Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable Unpacking, repacking, signing, and notarization of .pkg files and .app bundles #15206

Merged
merged 88 commits into from
Jan 16, 2025
Merged

Enable Unpacking, repacking, signing, and notarization of .pkg files and .app bundles #15206

merged 88 commits into from
Jan 16, 2025

Conversation

ellahathaway
Copy link
Member

@ellahathaway ellahathaway commented Oct 29, 2024 •
edited by mmitche
Loading

Related to #14438

This is the second part of #14438. This PR integrates the pkg tool, introduced in #15205, into SignTool. More specifically, this PR enables the unpacking and repacking of .pkgs and nested .app bundles within SignTool & adds tests & test data for this functionality into SignTool.Tests.

This is a rather large change, including quite a lot of refactoring as SignTool is becoming a bit bloated. Highlights

  • Removed the use of ITaskItem in the signtool sources, aside from the task. It made no sense to have some data passed around as MSBuild items, and others passed around formalized types. Introduce new types where needed.
  • Notarization is supported via a "dual sign" mechanism similar to a dual sign certificate. At some point, we may want to change this model and make notarization a separate concept (a new signing information type). For now, I deemed that approach too invasive. Right now, there are special certs for Mac that represent both notarization and signing. When those certs are used. Signtool will both sign and notarize the file, in separate passes.
  • Rework the pkg tooling to use the command line API
  • Minimally tweak the build manifest model to support the new signing data. I think this should be removed altogether in Remove signing information from the build manifest models #15415
  • Add various tests for new pkg tooling, corner case tests for old bugs.
  • If files did not have a matching extension or strong name sign info, they wouldn't get signed even if they had an explicit cert specified. Fix this.

There is more follow on work to be done here. Signtool is due for a major refactor to deal with all the various archive types it now supports. There is far too much "If ".

@ellahathaway ellahathaway changed the title Integrate Pkg Tool into SignTool Enable Unpacking and Repacking of .pkg files and .app bundles Oct 29, 2024
This was referenced Oct 29, 2024
Closed
Closed
ellahathaway added a commit to ellahathaway/arcade that referenced this pull request Oct 31, 2024
@ellahathaway
Remove tool from SignTool tests - will be added in dotnet#15206
3e81076
@mmitche mmitche marked this pull request as ready for review November 22, 2024 18:22
@mmitche mmitche changed the title Enable Unpacking and Repacking of .pkg files and .app bundles Enable Unpacking, repacking, signing, and notarization of .pkg files and .app bundles Jan 14, 2025
@mmitche mmitche marked this pull request as ready for review January 14, 2025 21:58
@mmitche
Copy link
Member

mmitche commented Jan 14, 2025

Readddy for review!

@mmitche mmitche requested review from a team January 15, 2025 00:22
ViktorHofer
ViktorHofer reviewed Jan 15, 2025
View reviewed changes
src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.proj
@@ -20,6 +20,7 @@
</PropertyGroup>

<Import Project="BuildStep.props" />
<Import Project="TargetFrameworkDefaults.props" />
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see this import being used anywhere below. I don't think that the Arcade TFM properties can be used.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I had this in there to use NetToolCurrent for the command line tools. Updated

ellahathaway
ellahathaway commented Jan 15, 2025
View reviewed changes
src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.proj Outdated
@@ -57,6 +58,9 @@

<!-- SN is only available on Windows -->
<SNBinaryPath Condition="$([MSBuild]::IsOSPlatform('Windows'))">$(NuGetPackageRoot)sn\$(SNVersion)\sn.exe</SNBinaryPath>

<!-- .pkgs and .app bundle tooling is only available on MacOS -->
<PkgToolPath Condition="$([MSBuild]::IsOSPlatform('OSX'))">$(NuGetPackageRoot)microsoft.dotnet.macospkg\$(MicrosoftDotNetMacOsPkgVersion)\tools\net10.0\any\Microsoft.Dotnet.MacOsPkg.dll</PkgToolPath>
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a way to use a prop for net10.0? I think the hardcoded version will cause issues when we eventually update the target framework.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

$(NetToolCurrent). I'll try it.

src/Microsoft.DotNet.MacOsPkg/AppBundle.cs Show resolved Hide resolved
src/Microsoft.DotNet.SignTool/src/BatchSignUtil.cs Show resolved Hide resolved
src/Microsoft.DotNet.SignTool/src/BatchSignUtil.cs Outdated Show resolved Hide resolved
src/Microsoft.DotNet.SignTool/src/BatchSignUtil.cs Outdated Show resolved Hide resolved
src/Microsoft.DotNet.SignTool/src/ZipData.cs Outdated Show resolved Hide resolved
src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.props Show resolved Hide resolved
ellahathaway
ellahathaway commented Jan 16, 2025
View reviewed changes
Copy link
Member Author

@ellahathaway ellahathaway left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cannot approve because I’m technically the author of the PR, but the changes look good to me. Thanks for all the work you did on this, Matt.

@mmitche
Copy link
Member

mmitche commented Jan 16, 2025 •
edited
Loading

Test build with mac signing enabled: https://dev.azure.com/dnceng/internal/_build/results?buildId=2622013&view=results
aspnetcore build with new sign tool: https://dev.azure.com/dnceng/internal/_build/results?buildId=2622014&view=results
sdk build with new sign tool: https://dev.azure.com/dnceng/internal/_build/results?buildId=2622037&view=results

@mmitche mmitche merged commit 2a5490c into dotnet:main Jan 16, 2025
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mmitche mmitche mmitche left review comments

@NikolaMilosavljevic NikolaMilosavljevic NikolaMilosavljevic approved these changes

@ViktorHofer ViktorHofer ViktorHofer approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@ellahathaway @mmitche @ViktorHofer @NikolaMilosavljevic