From 11d666131148be5b6c4315ff220c982c659c1c74 Mon Sep 17 00:00:00 2001
From: Chuy Zarate <jezarat@microsoft.com>
Date: Fri, 17 Apr 2026 17:55:39 -0600
Subject: [PATCH] Add eng/Signing.props to sign cab files inside MSI workload
 packs

The VS signing scan flags 42 unsigned cab1.cab files inside macOS SDK
and Templates workload pack MSI payloads. The Arcade SDK's default
Sign.props does not include a FileExtensionSignInfo for .cab, so the
SignTool skips signing them even though .cab is in SignableExtensions.

Add eng/Signing.props with:
- FileExtensionSignInfo for .cab -> Microsoft400
- UseDotNetCertificate = true (standard for dotnet/* repos)
- ItemsToSign entries for *.msi and *.wixpack.zip so the SignTool
  opens MSI containers and signs embedded cabs
---
 eng/Signing.props | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 eng/Signing.props

diff --git a/eng/Signing.props b/eng/Signing.props
new file mode 100644
index 000000000000..512b976e5777
--- /dev/null
+++ b/eng/Signing.props
@@ -0,0 +1,16 @@
+<Project>
+  <PropertyGroup>
+    <UseDotNetCertificate>true</UseDotNetCertificate>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <!-- Sign cab files embedded inside MSI containers with Authenticode -->
+    <FileExtensionSignInfo Include=".cab" CertificateName="Microsoft400" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ItemsToSign Include="$(ArtifactsShippingPackagesDir)\**\*.msi" Condition="'$(PostBuildSign)' != 'true'" />
+    <ItemsToSign Include="$(ArtifactsShippingPackagesDir)\**\*.wixpack.zip" Condition="'$(PostBuildSign)' != 'true'" />
+    <ItemsToSignPostBuild Include="$(ArtifactsShippingPackagesDir)\**\*.msi" Condition="'$(PostBuildSign)' == 'true'" />
+  </ItemGroup>
+</Project>