XPlat Signing and verification for dotnet core & mono

[rrelyea]

This epic covers the work needed in order to fully port NuGet's package signing and verification features to all platforms, including mono, as well as the dotnet command itself.
The dotnet APIs have specific XPLAT behaviors that we need to address when tackling signing and verification XPLAT. This will mean either document known behavior or do functional changes in specific platforms.

Some things are:

• X509RevocationMode.Offline is not supported on macOS
• OSCP are not supported in Linux

More info: https://github.com/dotnet/corefx/blob/master/Documentation/architecture/cross-platform-cryptography.md

Note: Make sure to read the document before implementing since it might change.

There is an initial PR and a summary of remaining work in that PR over at NuGet/NuGet.Client#2706

[clairernovotny]

Note this PR shows it working: NuGet/NuGet.Client#2545

There are a couple of comments in there w.r.t. a ComputeSignature overload that needs to be changed as well.

[bruno-garcia]

Any update on this? We've got a certificate laying around since August last year but having to get a Windows VM just to run the signing (Thanks @onovotny for SignService) is not ideal.

[karann-msft]

hey @bruno-garcia - we are actively working on this.

[bruno-garcia]

Highly appreciated!

[frivard-coveo]

I notice the milestone Sprint has been bumped from month to month for a whole year now; for a security feature this is quite unusual.
@aortiz-msft Can you please share an update about this? With some recent attack using public package repositories, it is getting urgent that our company-internal package are properly secured.

[Zastai]

If this is really an Epic, could there at least be an effort to keep its composing issues linked here?
The best we seem to have had is a (now outdated) screenshot.

• Issue Signing: implement dotnet verify command #8051 seems to be done.
• Issue Signing: implement dotnet sign command #8052 has been replaced by issue Implement dotnet nuget sign command #10581.
• Issue Signing: implement dotnet trusted-signers command #8053 has not seen much activity.

• Issue Signing: for Linux and Mac, implement timestamp integrity verification and enable the tests #8045 seems to be done.
• Issue Signing: improve document on Offline revocation not supported for Mac, test to make sure no hang on Mac in offline scenarios #8046 has not seen much activity.
• Issue Signing: Fix 22 test failures on Mac OS #8047 seems to be done.
• Issue Signing: Manual testing for signed package verification on mono(for dotnet restore and nuget exe)  #8048 has not seen much activity.
• Issue Signing: Enable tests that used OCSP on Linux #8050 has been closed, in favor of issue XPlat Signing: Enable signature verification for restore in dotnet.exe #9004 (which is also an Epic that seems to cover a subset of this one).

• Issue Signing: on Linux, verify untrusted certificates give unknown revocation doesn't affect the correctness of our code. #8044 seems to be done.

• Issue Signing: add .NET Standard 2.1 Targeting for NuGet.Packaging, fix tests, create nupkg for pack sdk #8043 seems to be done.

[heng-liu]

There is no work left for xplat signing and verification for dotnet core based on the current plan.
Pls refer to the following documents for xplat signing and verification related commands:
https://docs.microsoft.com/en-us/dotnet/core/tools/dotnet-nuget-verify
https://docs.microsoft.com/en-us/dotnet/core/tools/dotnet-nuget-trust
https://docs.microsoft.com/en-us/dotnet/core/tools/dotnet-nuget-sign

For Mono, currently there is no plan for enabling signing and verification.

[raffaeler]

@heng-liu The docs do not mention how to sign on Ubuntu (which is the default for GitHub actions).
Should I create the pfx from the base64 and then use the file command line? Suggested tooling?
To avoid reinventing the wheel, could you please add here (and then in the docs) the relevant details please?

[heng-liu]

Hi @raffaeler , thanks for your question!
May I know what's the original format of the cert you have on Ubuntu?
Or could you check if any command in page https://www.openssl.org/docs/man1.1.0/man1/openssl-pkcs12.html is helpful?
Can you please let us know if you find out any workable commands? Thanks!

[raffaeler]

Thank you @heng-liu
I got the certificate from DigiCert. I installed it on Windows certification store but I also downloaded the .crt which is the usually preferred method on Linux.

I would ask you to publish the exact commands to be added to the GitHub actions when an Ubuntu machine is used.
I believe this is a very popular use-case as Nuget is pushing towards signing the packages.

[frivard-coveo]

The dotnet-nuget-sign command expects a PFX file, which is quite uncommon on Linux-based systems. In my case I see PEM files in our infrastructure.
I found the following Stack Overflow answer which might be very useful : https://stackoverflow.com/a/808742/15480824
Basically, the OpenSSL tool can be used to combine a CRT and a PEM file into a PFX file.

This seems like an unfortunate workaround, since the .NET Core libraries now support working with formats other than PFX. But the nuget sign command does not seem to have been updated.

[raffaeler]

Thank you very much @frivard-coveo
In may personal case I can export the pfx from Windows and encode using base64 ubuntu utility from WSL, put it in the GitHub secrets and decode it in the GitHub action.

But I am very worried for the missing pieces (both in the tool and the documentation) for the Linux scenario given that now is so popular (and the default on GitHub actions).

I kindly ask @heng-liu to provide some kind of feedback about the missing pieces and hope they will soon filled in.

[janstaelensskyline]

Did someone ever get this working? dotnet-nuget-sign with a pfx file on a github action running on Ubuntu?
We've been unable to get it running nor have we found any clear documentation on how to get the signing to work.
Even when providing a pfx file containing the full chain we get the errors:
error: NU3018: PartialChain: unable to get local issuer certificate
error: NU3018: Certificate chain validation failed.

[ghost]

Did someone ever get this working? dotnet-nuget-sign with a pfx file on a github action running on Ubuntu? We've been unable to get it running nor have we found any clear documentation on how to get the signing to work. Even when providing a pfx file containing the full chain we get the errors: error: NU3018: PartialChain: unable to get local issuer certificate error: NU3018: Certificate chain validation failed.

@janstaelensskyline looks like you need to open a new or link an existing ticket for the missing pieces - #7939 (comment)