Add FileExtensionSignInfo for .cab to fix unsigned cab files inside ANCM MSIs#66443
Add FileExtensionSignInfo for .cab to fix unsigned cab files inside ANCM MSIs#66443jesuszarate wants to merge 1 commit intodotnet:mainfrom
Conversation
github-actions
Bot
added
the
needs-area-label
dotnet-policy-service
Bot
added
the
community-contribution
|
Thanks for your PR, @jesuszarate. Someone from the team will get assigned to your PR shortly and we'll get it reviewed. |
There was a problem hiding this comment.
Pull request overview
Adds signing configuration so .cab cabinet archives produced/embedded by ANCM MSI builds are code-signed, addressing signing compliance failures for unsigned CAB payloads.
Changes:
- Add a
FileExtensionSignInfoentry to sign.cabfiles using theMicrosoft400certificate. - Document the intent in
eng/Signing.propsnear existing signing exclusions.
| <!-- Sign cabinet archives embedded inside MSI installers (ANCM, hosting bundle, etc.) --> | ||
| <FileExtensionSignInfo Include=".cab" CertificateName="Microsoft400" /> |
There was a problem hiding this comment.
The new .cab signing rule is inside the ItemGroup labeled "Code sign exclusions", which now mixes exclusions (CertificateName="None") with a positive signing rule. Consider moving the .cab entry to a separate ItemGroup (or updating the label) to keep the intent clear for future edits.
There was a problem hiding this comment.
Good catch - moved the .cab entry into its own ItemGroup (Label=Container signing) above the exclusions group. This keeps the intent clear: exclusions are None, container signing rules are separate.
The Arcade SDK's default Sign.props does not include a FileExtensionSignInfo for .cab, so SignTool skips signing cabinet archives inside MSI installers. This causes the VS signing compliance scan to flag 22 unsigned files (12 DLLs + 10 cabs) inside the ANCM MSI payloads. Adding .cab with Microsoft400 (auto-replaced with MicrosoftDotNet500 since UseDotNetCertificate=true) unblocks SignTool from entering the cab containers and signing everything inside. Fix: https://devdiv.visualstudio.com/DevDiv/_workitems/edit/2951246
jesuszarate
force-pushed
the
dev/jezarat/sign-cab-files
branch
from
e6d8b33 to
c22892a
Compare
\ CertificateName=\Microsoft400\ />
\\
Affected payloads
Precedent
Same fix pattern applied in other dotnet repos:
Tracking