Unsigned Mac VMR artifacts

[ellahathaway]

Pipeline run

There are 60 unique filenames that are being reported as "unsigned" by SignCheck on mac:

Files without extensions:
Mono
crossgen2
ilasm
ilc
ildasm
llc
mono-aot-cross
opt
singlefilehost

.dwarf:
Mono.dwarf
apphost.dwarf
createdump.dwarf
dotnet.dwarf
ilasm.dwarf
ildasm.dwarf
libSystem.Globalization.Native.dylib.dwarf
libSystem.IO.Compression.Native.dylib.dwarf
libSystem.IO.Ports.Native.dylib.dwarf
libSystem.Native.dylib.dwarf
libSystem.Net.Security.Native.dylib.dwarf
libSystem.Security.Cryptography.Native.Apple.dylib.dwarf
libSystem.Security.Cryptography.Native.OpenSsl.dylib.dwarf
libclrgc.dylib.dwarf
libclrgcexp.dylib.dwarf
libclrjit.dylib.dwarf
libcoreclr.dylib.dwarf
libhostfxr.dylib.dwarf
libhostpolicy.dylib.dwarf
libmono-component-debugger.dylib.dwarf
libmono-component-diagnostics_tracing.dylib.dwarf
libmono-component-hot_reload.dylib.dwarf
libmono-component-marshal-ilgen.dylib.dwarf
libmonosgen-2.0.dylib.dwarf
libmscordaccore.dylib.dwarf
libmscordbi.dylib.dwarf
libnethost.dylib.dwarf
mono-aot-cross.dwarf
singlefilehost.dwarf

.o
libbootstrapper.o
libbootstrapperdll.o

.pkg
com.microsoft.dotnet.dev.x.y.z.component.osx.arch.pkg
com.microsoft.dotnet.hostfxr.x.y.z.component.osx.arch.pkg
com.microsoft.dotnet.pack.apphost.x.y.z.component.osx.arch.pkg
com.microsoft.dotnet.pack.targeting.x.y.z.component.osx.arch.pkg
com.microsoft.dotnet.sharedframework.Microsoft.NETCore.App..component.osx.arch.pkg <- this one is missing a version?
com.microsoft.dotnet.sharedhost.x.y.z.component.osx.arch.pkg
com.microsoft.standard.pack.targeting.x.y.z.component.osx.arch.pkg
dotnet-host-internal-x.y.z-osx-arch.pkg
dotnet-hostfxr-internal-x.y.z-osx-arch.pkg
dotnet-runtime-internal-x.y.z-osx-arch.pkg

[mmitche]

• The com.* packages can be eliminated if these are just a result of unpacking the .pkg. I haven't been able to peek at the nested signature after unpacking.
• The internal* packages can be unsigned. they are chained in to the final .pkgs later on.

[akoeplinger]

com.microsoft.dotnet.sharedframework.Microsoft.NETCore.App..component.osx.arch.pkg <- this one is missing a version?

I checked and this is already the case in 9.0.202 and 8.0.407 so likely always been this way and not critical. Would be nice to fix it though. dotnet/sdk#48059

[akoeplinger]

We should exclude the .dwarf files, these are debugging symbols and we're not signing .pdbs either

[akoeplinger]

The llc/opt/mono-aot-cross look like real issues that probably also happen in the current official build.

[mmitche]

The llc/opt/mono-aot-cross look like real issues that probably also happen in the current official build.

I'll add these to my sign/notarize PR in runtime.

[mmitche]

Additional unsigned mac executables covered by dotnet/runtime#114027

[mmitche]

Just waiting on runtime flow to complete so that we can merge the SDK PR