Question

Your team's Azure DevOps pipeline signs a mobile app using a code-signing certificate (.p12) and an Apple provisioning profile. Currently a developer commits these binary files into the repository and the pipeline reads them directly. A security audit flagged this as a leakage risk. You must store the certificate and profile so that they are encrypted at rest, never checked into source control, and only usable by explicitly authorized pipelines. Which Azure DevOps feature should you use?

Accepted Answer

Upload the files to the Secure files section of the Library and reference them with the DownloadSecureFile task, protecting them with a pipeline authorization/approval check.

Answer

Add the base64-encoded contents of both files as secret variables in a variable group and decode them at runtime.

Answer

Store the files in an Azure Storage account and generate a SAS token that the pipeline uses to download them.

Answer

Commit the files to a separate private Git repository and check it out during the build using a PAT.