Signing validation failure: unsigned files in source-built artifacts

[ellahathaway]

Summary

Signing validation is failing on signed builds with numerous unsigned files detected by SignCheck. The issue is present on both Linux and Mac validation jobs in the VMR Validation stage.

Example Failing build: https://dev.azure.com/dnceng/internal/_build/results?buildId=2939584

Affected Artifacts

The unsigned files trace back to the following source-build artifacts for the centos.10-x64 platform:

• Private.SourceBuilt.Artifacts.*.centos.10-x64.tar.gz
• dotnet-sdk-*.centos.10-x64.tar.gz

Symptom

Files within these archives are AuthentiCode signed but are missing StrongName signing (StrongName signed: False). SignCheck reports these as Outcome="Unsigned".

Notes

This does not appear to affect MSFT artifacts — only the source-build produced artifacts for centos.10-x64 are implicated.

[ellahathaway]

I pulled one of the reported files (Microsoft.TemplateEngine.Edge.resources.dll) from the artifacts and verified it is strong named. The assemblies themselves appear to be signed correctly.

This issue appears to have surfaced when the ValidateSigning_Linux job was moved to run inside a container (mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-3.0-net10.0-build-amd64) in dotnet/dotnet@c57f505. Something about that container environment is likely causing SignCheck to incorrectly report these assemblies as not strong named.

Build where the files were reported as unsigned: https://dev.azure.com/dnceng/internal/_build/results?buildId=2929085&view=logs&j=0206f2f7-7000-5b5b-9d34-17a4f76a4674&t=59de5ac3-efa8-51b1-27d8-06753729dea6