
+      <CustomFileExtensionSignInfo Include=".dll;.exe" CertificateName="MicrosoftSHA2" />
+      <CustomFileExtensionSignInfo Include=".cab" CertificateName="None" />
+      <!-- We don't need to code sign .js files because they are not used in Windows Script Host. -->
+      <CustomFileExtensionSignInfo Include=".js" CertificateName="None" />
+      <!-- We don't produce font files. We rebundle some for using the web brower, so they do not need to be signed. -->
+      <CustomFileExtensionSignInfo Include=".otf" CertificateName="None" />
+      <CustomFileExtensionSignInfo Include=".ttf" CertificateName="None" />
+      <!-- This is a text file which doesn't need to be code signed, even though some .mof files can be signed. -->
+      <CustomFileSignInfo Include="ancm.mof" CertificateName="None" />
+      <!-- Exclude the apphost because this is expected to be code-signed by customers after the SDK modifies it. -->
+      <CustomFileSignInfo Include="apphost.exe" CertificateName="None" />
+
+      <FilesToSign Include="$(DependencyPackageDir)**\*.nupkg" Certificate="NuGet" />
+      <FilesToSign Include="$(DependencyPackageDir)**\*.mpack" Certificate="None" />
+      <FilesToSign Include="$(DependencyPackageDir)**\*.vsix" Certificate="VsixSHA2" />
+      <FilesToSign Include="$(DependencyPackageDir)**\*.jar" Certificate="MicrosoftJARSHA2" />
+      <FilesToSign Include="$(ArtifactsDir)symbols\**\*.nupkg" Certificate="NuGet" />
+      <FilesToSign Include="$(SharedFxOutputPath)**\*.zip" Certificate="None" />
+    </ItemGroup>
+  </Target>
+
+  <Target Name="_CopySignedFilesToArtifacts">
+    <Copy SourceFiles="%(FilesToSign.Identity)" DestinationFiles="$(ArtifactsDir)Signed\MPacks\%(FilesToSign.Filename)%(FilesToSign.Extension)" Condition="'%(FilesToSign.Extension)' == '.mpack'" />
+    <Copy SourceFiles="%(FilesToSign.Identity)" DestinationFiles="$(ArtifactsDir)Signed\Packages\%(FilesToSign.Filename)%(FilesToSign.Extension)" Condition="'%(FilesToSign.Extension)' == '.nupkg'" />
+    <Copy SourceFiles="%(FilesToSign.Identity)" DestinationFiles="$(ArtifactsDir)Signed\Packages\%(FilesToSign.Filename)%(FilesToSign.Extension)" Condition="'%(FilesToSign.Extension)' == '.jar'" />
+    <Copy SourceFiles="%(FilesToSign.Identity)" DestinationFiles="$(ArtifactsDir)Signed\VSIX\%(FilesToSign.Filename)%(FilesToSign.Extension)" Condition="'%(FilesToSign.Extension)' == '.vsix'" />
+    <Copy SourceFiles="%(FilesToSign.Identity)" DestinationFiles="$(ArtifactsDir)Signed\SharedFx\%(FilesToSign.Filename)%(FilesToSign.Extension)" Condition="'%(FilesToSign.Extension)' == '.zip'" />
+  </Target>
+
+</Project>
\ No newline at end of file
diff --git a/dockerbuild.sh b/dockerbuild.sh
index ccc55b8852..20df1a5c39 100755
--- a/dockerbuild.sh
+++ b/dockerbuild.sh
@@ -104,6 +104,15 @@ docker run \
     -e TEAMCITY_VERSION \
     -e DOTNET_CLI_TELEMETRY_OPTOUT \
     -e Configuration \
+    -e PB_RESTORESOURCE \
+    -e PB_PUBLISHBLOBFEEDURL \
+    -e PB_PUBLISHTYPE \
+    -e PB_SKIPTESTS \
+    -e PB_ISFINALBUILD \
+    -e PB_ACCESSTOKENSUFFIX \
+    -e PB_PACKAGEVERSIONPROPSURL\
+    -e PB_ASSETROOTURL \
+    -e PRODUCTBUILDID \
     -v "$DIR:/code/build" \
     ${docker_args[@]+"${docker_args[@]}"} \
     $tagname \
diff --git a/korebuild-lock.txt b/korebuild-lock.txt
index a9440d2de0..97dcf4e343 100644
--- a/korebuild-lock.txt
+++ b/korebuild-lock.txt
@@ -1,2 +1,2 @@
-version:2.1.7-build-20201119.1
-commithash:8212674c2abff7b51f99422c9bdb1a81b90d9dc1
+version:2.1.7-build-20201218.2
+commithash:26d5fca2ed53577d072f0c7a00c188a2fe826f7f
diff --git a/run.ps1 b/run.ps1
index 31aba9f045..914fd98bf6 100644
--- a/run.ps1
+++ b/run.ps1
@@ -94,8 +94,8 @@ param(
     [string]$ConfigFile = $null,
     [switch]$CI,
     [string]$Projects,
-    [string]$PackageVersionPropsUrl = $null,
-    [string]$AccessTokenSuffix = $null,
+    [string]$PackageVersionPropsUrl = $env:PB_PackageVersionPropsUrl,
+    [string]$AccessTokenSuffix = $env:PB_AccessTokenSuffix,
     [string]$RestoreSources = $null,
     [string]$AssetRootUrl = $null,
     [string]$ProductBuildId = $null,
@@ -218,28 +218,18 @@ if (!$LockFile) { $LockFile = Join-Path $Path 'korebuild-lock.txt' }
 if (!$Channel) { $Channel = 'master' }
 if (!$ToolsSource) { $ToolsSource = 'https://aspnetcore.blob.core.windows.net/buildtools' }
 
+[string[]] $ProdConArgs = @()
+
 if ($PackageVersionPropsUrl) {
     $IntermediateDir = Join-Path $PSScriptRoot 'obj'
     $PropsFilePath = Join-Path $IntermediateDir 'external-dependencies.props'
     New-Item -ItemType Directory $IntermediateDir -ErrorAction Ignore | Out-Null
     Get-RemoteFile "${PackageVersionPropsUrl}${AccessTokenSuffix}" $PropsFilePath
-    $MSBuildArguments += "-p:DotNetPackageVersionPropsPath=$PropsFilePath"
-}
-
-if ($RestoreSources) {
-    $MSBuildArguments += "-p:DotNetAdditionalRestoreSources=$RestoreSources"
-}
-
-if ($AssetRootUrl) {
-    $MSBuildArguments += "-p:DotNetAssetRootUrl=$AssetRootUrl"
+    $ProdConArgs += "-p:DotNetPackageVersionPropsPath=$PropsFilePath"
 }
 
 if ($AccessTokenSuffix) {
-    $MSBuildArguments += "-p:DotNetAssetRootAccessTokenSuffix=$AccessTokenSuffix"
-}
-
-if ($ProductBuildId) {
-    $MSBuildArguments += "-p:DotNetProductBuildId=$ProductBuildId"
+    $ProdConArgs += "-p:DotNetAssetRootAccessTokenSuffix=$AccessTokenSuffix"
 }
 
 if ($Projects) {
@@ -247,6 +237,17 @@ if ($Projects) {
     $MSBuildArguments += "-p:_ProjectsOnly=true"
 }
 
+# PipeBuild parameters
+$ProdConArgs += "-p:DotNetAssetRootUrl=${env:PB_AssetRootUrl}"
+$ProdConArgs += "-p:DotNetAdditionalRestoreSources=${env:PB_RestoreSource}"
+$ProdConArgs += "-p:DotNetProductBuildId=${env:ProductBuildId}"
+$ProdConArgs += "-p:PublishBlobFeedUrl=${env:PB_PublishBlobFeedUrl}"
+$ProdConArgs += "-p:PublishType=${env:PB_PublishType}"
+$ProdConArgs += "-p:SkipTests=${env:PB_SkipTests}"
+$ProdConArgs += "-p:IsFinalBuild=${env:PB_IsFinalBuild}"
+$ProdConArgs += "-p:SignType=${env:PB_SignType}"
+$ProdConArgs += "-p:PublishBlobFeedKey=${env:PB_PublishBlobFeedKey}"
+
 # Execute
 
 $korebuildPath = Get-KoreBuild
@@ -254,7 +255,7 @@ Import-Module -Force -Scope Local (Join-Path $korebuildPath 'KoreBuild.psd1')
 
 try {
     Set-KoreBuildSettings -ToolsSource $ToolsSource -DotNetHome $DotNetHome -RepoPath $Path -ConfigFile $ConfigFile -CI:$CI
-    Invoke-KoreBuildCommand $Command @MSBuildArguments
+    Invoke-KoreBuildCommand $Command @ProdConArgs @MSBuildArguments
 }
 finally {
     Remove-Module 'KoreBuild' -ErrorAction Ignore
diff --git a/run.sh b/run.sh
index cfc0a36904..8c12899e90 100755
--- a/run.sh
+++ b/run.sh
@@ -19,11 +19,9 @@ lockfile_path=''
 channel=''
 tools_source=''
 ci=false
-package_version_props_url=''
-asset_root_url=''
-access_token_suffix=''
-restore_sources=''
-product_build_id=''
+package_version_props_url="${PB_PACKAGEVERSIONPROPSURL:-}"
+asset_root_url="${PB_ASSETROOTURL:-}"
+product_build_id="${PRODUCTBUILDID:-}"
 msbuild_args=()
 
 #
@@ -193,30 +191,6 @@ while [[ $# -gt 0 ]]; do
             [ -z "${1+x}" ] && __error "Missing value for parameter --package-version-props-url" && __usage
             package_version_props_url="$1"
             ;;
-        --access-token-suffix|-AccessTokenSuffix)
-            shift
-            # This parameter can be an empty string, but it should be set
-            [ -z "${1+x}" ] && __error "Missing value for parameter --access-token-suffix" && __usage
-            access_token_suffix="$1"
-            ;;
-        --restore-sources|-RestoreSources)
-            shift
-            # This parameter can be an empty string, but it should be set
-            [ -z "${1+x}" ] && __error "Missing value for parameter --restore-sources" && __usage
-            restore_sources="$1"
-            ;;
-        --asset-root-url|-AssetRootUrl)
-            shift
-            # This parameter can be an empty string, but it should be set
-            [ -z "${1+x}" ] && __error "Missing value for parameter --asset-root-url" && __usage
-            asset_root_url="$1"
-            ;;
-        --product-build-id|-ProductBuildId)
-            shift
-            # This parameter can be an empty string, but it should be set
-            [ -z "${1+x}" ] && __error "Missing value for parameter --product-build-id" && __usage
-            product_build_id="$1"
-            ;;
         -u|--update|-Update)
             update=true
             ;;
@@ -278,30 +252,32 @@ fi
 
 [ -z "${DOTNET_HOME:-}" ] && DOTNET_HOME="$HOME/.dotnet"
 
+prodcon_args=()
+
 if [ ! -z "$package_version_props_url" ]; then
     intermediate_dir="$repo_path/obj"
     props_file_path="$intermediate_dir/external-dependencies.props"
     mkdir -p "$intermediate_dir"
-    __get_remote_file "$package_version_props_url" "$props_file_path"
-    msbuild_args[${#msbuild_args[*]}]="-p:DotNetPackageVersionPropsPath=$props_file_path"
-fi
-
-if [ ! -z "$restore_sources" ]; then
-    msbuild_args[${#msbuild_args[*]}]="-p:DotNetAdditionalRestoreSources=$restore_sources"
+    __get_remote_file "$package_version_props_url" "$props_file_path" "${PB_ACCESSTOKENSUFFIX:-}"
+    prodcon_args[${#prodcon_args[*]}]="-p:DotNetPackageVersionPropsPath=$props_file_path"
 fi
 
 if [ ! -z "$asset_root_url" ]; then
-    msbuild_args[${#msbuild_args[*]}]="-p:DotNetAssetRootUrl=$asset_root_url"
-fi
-
-if [ ! -z "$access_token_suffix" ]; then
-    msbuild_args[${#msbuild_args[*]}]="-p:DotNetAssetRootAccessTokenSuffix=$access_token_suffix"
+    prodcon_args[${#prodcon_args[*]}]="-p:DotNetAssetRootUrl=$asset_root_url"
 fi
 
 if [ ! -z "$product_build_id" ]; then
-    msbuild_args[${#msbuild_args[*]}]="-p:DotNetProductBuildId=$product_build_id"
+    prodcon_args[${#prodcon_args[*]}]="-p:DotNetProductBuildId=$product_build_id"
 fi
 
+# PipeBuild parameters
+prodcon_args[${#prodcon_args[*]}]="-p:DotNetAdditionalRestoreSources=${PB_RESTORESOURCE:-}"
+prodcon_args[${#prodcon_args[*]}]="-p:PublishBlobFeedUrl=${PB_PUBLISHBLOBFEEDURL:-}"
+prodcon_args[${#prodcon_args[*]}]="-p:PublishType=${PB_PUBLISHTYPE:-}"
+prodcon_args[${#prodcon_args[*]}]="-p:SkipTests=${PB_SKIPTESTS:-}"
+prodcon_args[${#prodcon_args[*]}]="-p:IsFinalBuild=${PB_ISFINALBUILD:-}"
+prodcon_args[${#prodcon_args[*]}]="-p:DotNetAssetRootAccessTokenSuffix=${PB_ACCESSTOKENSUFFIX:-}"
+
 [ -z "$lockfile_path" ] && lockfile_path="$repo_path/korebuild-lock.txt"
 [ -z "$channel" ] && channel='master'
 [ -z "$tools_source" ] && tools_source='https://aspnetcore.blob.core.windows.net/buildtools'
@@ -311,4 +287,4 @@ set_korebuildsettings "$tools_source" "$DOTNET_HOME" "$repo_path" "$config_file"
 
 # This incantation avoids unbound variable issues if msbuild_args is empty
 # https://stackoverflow.com/questions/7577052/bash-empty-array-expansion-with-set-u
-invoke_korebuild_command "$command" ${msbuild_args[@]+"${msbuild_args[@]}"}
+invoke_korebuild_command "$command" "${prodcon_args[@]}" ${msbuild_args[@]+"${msbuild_args[@]}"}
diff --git a/src/Installers/Windows/AspNetCoreModule-Setup/build/settings/common.props b/src/Installers/Windows/AspNetCoreModule-Setup/build/settings/common.props
index 3dfffe943f..69fb5502a5 100644
--- a/src/Installers/Windows/AspNetCoreModule-Setup/build/settings/common.props
+++ b/src/Installers/Windows/AspNetCoreModule-Setup/build/settings/common.props
@@ -16,8 +16,8 @@
     <IisOobWinSdkVersion Condition="'$(IisOobWinSdkVersion)' == ''">10.0.17134.0</IisOobWinSdkVersion>
     <WindowsTargetPlatformVersion Condition="'$(WindowsTargetPlatformVersion)' == ''">$(IisOobWinSdkVersion)</WindowsTargetPlatformVersion>
     <CharacterSet>Unicode</CharacterSet>
-    <OutDir>bin\$(Configuration)\$(PlatformShortname)\</OutDir>
-    <IntDir>obj\$(Configuration)\$(PlatformShortname)\</IntDir>
+    <OutDir Condition=" '$(OutDir)' == '' ">bin\$(Configuration)\$(PlatformShortname)\</OutDir>
+    <IntDir Condition=" '$(IntDir)' == '' ">obj\$(Configuration)\$(PlatformShortname)\</IntDir>
   </PropertyGroup>
 
   <!--
diff --git a/src/Installers/Windows/WindowsInstallers.proj b/src/Installers/Windows/WindowsInstallers.proj
index ed47388b68..e0c1a5068e 100644
--- a/src/Installers/Windows/WindowsInstallers.proj
+++ b/src/Installers/Windows/WindowsInstallers.proj
@@ -19,7 +19,7 @@
 
   </ItemGroup>
 
-  <Target Name="Build">
+  <Target Name="Build" DependsOnTargets="UnzipSharedFx">
     <MSBuild Projects="@(InstallerProject)" Targets="Build" />
   </Target>
 
@@ -32,4 +32,28 @@
     <MSBuild Projects="@(InstallerProject)" Targets="Restore" />
   </Target>
 
-</Project>
+  <Target Name="UnzipSharedFx">
+    <Message Text="Unzipping x64 SharedFx to $(SharedFrameworkHarvestRootPath)x64" Importance="High" />
+
+    <ItemGroup>
+      <x64Archive Include="$(SharedFxDepsRoot)aspnetcore-runtime-internal-*-win-x64.zip" />
+      <x86Archive Include="$(SharedFxDepsRoot)aspnetcore-runtime-internal-*-win-x86.zip" />
+    </ItemGroup>
+
+    <!-- We don't import version files here, so unzip whatever internal archives are in the .deps folder -->
+    <Unzip
+      SourceFiles="@(x64Archive)"
+      DestinationFolder="$(SharedFrameworkHarvestRootPath)x64"
+      Condition="!Exists('$(SharedFrameworkHarvestRootPath)x64/shared/')"
+    />
+
+    <Message Text="Unzipping x86 SharedFx to $(SharedFrameworkHarvestRootPath)x86" Importance="High" />
+
+    <Unzip
+      SourceFiles="@(x86Archive)"
+      DestinationFolder="$(SharedFrameworkHarvestRootPath)x86"
+      Condition="!Exists('$(SharedFrameworkHarvestRootPath)x86/shared/')"
+    />
+  </Target>
+
+</Project>
\ No newline at end of file
diff --git a/src/Installers/Windows/Wix.props b/src/Installers/Windows/Wix.props
index 7dcf66b5d9..c3846a9386 100644
--- a/src/Installers/Windows/Wix.props
+++ b/src/Installers/Windows/Wix.props
@@ -1,7 +1,13 @@
 <Project>
 
   <PropertyGroup>
-    <Version>$(AspNetCoreMajorVersion).$(AspNetCoreMinorVersion).$(AspNetCorePatchVersion).$(BuildNumber)</Version>
+    <!-- Ugly hack - Wix doesn't accept build numbers larger than 65535, and AzDo's BuildIds are larger than that.
+         The largest we ever got on TeamCity was 31363, so we want to be in the range of 31364 - 65535. To achieve this we take the
+         AzDO build number modulo 34172 (65545 - 31363 = 34172), and add 31364 to that to give us a number in the desired range. -->
+    <InstallerBuildNumber>$(BuildNumber)</InstallerBuildNumber>
+    <InstallerBuildNumberModulo Condition="'$(BuildNumber)' != 't000'">$([MSBuild]::Modulo($(BuildNumber), 34172))</InstallerBuildNumberModulo>
+    <InstallerBuildNumber Condition="'$(BuildNumber)' != 't000'">$([MSBuild]::Add($(InstallerBuildNumberModulo), 31364))</InstallerBuildNumber>
+    <Version>$(AspNetCoreMajorVersion).$(AspNetCoreMinorVersion).$(AspNetCorePatchVersion).$(InstallerBuildNumber)</Version>
     <Configuration Condition="'$(Configuration)' == ''">Release</Configuration>
     <Platform Condition="'$(Platform)' == ''">x64</Platform>
     <Lang Condition="'$(Lang)' == ''">ENU</Lang>
@@ -35,4 +41,4 @@
     <GenerateNupkgPowershellScript>$(RepositoryRoot)\src\Installers\Windows\GenerateNugetPackageWithMsi.ps1</GenerateNupkgPowershellScript>
   </PropertyGroup>
 
-</Project>
+</Project>
\ No newline at end of file
diff --git a/src/Installers/Windows/build.ps1 b/src/Installers/Windows/build.ps1
index f8df1c7192..8513a083fd 100644
--- a/src/Installers/Windows/build.ps1
+++ b/src/Installers/Windows/build.ps1
@@ -6,18 +6,9 @@
 [cmdletbinding()]
 param(
     [string]$Configuration = 'Debug',
-    [Parameter(Mandatory = $true)]
-    [Alias("x86")]
-    [string]$Runtime86Zip,
-    [Parameter(Mandatory = $true)]
-    [Alias("x64")]
-    [string]$Runtime64Zip,
     [string]$BuildNumber = 't000',
-    [switch]$IsFinalBuild,
-    [string]$SignType = '',
-    [string]$PackageVersionPropsUrl = $null,
+    [string]$PackageVersionPropsUrl = $env:PB_PackageVersionPropsUrl,
     [string]$AccessTokenSuffix = $null,
-    [string]$AssetRootUrl = $null,
     [switch]$clean
 )
 
@@ -27,20 +18,13 @@ Import-Module -Scope Local "$repoRoot/scripts/common.psm1" -Force
 $msbuild = Get-MSBuildPath -Prerelease -requires 'Microsoft.VisualStudio.Component.VC.Tools.x86.x64'
 
 $harvestRoot = "$repoRoot/obj/sfx/"
+$sharedFxDepsRoot = "$repoRoot/.deps/fx/"
 if ($clean) {
     Remove-Item -Recurse -Force $harvestRoot -ErrorAction Ignore | Out-Null
 }
 
 New-Item "$harvestRoot/x86", "$harvestRoot/x64" -ItemType Directory -ErrorAction Ignore | Out-Null
 
-if (-not (Test-Path "$harvestRoot/x86/shared/")) {
-    Expand-Archive $Runtime86Zip -DestinationPath "$harvestRoot/x86"
-}
-
-if (-not (Test-Path "$harvestRoot/x64/shared/")) {
-    Expand-Archive $Runtime64Zip -DestinationPath "$harvestRoot/x64"
-}
-
 Push-Location $PSScriptRoot
 try {
     Invoke-Block { & $msbuild `
@@ -56,14 +40,15 @@ try {
 
     [string[]] $msbuildArgs = @()
 
+    # PipeBuild parameters
+    $msbuildArgs += "-p:SignType=${env:PB_SignType}"
+    $msbuildArgs += "-p:DotNetAssetRootUrl=${env:PB_AssetRootUrl}"
+    $msbuildArgs += "-p:IsFinalBuild=${env:PB_IsFinalBuild}"
+
     if ($clean) {
         $msbuildArgs += '-t:Clean'
     }
 
-    if ($AssetRootUrl) {
-        $msbuildArgs += "-p:DotNetAssetRootUrl=$AssetRootUrl"
-    }
-
     if ($AccessTokenSuffix) {
         $msbuildArgs += "-p:DotNetAccessTokenSuffix=$AccessTokenSuffix"
     }
@@ -87,10 +72,9 @@ try {
             -nodeReuse:false `
             -clp:Summary `
             "-p:SharedFrameworkHarvestRootPath=$repoRoot/obj/sfx/" `
+            "-p:SharedFxDepsRoot=$sharedFxDepsRoot" `
             "-p:Configuration=$Configuration" `
             "-p:BuildNumber=$BuildNumber" `
-            "-p:SignType=$SignType" `
-            "-p:IsFinalBuild=$IsFinalBuild" `
             "-bl:$repoRoot/artifacts/logs/installers.msbuild.binlog" `
             @msbuildArgs
     }