Skip to content

Commit 979736d

Browse files
natemcmasternatemcmaster
authored
MicroBuild code signing (#821)
This backports changes made in the 2.2 build tools. This is anticipation of Arcade convergence. We already stopped using signrequest.xml in other parts of the stack. New tools replace this functionality. * Backport implementation of Arcade code signing * Remove sign request generation and validation * Sign .Sources packages by default * Use built-in dotnet-tool shim generation
1 parent 3965b17 commit 979736d

File tree

55 files changed

+406
-1083
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+406
-1083
lines changed

Diff for: ‎Directory.Build.props

+1-2
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,7 @@
1212
<GenerateSourceLinkFile>false</GenerateSourceLinkFile>
1313
<GenerateAssemblyFileVersionAttribute>false</GenerateAssemblyFileVersionAttribute>
1414
<EnableApiCheck>false</EnableApiCheck>
15-
<!-- workaround https://github.com/aspnet/CoreCLR/issues/223 -->
16-
<NoWarn>$(NoWarn);NU1603</NoWarn>
15+
<NoWarn>$(NoWarn);NU5105</NoWarn>
1716
<Serviceable>false</Serviceable>
1817
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
1918
<SuppressNETCoreSdkPreviewMessage>true</SuppressNETCoreSdkPreviewMessage>

Diff for: ‎README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,11 @@ See [docs/README.md](./docs/README.md).
1313

1414
Channel | Latest Build
1515
---------------|:---------------
16-
dev | ![badge][dev-badge]
16+
master | ![badge][master-badge]
1717
release/2.1 | ![badge][rel-2.1-badge]
1818
release/2.0 | ![badge][rel-2.0-badge]
1919

20-
[dev-badge]: https://aspnetcore.blob.core.windows.net/buildtools/korebuild/channels/dev/badge.svg
20+
[master-badge]: https://aspnetcore.blob.core.windows.net/buildtools/korebuild/channels/master/badge.svg
2121
[rel-2.1-badge]: https://aspnetcore.blob.core.windows.net/buildtools/korebuild/channels/release/2.1/badge.svg
2222
[rel-2.0-badge]: https://aspnetcore.blob.core.windows.net/buildtools/korebuild/channels/release/2.0/badge.svg
2323

Diff for: ‎build/dependencies.props

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
<Project>
22
<PropertyGroup>
33
<HtmlAgilityPackPackageVersion>1.5.1</HtmlAgilityPackPackageVersion>
4+
<MicroBuildCorePackageVersion>0.3.0</MicroBuildCorePackageVersion>
45
<MicrosoftDotNetPlatformAbstractionsVersion>2.0.0</MicrosoftDotNetPlatformAbstractionsVersion>
5-
<MicrosoftNETTestSdkPackageVersion>15.6.1</MicrosoftNETTestSdkPackageVersion>
6+
<MicrosoftDotNetSignToolPackageVersion>1.0.0-beta.18515.2</MicrosoftDotNetSignToolPackageVersion>
7+
<MicrosoftNETTestSdkPackageVersion>15.9.0</MicrosoftNETTestSdkPackageVersion>
68
<MicrosoftWin32RegistryPackageVersion>4.4.0</MicrosoftWin32RegistryPackageVersion>
79
<MonoCecilPackageVersion>0.10.0-beta6</MonoCecilPackageVersion>
810
<MoqPackageVersion>4.7.99</MoqPackageVersion>

Diff for: ‎build/sources.props

+1-3
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,7 @@
55
<RestoreSources>$(DotNetRestoreSources)</RestoreSources>
66
<RestoreSources Condition="'$(DotNetBuildOffline)' != 'true'">
77
$(RestoreSources);
8-
https://dotnet.myget.org/F/dotnet-core/api/v3/index.json;
9-
https://dotnet.myget.org/F/nuget-build/api/v3/index.json;
10-
https://dotnet.myget.org/F/msbuild/api/v3/index.json;
8+
https://dotnetfeed.blob.core.windows.net/dotnet-core/index.json;
119
https://api.nuget.org/v3/index.json;
1210
</RestoreSources>
1311
</PropertyGroup>

Diff for: ‎docs/Signing.md

+23-93
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,7 @@
11
Signing
22
=======
33

4-
KoreBuild supports generating a signing request manfiest. This includes a list of all files that should be signed
5-
and information about the strongname or certificate that should be used.
6-
7-
## Format
8-
9-
The signing request manifest supports three element types. A minimal example looks like this. See [Elements](#Elements) below for details
10-
11-
```xml
12-
<SigningRequest>
13-
<File Path="MyAssembly.dll" Certificate="MyCert" StrongName="MyStrongName" />
14-
<File Path="build/Another.dll" Certificate="MyCert" />
15-
<Container Path="MyLib.1.0.0.nupkg" Type="nupkg" Certificate="NuGetCert">
16-
<File Path="lib/netstandard2.0/MyLib.dll" Certificate="MyCert" />
17-
</Container>
18-
<Container Path="MyVSTool.vsix" Type="vsix" Certificate="VsixCert">
19-
<File Path="MyVSTool.dll" Certificate="MyCert" />
20-
<!-- excluded from signing, but useful if you want to assert all files in a container are accounted for. -->
21-
<ExcludedFile Path="NotMyLib.dll" />
22-
</Container>
23-
</SigningRequest>
24-
```
4+
KoreBuild supports code signing files and using MSBuild to configure the list of files which are code-signed.
255

266
## Config via csproj
277

@@ -38,51 +18,38 @@ To sign assemblies, set the AssemblySigningCertName and AssemblySigningStrongNam
3818
</PropertyGroup>
3919
```
4020

41-
This will generate a signing request like this:
42-
43-
```xml
44-
<SigningRequest>
45-
<File Path="MyLib.dll" Certificate="MyCert" StrongName="PrivateStrongName" />
46-
</SigningRequest>
47-
```
48-
4921
### NuGet packages
5022

5123
To sign NuGet packages, set the PackageSigningCertName property in the \*.csproj that produces the nupkg.
5224

5325
```xml
5426
<PropertyGroup>
55-
<PackageSigningCertName>NuGetCert</PackageSigningCertName>
27+
<PackageSigningCertName>MyNuGetCert</PackageSigningCertName>
5628
</PropertyGroup>
5729
```
5830

59-
This will generate a signing request like this:
60-
61-
```xml
62-
<SigningRequest>
63-
<Container Path="MyLib.1.0.0.nupkg" Type="nupkg" Certificate="NuGetCert" />
64-
</SigningRequest>
65-
```
66-
6731
### NuGet packages with assemblies
6832

6933
For assemblies that ship in a NuGet package, you can specify multiple properties.
7034

7135
```xml
7236
<PropertyGroup>
7337
<AssemblySigningCertName>MyCert</AssemblySigningCertName>
74-
<PackageSigningCertName>NuGetCert</PackageSigningCertName>
38+
<PackageSigningCertName>MyNuGetCert</PackageSigningCertName>
7539
</PropertyGroup>
7640
```
7741

78-
This will generate a signing request like this:
42+
### Recommended cert names for Microsoft projects
43+
44+
The following certificate names should be used for Microsoft projects. These MSBuild properties are also available by using Internal.AspNetCore.SDK.
7945

8046
```xml
81-
<SigningRequest>
82-
<Container Path="MyLib.1.0.0.nupkg" Type="nupkg" Certificate="NuGetCert">
83-
<File Path="lib/netstandard2.0/MyLib.dll" Certificate="MyCert" />
84-
</Container>
85-
</SigningRequest>
47+
<AssemblySigningCertName>Microsoft400</AssemblySigningCertName>
48+
<AssemblySigning3rdPartyCertName>3PartySHA2</AssemblySigning3rdPartyCertName>
49+
<PowerShellSigningCertName>Microsoft400</PowerShellSigningCertName>
50+
<PackageSigningCertName>NuGet</PackageSigningCertName>
51+
<VsixSigningCertName>VsixSHA2</VsixSigningCertName>
52+
<JarSigningCertName>MicrosoftJAR</JarSigningCertName>
8653
```
8754

8855
### Projects using nuspec
@@ -108,20 +75,24 @@ Sometimes other signable assemblies end up in a nupkg. Signing for these file ty
10875

10976
```xml
11077
<ItemGroup>
111-
<!-- Files that come from other ASP.NET Core projects -->
112-
<SignedPackageFile Include="$(PublishDir)Microsoft.Extensions.Configuration.Abstractions.dll" Certificate="$(AssemblySigningCertName)" PackagePath="tools/Microsoft.Extensions.Configuration.Abstractions.dll" Visible="false" />
78+
<!-- Specifying signing for a file in a package. -->
79+
<SignedPackageFile Include="tools/Microsoft.Extensions.Configuration.Abstractions.dll" Certificate="$(AssemblySigningCertName)" Visible="false" />
80+
81+
<!-- Specifying signing for a file in a package using an explicit path within the NuGet package. -->
82+
<SignedPackageFile Include="$(OutputPath)$(TargetFileName)" Certificate="$(AssemblySigningCertName)"
83+
PackagePath="tasks/net461/$(TargetFileName)" Visible="false" />
11384

11485
<!-- Third-party cert -->
115-
<SignedPackageFile Include="$(PublishDir)Newtonsoft.Json.dll" Certificate="3PartyDual" PackagePath="tools/Newtonsoft.Json.dll" Visible="false" />
86+
<SignedPackageFile Include="tools/Newtonsoft.Json.dll" Certificate="3PartySHA2" Visible="false" />
11687

11788
<!-- This should already be signed by the dotnet-core team -->
118-
<ExcludePackageFileFromSigning Include="$(PublishDir)System.Runtime.CompilerServices.Unsafe.dll" PackagePath="tools/System.Runtime.CompilerServices.Unsafe.dll" Visible="false" />
89+
<ExcludePackageFileFromSigning Include="tools/System.Runtime.CompilerServices.Unsafe.dll" />
11990
</ItemGroup>
12091
```
12192

12293
### Disabling signing
12394

124-
You can disable sign request generation on an MSBuild project by setting DisableCodeSigning.
95+
You can disable sign request generation on an MSBuild project by setting DisableCodeSigning, or for an entire repo (via repo.props).
12596

12697
```xml
12798
<PropertyGroup>
@@ -137,50 +108,9 @@ these elements to the `build/repo.props` file. (See also [KoreBuild.md](./KoreBu
137108
```xml
138109
<!-- build/repo.props -->
139110
<ItemGroup>
140-
<FilesToSign Include="$(ArtifactsDir)libuv.dll" Certificate="3PartyDual" />
111+
<FilesToSign Include="$(ArtifactsDir)libuv.dll" Certificate="3PartySHA2" />
141112

142113
<!-- Files can also be listed as "do not sign", for completeness -->
143-
<FilesToExcludeFromSigning Include="$(ArtifactsDir)my.test.dll" Certificate="3PartyDual" />
114+
<FilesToExcludeFromSigning Include="$(ArtifactsDir)my.test.dll" Certificate="3PartySHA2" />
144115
</ItemGroup>
145116
```
146-
147-
## Elements
148-
149-
#### `SigningRequest`
150-
151-
Root element. No options.
152-
153-
#### `File`
154-
155-
A file to be signed.
156-
157-
**Path** - file path, relative to the file path. If nested in a `<Container>`, is relative to the organization within the container
158-
159-
**Certificate** - the name of the certificate to use
160-
161-
**StrongName** - for assemblies only. This is used to strong name assemblies that were delay signed in public.
162-
163-
#### `Container`
164-
165-
A container is an archive file, installer, or some kind of bundle that can be signed, or that has files that can be signed
166-
inside it. Nested elements can be added for `<File>` and `<ExcludedFile>`.
167-
168-
**Path** - file path to the container
169-
170-
**Certificate** - the name of the certificate to use
171-
172-
**Type** - The type of the container. Instructs the consumer how to extract the container. Example values:
173-
174-
- zip
175-
- tar.gz
176-
- vsix
177-
- nupkg
178-
- msi
179-
180-
#### `ExcludedFile`
181-
182-
This is useful when you want to exclude files within a container from being signed, but want to assert that
183-
all files in a container are accounted for.
184-
185-
**Path** - file path to a file to be ignored by the signing tool
186-

Diff for: ‎files/KoreBuild/KoreBuild.Common.props

+16
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,22 @@ Default layout and configuration.
3939
<BuildDir>$(ArtifactsDir)build\</BuildDir>
4040
<LogOutputDir>$(ArtifactsDir)logs\</LogOutputDir>
4141
<IntermediateDir>$([MSBuild]::NormalizeDirectory('$(RepositoryRoot)'))obj\</IntermediateDir>
42+
43+
<NuGetPackageRoot Condition=" '$(NuGetPackageRoot)' == '' ">$(NUGET_PACKAGES)</NuGetPackageRoot>
44+
<NuGetPackageRoot Condition=" '$(NuGetPackageRoot)' == '' AND '$(USERPROFILE)' != '' ">$(USERPROFILE)\.nuget\packages\</NuGetPackageRoot>
45+
<NuGetPackageRoot Condition=" '$(NuGetPackageRoot)' == '' AND '$(HOME)' != '' ">$(HOME)\.nuget\packages\</NuGetPackageRoot>
46+
<NuGetPackageRoot Condition=" '$(NuGetPackageRoot)' == '' ">$(RepositoryRoot)\.nuget\packages\</NuGetPackageRoot>
47+
<NuGetPackageRoot>$([MSBuild]::NormalizeDirectory('$(NuGetPackageRoot)'))</NuGetPackageRoot>
48+
</PropertyGroup>
49+
50+
<!-- Code signing certificate names -->
51+
<PropertyGroup Condition=" '$(DisableCodeSigning)' != 'true' ">
52+
<AssemblySigningCertName>Microsoft400</AssemblySigningCertName>
53+
<AssemblySigning3rdPartyCertName>3PartySHA2</AssemblySigning3rdPartyCertName>
54+
<PowerShellSigningCertName>Microsoft400</PowerShellSigningCertName>
55+
<PackageSigningCertName>NuGet</PackageSigningCertName>
56+
<VsixSigningCertName>VsixSHA2</VsixSigningCertName>
57+
<JarSigningCertName>MicrosoftJAR</JarSigningCertName>
4258
</PropertyGroup>
4359

4460
<!-- Use build number from CI if available -->

Diff for: ‎files/KoreBuild/KoreBuild.sh

+18-2
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ set_korebuildsettings() {
2626

2727
[ -z "${tools_source:-}" ] && tools_source="$default_tools_source"
2828

29+
# This is required for NuGet and MSBuild
30+
if [[ -z "${HOME:-}" ]]; then
31+
export HOME="$repo_path/.build/home"
32+
fi
2933

3034
if [ "$ci" = true ]; then
3135
export CI=true
@@ -40,15 +44,15 @@ set_korebuildsettings() {
4044
mkdir -p "$HOME"
4145
mkdir -p "$dot_net_home"
4246
if [[ -z "${NUGET_PACKAGES:-}" ]]; then
43-
export NUGET_PACKAGES="$repo_path/.build/.nuget/packages"
47+
export NUGET_PACKAGES="$repo_path/.nuget/packages"
4448
fi
4549
else
4650
if [[ -z "${NUGET_PACKAGES:-}" ]]; then
4751
export NUGET_PACKAGES="$HOME/.nuget/packages"
4852
fi
4953
fi
5054

51-
export DOTNET_ROOT="$DOTNET_HOME"
55+
export DOTNET_ROOT="$dot_net_home"
5256

5357
# Workaround perpetual issues in node reuse and custom task assemblies
5458
export MSBUILDDISABLENODEREUSE=1
@@ -123,6 +127,18 @@ __install_tools() {
123127

124128
# Set environment variables
125129
export PATH="$install_dir:$PATH"
130+
131+
# This is a workaround for https://github.com/Microsoft/msbuild/issues/2914.
132+
# Currently, the only way to configure the NuGetSdkResolver is with NuGet.config, which is not generally used in aspnet org projects.
133+
# This project is restored so that it pre-populates the NuGet cache with SDK packages.
134+
local restorerfile="$__korebuild_dir/modules/BundledPackages/BundledPackageRestorer.csproj"
135+
local restorerfilelock="$NUGET_PACKAGES/internal.aspnetcore.sdk/$(__get_korebuild_version)/korebuild.sentinel"
136+
if [[ -e "$restorerfile" ]] && [[ ! -e "$restorerfilelock" ]]; then
137+
mkdir -p "$(dirname $restorerfilelock)"
138+
touch "$restorerfilelock"
139+
__exec dotnet msbuild -t:restore -v:q "$restorerfile"
140+
fi
141+
# end workaround
126142
}
127143

128144
__show_version_info() {

Diff for: ‎files/KoreBuild/modules/sharedsources/module.targets

+14-4
Original file line numberDiff line numberDiff line change
@@ -26,15 +26,25 @@ that matches "$(RepositoryRoot)/shared/*.Sources".
2626
Properties="$(_SharedSourcesPackageProperties);NuspecBasePath=$([MSBuild]::NormalizeDirectory('%(SharedSourceDirectories.Identity)'));PackageId=%(FileName)%(Extension)"
2727
Condition="@(SharedSourceDirectories->Count()) != 0"
2828
BuildInParallel="true">
29-
<Output TaskParameter="TargetOutputs" ItemName="ArtifactInfo" />
30-
<Output TaskParameter="TargetOutputs" ItemName="FilesToExcludeFromSigning" Condition="'$(SignSourcesPackages)' != 'true'" />
31-
<Output TaskParameter="TargetOutputs" ItemName="FilesToSign" Condition="'$(SignSourcesPackages)' == 'true'" />
29+
<Output TaskParameter="TargetOutputs" ItemName="_SharedSrcPkgArtifactInfo" />
3230
</MSBuild>
31+
32+
<ItemGroup>
33+
<ArtifactInfo Include="@(_SharedSrcPkgArtifactInfo)" />
34+
<FilesToExcludeFromSigning Include="@(_SharedSrcPkgArtifactInfo)" Condition="'%(_SharedSrcPkgArtifactInfo.ShouldBeSigned)' != 'true' " />
35+
<FilesToSign Include="@(_SharedSrcPkgArtifactInfo)" Condition="'%(_SharedSrcPkgArtifactInfo.ShouldBeSigned)' == 'true' " />
36+
</ItemGroup>
3337
</Target>
3438

3539
<Target Name="_SetSharedSourcesProperties">
3640
<PropertyGroup>
37-
<_SharedSourcesPackageProperties>PackageOutputPath=$(BuildDir);RepositoryRoot=$(RepositoryRoot);ImportDirectoryBuildProps=false;BuildNumber=$(BuildNumber);</_SharedSourcesPackageProperties>
41+
<_SharedSourcesPackageProperties>
42+
PackageOutputPath=$(BuildDir);
43+
RepositoryRoot=$(RepositoryRoot);
44+
ImportDirectoryBuildProps=false;
45+
BuildNumber=$(BuildNumber);
46+
RepositoryCommit=$(RepositoryCommit)
47+
</_SharedSourcesPackageProperties>
3848
</PropertyGroup>
3949
</Target>
4050

Diff for: ‎files/KoreBuild/modules/sharedsources/sharedsources.csproj

+8-1
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,13 @@
3737
<ContentTargetFolders>contentFiles</ContentTargetFolders>
3838
<DisableImplicitFrameworkReferences>true</DisableImplicitFrameworkReferences>
3939
<DefaultExcludeItems>$(DefaultExcludeItems);$(BaseOutputPath);$(BaseIntermediateOutputPath);</DefaultExcludeItems>
40+
<!-- Suppress warnings about using semver 2.0 versions in packages -->
41+
<NoWarn>$(NoWarn);NU5105</NoWarn>
42+
</PropertyGroup>
43+
44+
<PropertyGroup Condition=" '$(DisableCodeSigning)' != 'true' ">
45+
<!-- Only specify the package signing cert. Do not specify AssemblySigningCertName because .Sources packages should not have binaries. -->
46+
<PackageSigningCertName>NuGet</PackageSigningCertName>
4047
</PropertyGroup>
4148

4249
<ItemGroup Condition="'$(NuspecBasePath)'!=''">
@@ -73,7 +80,7 @@
7380
<Category>$(PackageArtifactCategory)</Category>
7481
<IsContainer>true</IsContainer>
7582
<Certificate>$(PackageSigningCertName)</Certificate>
76-
<ShouldBeSigned Condition=" '$(PackageSigningCertName)' != '' ">true</ShouldBeSigned>
83+
<ShouldBeSigned Condition=" '$(PackageSigningCertName)' != '' AND '$(DisableCodeSigning)' != 'true' ">true</ShouldBeSigned>
7784
</ArtifactInfo>
7885
</ItemGroup>
7986
</Target>

0 commit comments

Comments
 (0)