Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update signtool plan #453

Merged
merged 2 commits into from
Aug 9, 2018
Merged

Update signtool plan #453

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2b42ab7
Update signtool plan
maririos Aug 9, 2018
73c765c
change the wording
maririos Aug 9, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 3 additions & 6 deletions Documentation/CorePackages/SigningPlan.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,19 +5,16 @@ The goal of the signing plan is to provide guidance on how the tier 1 (T1) produ
- Leverage pre-existing solutions so that work isn't duplicated.
- Where possible, avoid dependency on software installed on the machine to facilitate the consumtion of the tool accross the .NET Core repositories.
- The consumption method of the SignTool should follow the [Methods for Consuming the .NET Core Shared Infrastructure Components](https://github.com/dotnet/arcade/blob/master/Documentation/Overview.md#methods-for-consuming-the-net-core-shared-infrastructure-components).
- Signtool will need a manifest (list of files) in order to know what to sign. The manifest can be checked in (explicit) or
can be generated during the build (implicit).
- SignTool should provide validation to guarantee that all assets that need signing are going to be signed, and also verify
that the binaries were actually signed.
- Signtool will need a list of containers in order to know what to sign.

## Roadmap
1. (S137) Migrate SignTool from Repo tool set to Arcade.
2. (S138) Add SignTool to Arcade SDK.
3. (S138) Arcade should sign its packages using the SignTool that is in the SDK.
4. (S138 - S139) Refactor the SignTool to accomodate scenarios for other repositories. Examples of the changes are:
- Convert to MsBuild task.
- Accept a manifest file from different source (implicit or explicit).
- Read the strong name from the metadata of a build.
- Accept a list of containers that need to be signed. Those containers will be expanded and nested assemblies signed. Current support will be to VSIX and NuGet packages.
- Read the strong name from the metadata of the file.
5. (S140) Onboard one repository from T1 to use the SignTool from the SDK to sign its binaries.
6. (S140) Once validated in a repository, start onboarding the other T1 repositories.

Expand Down