Add catalog signing for .js files and direct signing for .cab files#127242
Open
jesuszarate wants to merge 1 commit intodotnet:mainfrom
Open
Add catalog signing for .js files and direct signing for .cab files#127242jesuszarate wants to merge 1 commit intodotnet:mainfrom
jesuszarate wants to merge 1 commit intodotnet:mainfrom
Conversation
dotnet-policy-service
Bot
added
the
community-contribution
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the repo signing configuration to satisfy Visual Studio setup signing compliance by ensuring additional signable file types included in Mono workload MSI payloads are Authenticode-signed.
Changes:
- Updates
.jssigning to use theMicrosoft400certificate instead of opting out (None). - Adds signing configuration for
.cabfiles using theMicrosoft400certificate.
The VS signing scan requires every signable file to carry its own signature. The Mono workload packs contain 480 unsigned files: - 198 .js files (browser-wasm runtime scripts) - 282 .cab files (WiX cabinet archives inside MSIs) For .js files: keep CertificateName=None (same as dotnet/emsdk#1671) because these are customer-modifiable runtime files. Instead, generate a .cat catalog file covering all .js files, signed via FileExtensionSignInfo for .cat. The GenerateCatalogFiles target runs after AddMonoRuntimeFiles on Windows browser-wasm builds. For .cab files: add FileExtensionSignInfo with Microsoft400 so the Arcade SDK SignTool signs them directly. Both Microsoft400 entries are auto-replaced by MicrosoftDotNet500 since UseDotNetCertificate=true. Tracking: https://devdiv.visualstudio.com/DevDiv/_workitems/edit/2911494
jesuszarate
force-pushed
the
dev/jezarat/sign-mono-cab-js
branch
from
245664b to
c974f16
Compare
jesuszarate
changed the title
| Instead, a catalog file (.cat) is generated and signed to provide integrity | ||
| verification. See the GenerateCatalogFiles target in eng/mono.proj. --> | ||
| <FileExtensionSignInfo Update=".js" CertificateName="None" /> | ||
| <FileExtensionSignInfo Include=".cab" CertificateName="Microsoft400" /> |
Member
There was a problem hiding this comment.
If this is for correctness, can we instead add this in dotnet/arcade? Then everyone that builds MSIs will get it (SDK as well).
This was referenced Apr 22, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Visual Studio signing scan flags 480 unsigned files across Mono workload pack MSI payloads (.NET 6-10):
These MSI payloads are produced by the dotnet/runtime CI build and inserted into Visual Studio via the DotNet-SDK-Workloads staging pipeline. Every signable file in VS setup must carry its own signature.
Approach
Follows the same pattern as dotnet/emsdk#1671 (merged):
.js files - Catalog signing (not direct Authenticode)
The .js files are customer-modifiable runtime/toolchain files. Direct Authenticode signing would break when users modify them. Instead:
A GenerateCatalogFiles target in the Mono runtime sfxproj runs after AddMonoRuntimeFiles on Windows browser-wasm builds, using the same generate-catalog.ps1 script pattern from emsdk.
.cab files - Direct Authenticode signing
Cabinet archives are immutable build artifacts. Added FileExtensionSignInfo .cab with Microsoft400 so the Arcade SDK SignTool signs them directly.
Changes
Affected Payloads
All Mono workload packs for .NET 6-10 (276 payloads total):
Tracking
VS signing compliance: https://devdiv.visualstudio.com/DevDiv/_workitems/edit/2911494