Add Linux RPM packaging to the official pipeline

[Mike Krüger (mkrueger)]

Purpose

This PR adds small, framework-dependent RPM packages for internal Azure Cloud Shell deployment. They may also be useful in controlled CI environments that already provide the required runtime.

These RPMs are not intended as a general-purpose Linux distribution channel. Public/general installation should continue to use the supported distribution mechanisms documented by the project.

Packaging

• builds x86_64 and aarch64 RPMs in the official pipeline
• requires the preinstalled .NET 10 runtime (dotnet-runtime-10.0)
• installs the launcher as /usr/bin/cosmosdbshell
• publishes the RPMs in the dedicated cosmos_shell_rpm artifact
• validates architecture, runtime dependency, payload layout, and the Azure Cloud Shell 25 MB package limit
• produces packages of approximately 9 MB each in the attached build artifact ZIP

Native MSAL runtime tradeoff

The RPM publish intentionally removes libmsalruntime.so. That native library is available only for linux-x64, would roughly double that package's size, and has no linux-arm64 equivalent.

Without libmsalruntime.so, VisualStudioCodeCredential and its native MSAL broker flow do not work in these RPM builds. Other authentication paths remain available, including account keys, static tokens, managed identity, Azure CLI, browser/device-code flows, and the remaining DefaultAzureCredential chain.

The implementation makes this limitation explicit rather than relying on a runtime failure:

• the RPM build sets CosmosDBShellExcludeMsalRuntime=true
• that defines COSMOSDBSHELL_NO_MSAL_RUNTIME at compile time
• the shell reports that VS Code credential authentication is unavailable in this build
• authentication then continues through the existing fallback chain
• Azure CLI authentication remains a deterministic option for Azure Cloud Shell, avoiding accidental selection of the Cloud Shell managed identity when the signed-in user identity is intended
• tests verify that VS Code credential capability matches the build configuration
• pipeline validation fails if libmsalruntime.so is accidentally included

Validation

• Release application and test-project builds complete without warnings or errors
• normal and RPM-capability connect tests pass
• localization tests pass
• RPM publish validation confirms the final payload does not contain libmsalruntime.so
• current PR checks are green, including offline and emulator integration tests, packaging, and CodeQL

[Copilot]

Pull request overview

Adds first-class RPM packaging support to the official OneBranch pipeline so the CosmosDBShell CLI can be installed on RPM-based Linux distributions (including Azure Linux) via a framework-dependent RPM that depends on the preinstalled .NET 10 runtime.

Changes:

• Adds a governed Linux pipeline job that publishes x86_64 and aarch64 framework-dependent builds and packages them as compressed RPMs, with size/dependency/path validation.
• Introduces an RPM spec (cosmosdbshell.spec) that installs the binary under /usr/libexec and exposes /usr/bin/cosmosdbshell via a symlink.
• Documents RPM installation and records the packaging change in the changelog.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
README.md	Documents installing CosmosDBShell via the pipeline-produced RPM artifacts.
packaging/rpm/cosmosdbshell.spec	Defines the RPM layout, runtime dependency, and installed file list.
CHANGELOG.md	Notes the new official RPM outputs and Cloud Shell size-limit validation.
.pipelines/CosmosDB-Shell-Official.yml	Adds a new governed Linux job to build, validate, and publish RPM artifacts.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-code-quality]

Code Coverage Overview

Languages: C#

C# / code-coverage/dotnet

The overall line coverage in commit 3c72b0f in the dev/mkrueger/linux-r... branch remains at 62%, unchanged from commit 0d21834 in the main branch.

---

_{Updated August 27, 2026 10:07 UTC}

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

README.md:80

• The install example uses dnf, but Azure Linux (called out in the text) typically uses tdnf (and the official pipeline installs RPM tooling via tdnf). As written, the command is likely to fail on the primary target distro; consider documenting both tdnf (Azure Linux / Cloud Shell) and dnf (other RPM distros).

sudo dnf install ./cosmosdbshell-<version>-<release>.<architecture>.rpm
cosmosdbshell

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

README.md:77

• The README implies these RPM artifacts can be installed on “other RPM-based distributions” with dnf, but the package has a hard dependency on dotnet-runtime-10.0 (from Microsoft’s RPM feeds / packages.microsoft.com). On distros without that repo configured, dnf install will fail even if the .NET runtime was installed by other means. Consider clarifying the prerequisite (Microsoft .NET RPM repo enabled) so the installation steps are actionable.

The official pipeline produces framework-dependent RPMs for Azure Linux and
other RPM-based distributions:

- `cosmosdbshell-<version>-<release>.x86_64.rpm`
- `cosmosdbshell-<version>-<release>.aarch64.rpm`

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.