Support skipping 3rd party signature check #15852
Conversation
These images don't have valid copyright info. If we emit the warning, various repos will just fail. To detect these, we need to read the export table. To do so, we use runtime's ILCompiler.Reflection.ReadyToRun.Experimental package, which has some PEReader extensions.
jkoritzinsky
left a comment
jkoritzinsky
left a comment
There was a problem hiding this comment.
LGTM once tests are passing
|
Causes assembly load failures when using signtool with desktop msbuild. |
mmitche
force-pushed
the
composite-crossgen
branch
from
81ec0c6 to
4ba0121
Compare
|
Dug a bit further and I really understand what is going on now. This issue primarily Windows vs. Linux. When you have a composite r2r image, the native PE image still has a resource section with the native copyright info. When we can't find the managed copyright attrs, we fall back to the native copyright info. This is obtained via FileVersionInfo. On Windows, this information is loaded via native interop. It is NOT populated on *nix. So what is happening is that we end up with an empty copyright string, which then causes the warning. The workaround to detect a r2r image is reasonable, since the likelihood is that we created such an image, but it's not ideal. I think a better methodology is to just add an explicit opt-out to the 3rd party check. The "I know what I'm doing for Blah.dll" config |
mmitche
changed the title
3 participants
Native images don't have readable copyright info on Linux. Composite r2r images show up as fully native images, and trigger the 3rd party warning when signing on Mac/Linux. The list of these files is very small (currently a list of 1)
Support a "no check" list.