From 7c118934e6f5c5f82379740571927a649d309d67 Mon Sep 17 00:00:00 2001
From: Chuy Zarate <jezarat@microsoft.com>
Date: Mon, 20 Apr 2026 13:29:42 -0600
Subject: [PATCH] Add .cab/.vbs FileExtensionSignInfo for VS signing compliance

The VS signing scan flags files across msemscriptenpythonnet* and emsdk6manifest*
workload packs (.NET 6-10) as unsigned.

Root cause: eng/Signing.props has no FileExtensionSignInfo for .cab or .vbs.
Without .cab, the Arcade SignTool cannot open MSI containers to sign embedded
cabinet archives. Without .vbs, CPython VBScript installer scripts are unsigned.

The Arcade SDK default already covers .ps1 (Microsoft400, auto-upgraded to
MicrosoftDotNet500 via UseDotNetCertificate), so no override is needed for that.

Fix:
- .cab -> MicrosoftDotNet500 (consistent with .pyd, .cat)
- .vbs -> MicrosoftDotNet500 (consistent with .pyd, .cat, .cab)
---
 eng/Signing.props | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/eng/Signing.props b/eng/Signing.props
index 3d376905eb..b5021b0f3c 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -7,6 +7,8 @@
   <ItemGroup>
     <FileExtensionSignInfo Include=".pyd" CertificateName="MicrosoftDotNet500" />
     <FileExtensionSignInfo Include=".cat" CertificateName="MicrosoftDotNet500" />
+    <FileExtensionSignInfo Include=".cab" CertificateName="MicrosoftDotNet500" />
+    <FileExtensionSignInfo Include=".vbs" CertificateName="MicrosoftDotNet500" />
 
     <!-- JS files are customer-modifiable Emscripten toolchain files. They cannot be
          Authenticode-signed because modifying a signed file breaks the signature.