Skip to content

Authenticode-sign library DLLs in CI - #337

Draft
TheCodeTraveler with Copilot wants to merge 6 commits into
mainfrom
copilot/sign-dlls-for-asyncawaitbestpractices
Draft

TheCodeTraveler with Copilot wants to merge 6 commits into
mainfrom
copilot/sign-dlls-for-asyncawaitbestpractices

Conversation

Copilot AI commented Oct 13, 2026 •

Copy link
Copy Markdown

Windows Smart App Control can block applications that depend on unsigned DLLs. The libraries’ existing strong-name signatures do not provide Authenticode signatures.

  • Signing: Sign library outputs before NuGet packing with SHA-256 and a timestamp.
  • CI: Use a temporary certificate on pull requests; trusted builds use CODE_SIGNING_CERTIFICATE_PFX_BASE64 and CODE_SIGNING_CERTIFICATE_PASSWORD.
  • Verification: Check signatures on DLLs extracted from each generated NuGet package.
signtool sign /sha1 <thumbprint> /s My /fd SHA256 /tr https://timestamp.digicert.com /td SHA256 <dll>

Copilot AI self-assigned this Oct 13, 2026
Copilot AI balanced review requested due to automatic review settings October 13, 2026 19:29

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

Copilot AI linked an issue Oct 13, 2026 that may be closed by this pull request
Co-authored-by: TheCodeTraveler <13558917+TheCodeTraveler@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings October 13, 2026 19:38
Copilot AI changed the title [WIP] Sign DLLs for AsyncAwaitBestPractices to meet Smart App Control requirements Authenticode-sign library DLLs in CI Oct 13, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Job-wide signing is enabled before certificate setup, causing the unit-test build to fail.

1 open finding

🧠 Review effort: Balanced

Comment thread .github/workflows/dotnet-build.yml Outdated
Co-authored-by: TheCodeTraveler <13558917+TheCodeTraveler@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings October 15, 2026 03:15

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No blocking issues were identified in the signing target, certificate handling, or package verification flow.

0 open findings

1 resolved since last review

🧠 Review effort: Balanced

Copilot AI balanced review requested due to automatic review settings October 15, 2026 03:18

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No blocking issues remain; signing is scoped to packing, pull requests avoid signing secrets, and packaged signatures are verified.

0 open findings

🧠 Review effort: Balanced

…se is published

Co-authored-by: TheCodeTraveler <13558917+TheCodeTraveler@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings October 15, 2026 03:24

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Production certificate handling and release publishing need end-to-end validation in trusted Windows CI.

0 open findings

🧠 Review effort: Balanced

…icate

Co-authored-by: TheCodeTraveler <13558917+TheCodeTraveler@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings October 15, 2026 03:37

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Production signing needs release-environment validation, and the documented signing setup differs from the workflow.

1 open finding

🧠 Review effort: Balanced

Comment on lines +225 to +228
$missing = @('AZURE_CLIENT_ID', 'AZURE_TENANT_ID', 'AZURE_SUBSCRIPTION_ID', 'ARTIFACT_SIGNING_ENDPOINT', 'ARTIFACT_SIGNING_ACCOUNT_NAME', 'ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME') |
Where-Object { [string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($_)) }
if ($missing) {
throw "Add these secrets/variables to the 'release' environment (Settings > Environments > release): $($missing -join ', ')"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Windows 11 - Smart App Control

3 participants