Sample Workflows Require Updating

[MikeWilliams-UK]

Describe the bug
The sample workflows at
https://github.com/dotnet/sign/blob/main/docs/azdo-build-and-sign.yml
https://github.com/dotnet/sign/blob/main/docs/gh-build-and-sign.yml
need to be updated as they do not reflect the current code base

They are over two years old and some options presented are now obsolete.

Repro steps
N/A

Expected behavior
Examples are updated to reflect current code.

[dlemstra]

Thanks for reporting this. We should update those two examples to use a managed identity and remove the obsolete options.

[MikeWilliams-UK]

Thanks, I have been working with [Chris Sfanos (.NET Foundation)] to try to get the Chem4Word signing to work using a managed identity created by Chris but we must be missing something as all we ever get is permission denied.
Therefore any documentation on the permissions required would also be useful here.

We are using the sign system in Visual Studio post build event to sign a component and also in a batch file to sign our installer.

[dlemstra]

Have you tried using federated credentials? I have written something about that. It uses the sign cli with trusted signing but this should also work for azure key vault. You can find that article here: https://dlemstra.github.io/github-stories/2024/signing-nuget-packages-with-trusted-signing/.

[MikeWilliams-UK]

@ChrisSfanos is using federated credentials worth trying for our Chem4Word signing workflows?

[MikeWilliams-UK]

@dlemstra FYI:

During our post build of our auto updater we use this code
https://github.com/Chem4Word/Version3-3/blob/main/src/Scripts/Sign-Assembly.ps1

After the WiX installer has been build we sign it and our bootstrap downloader with this code
https://github.com/Chem4Word/Version3-3/blob/main/src/Scripts/Sign-Files.cmd

[ChrisSfanos]

Hey @MikeWilliams-UK - yep we can definitely do FedCreds - I can set one up for you and we can tweak it based on your environment setup

[Aaronontheweb]

How do you even authenticate in Azure DevOps using FedCreds and this tool? Been banging my head against the wall with this today

[ChrisSfanos]

I think Managed Identities (replacing secrets) are for that? I admit this isn't my area

[Aaronontheweb]

I figured it out: https://aaronstannard.com/dotnet-sign-azure-devops/

[ChrisSfanos]

Hey @Aaronontheweb ! Thanks for writing that up! I'm going to hang on and share that out as I think folks will find it help in the Foundation as we move them all to dotnet/sign - appreciate it

[Aaronontheweb]

No problem!

[clairernovotny]

@Aaronontheweb, thanks for the write-up. Docs have been short. I would very strongly recommend never to run sign on a build agent for security reasons. Builds frequently pull in dependencies from all over and run all kinds of code in the process. There's a lot of room to compromise the signing step. By splitting sign onto its own stage and using artifacts to pass between them, it minimizes exposure to signing. This AzDo pipeline shows how:

https://github.com/novotnyllc/Zeroconf/blob/main/azure-pipelines.yml -- this one uses Trusted Signing

https://github.com/NuGetPackageExplorer/NuGetPackageExplorer/blob/main/azure-pipelines.yml#L203 -- this one uses Key Vault

[Aaronontheweb]

That's what I do internally (read your docs!) - but I just didn't fully dump all of that into the blog post because the YAML file was already a decent size. At the very end though you can see me publish the pipeline artifact, which gets consumed in other stages for NuGet push and GitHub artifact uploads later.

[MikeWilliams-UK]

I am looking forward to bringing our code signing for Chem4Word https://github.com/Chem4Word up to date so that we don't get caught out when the "old" way we are currently using is removed.