Skip to content

Sign Microsoft.Installation library package #51488

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Nov 3, 2025
+62 −2
Merged

Sign Microsoft.Installation library package #51488

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f637eda
Add signing to `dnup` library package using `SignTool`
nagilson Oct 31, 2025
703cef4
remove extraneous leftover build step
nagilson Oct 31, 2025
26c8a18
remove unneeded property group
nagilson Oct 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions eng/pipelines/templates/jobs/dnup/dnup-library-package.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,6 @@ jobs:
targetPath: '$(Build.SourcesDirectory)/artifacts/packages/Release/NonShipping/'
artifactName: 'dnup-library-packages'
publishLocation: Container

steps:
- ${{ if eq(parameters.pool.os, 'windows') }}:
- powershell: |
Expand All @@ -54,5 +53,8 @@ jobs:
& .\.dotnet\dotnet build test\dnup.Tests\dnup.Tests.csproj -c Release
displayName: 💻 Build Windows
- powershell: |
& .\.dotnet\dotnet pack .\src\Installer\Microsoft.Dotnet.Installation\Microsoft.Dotnet.Installation.csproj
& .\.dotnet\dotnet pack .\src\Installer\Microsoft.Dotnet.Installation\Microsoft.Dotnet.Installation.csproj
displayName: 📦 Package dnup library
- powershell: |
& .\.dotnet\dotnet build .\src\Installer\Microsoft.Dotnet.Installation\Microsoft.Dotnet.Installation.sign.proj /t:Sign
displayName: 🖋️ Sign dnup library packages with arcade signtool
58 changes: 58 additions & 0 deletions src/Installer/Microsoft.Dotnet.Installation/Microsoft.Dotnet.Installation.sign.proj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<TargetFramework>net10.0</TargetFramework>
<!-- Determine repository root when the pipeline variables are unavailable (e.g. local invocations). -->
<_RepoRoot Condition="'$(RepoRoot)' != ''">$(RepoRoot)</_RepoRoot>
<_RepoRoot Condition="'$(_RepoRoot)' == ''">$([System.IO.Path]::GetFullPath('$(MSBuildThisFileDirectory)..\..\..\'))</_RepoRoot>
Comment on lines +5 to +6
Copy link
Member

@dsplaisted dsplaisted Oct 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this necessary here? Isn't it set via the Arcade SDK which Directory.Build.props brings in?

If not, then this is probably a bit better (from Arcade):

<RepoRoot Condition="'$(RepoRoot)' == ''">$([MSBuild]::NormalizeDirectory('$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), 'global.json'))'))</RepoRoot>

Copy link
Member Author

@nagilson nagilson Nov 3, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree - this is definitely an improvement. Thanks! It looks like some of the dirs don't populate properly without this - let's improve this in the publishing step so we can move forward.


<!-- Allow callers to override these directories; fall back to repo-relative defaults. -->
<PackagesDir Condition="'$(PackagesDir)' == ''">$(_RepoRoot)artifacts\packages\Release\</PackagesDir>
<IntermediateOutputPath Condition="'$(IntermediateOutputPath)' == ''">$(_RepoRoot)artifacts\obj\Sign\</IntermediateOutputPath>
<LogDir Condition="'$(LogDir)' == ''">$(_RepoRoot)artifacts\log\Sign\</LogDir>

<!-- SignTool requires explicit dotnet path; default to repo-local SDK. -->
<DotNetPath Condition="'$(DotNetPath)' == ''">$(_RepoRoot).dotnet\dotnet.exe</DotNetPath>

<MicroBuild_DoNotStrongNameSign>true</MicroBuild_DoNotStrongNameSign>
<MicroBuild_SigningEnabled>true</MicroBuild_SigningEnabled>
</PropertyGroup>

<Import Project="$(NuGetPackageRoot)microsoft.dotnet.signtool\$(MicrosoftDotNetSignToolVersion)\build\Microsoft.DotNet.SignTool.props" />

<ItemGroup>
<FileExtensionSignInfo Include=".nupkg" CertificateName="NuGet" />
<FileExtensionSignInfo Include=".dll" CertificateName="Microsoft400" />
<FileSignInfo Include="Microsoft.Dotnet.Installation.dll" CertificateName="Microsoft400" />
<FileSignInfo Include="Microsoft.Dotnet.Installation*.nupkg" CertificateName="NuGet" />
<ItemsToSign Include="$(PackagesDir)**\Microsoft.Dotnet.Installation*.nupkg">
<Authenticode>NuGet</Authenticode>
</ItemsToSign>
</ItemGroup>

<PropertyGroup Condition="'$(SignType)' == ''">
<SignType>test</SignType>
<TestSign>true</TestSign>
</PropertyGroup>

<PropertyGroup Condition="'$(TestSign)' == ''">
<TestSign>false</TestSign>
</PropertyGroup>


<Target Name="Sign" AfterTargets="Build">
<Microsoft.DotNet.SignTool.SignToolTask
DryRun="false"
TestSign="$(TestSign)"
ItemsToSign="@(ItemsToSign)"
FileSignInfo="@(FileSignInfo)"
FileExtensionSignInfo="@(FileExtensionSignInfo)"
TempDir="$(IntermediateOutputPath)"
LogDir="$(LogDir)"
DoStrongNameCheck="false"
DotNetPath="$(DotNetPath)"
MicroBuildCorePath="$(NuGetPackageRoot)microsoft.visualstudioeng.microbuild.core\$(MicrosoftVisualStudioEngMicroBuildCoreVersion)"
SNBinaryPath="$(NuGetPackageRoot)sn\$(SNVersion)\sn.exe"
>
</Microsoft.DotNet.SignTool.SignToolTask>
</Target>
</Project>