Signing failure for spectre-console

[mthalman]

The Sign Source-Built Artifacts pipeline step is failing with the following error:

/__w/1/s/.packages/microsoft.dotnet.arcade.sdk/10.0.0-beta.25523.111/tools/Sign.proj(76,5): error SIGN004: Signing 3rd party library '/__w/1/s/artifacts/tmp/Release/ContainerSigning/9210/lib/net10.0/Spectre.Console.dll' with Microsoft certificate 'MicrosoftDotNet500'. The library is considered 3rd party library due to its copyright: 'Patrik Svensson, Phil Scott, Nils Andresen, Cédric Luthi, Frank Ray'.

This occurred as a result of the changes in dotnet/source-build-reference-packages#1485

Example build (internal link)

[zivkan]

I don't know if this helps in any way, but FWIW, Spectre.Console was added to the main branch in dotnet/source-build-reference-packages#1447

Does source build the VMR main branch? Maybe it's already been solved there and can be backported to 10.0.

[mthalman]

The signing step doesn't run in the main branch.

[MichaelSimons]

The signing step doesn't run in the main branch.

I thought we ran a signed build weekly in main just to flush these types of things out? Or is that not real signed?

[zivkan]

Looking at my own SDK install, the only 3rd party dll I can see (at least in the SDK root directory) is Newtonsoft.Json. But it means there should be prior art on how to sign a 3rd party. Can we find how Newtonsoft.Json is being signed, and copy the approach for Spectre.Console?

I know that in the NuGet repo we have a "3rd party" certificate for stuff we ship in our VS extension. I'm not familiar with Arcade or the VMR.

[MichaelSimons]

I know we have some special signing for some repos but at a glance that appears strong name related. That appears to be how Newtonsoft.Json is handled.

@ellahathaway do you have any insights here?

[zivkan]

Thanks for the pointer.

Taking a look at newtonsoft-json.proj, I can take a guess at what needs to be done to spectre-console.proj

I see that Spectre.Console have their snk in their repo: https://github.com/spectreconsole/spectre.console/blob/e097281ca8a50268b1022453fe6efd9112123a28/resources/spectre.snk

It's just not clear to me if we can copy it as is, or if we have to extract just the public key portion. Or why we don't just reference the snk from the submodule, rather than copying it. edit: actually the readme says it's just for repos that don't have a snk commit. Since spectre does, I guess we just need to modify spectre-console.proj to use it from the repo.

Anyway, unless someone beats me to it, I'll try to create a PR when I can find some time. I have a few things going on today.

[ellahathaway]

Spectre.Console.dll is signed with the 3rd party cert in main: https://github.com/dotnet/dotnet/blob/54e287dbc5574a713b7167d27db9a4d9f94b7187/eng/tools/tasks/Microsoft.DotNet.UnifiedBuild.Tasks/static/Signing.props#L34. I think we just need to backport dotnet/dotnet#3199 to release/10.0.1xx branch.

[ellahathaway]

dotnet/dotnet#3643 will fix this issue