Fix NTVS insertion SignCheck: resolve makecat.exe from the Windows SDK - #2556
Merged
Conversation
The GenerateContentCatalog target invoked a bare `makecat.exe`, which is not on PATH on the official build agents. It failed with exit code 9009 and, because the Exec used IgnoreExitCode=true, the .cat was silently never produced, signed, or bundled into the VSIX. Insertions therefore shipped 33 unsigned .js/.xml template files and were rejected by the VS insertion SignCheck. Resolve makecat.exe explicitly from the Windows 10 SDK (ToolLocationHelper with a registry fallback) and fail the build loudly if the catalog cannot be produced, so an unsigned payload can never ship silently again. Bug: 2982241 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2
makecat.exe cannot hash a 0-byte file: it aborts with 'NOT processed: calculating the indirect data' / 'Errors found in parsing the CDF file' and produces no catalog. EmptyJs.js is a 0-byte placeholder template, so it broke catalog generation once the makecat.exe exit code was no longer ignored. Filter zero-byte files out of the catalog source list via a RoslynCodeTaskFactory inline task before writing the CDF. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2
Two bugs prevented the content catalog from actually protecting the template files, so the build went green while still shipping 32 unsigned .js/.xml files: 1. _CatalogSourceDir used '..\Nodejs\...' / '..\..\Extras' / '..\TestAdapter\...', which resolve one level too high from Nodejs\Product\ and do not exist, so zero files were collected and makecat never ran (guarded on count > 0). 2. IncludeCatalogInVsix hooked BeforeTargets=CreateVsixContainer, but CreateVsixContainer depends on GetVsixSourceItems, which had already enumerated the package contents - so the signed .cat was never added to the VSIX. Hook BeforeTargets=GetVsixSourceItems instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2
makecat keeps only one entry per member name, so template files that share a basename across directories (the five UnitTest.js item templates and the six roletemplatedata.xml cloud-role templates) collided under a single '<hash>UnitTest.js' / '<hash>roletemplatedata.xml' tag - only the first was cataloged and the other 9 shipped unsigned. Assign a unique CatTag (index_filename) per file in the CDF. Verified locally: NodejsToolsVsix 26/26 and TestAdapterVsix 12/12 non-empty js/xml now covered. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2
The 0-byte EmptyJs.js template cannot be hashed by makecat, leaving it uncovered by the content catalog and flagged by the VS Insertion Sign Check. Add a minimal newline so all 33 shipped template files are catalog-signed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2
Sabrina Faceroli Tridico (safacero)
approved these changes
Jul 10, 2026
lucygramley
added a commit
that referenced
this pull request
Aug 19, 2026
#2556) * Fix content catalog signing: resolve makecat.exe from Windows SDK The GenerateContentCatalog target invoked a bare `makecat.exe`, which is not on PATH on the official build agents. It failed with exit code 9009 and, because the Exec used IgnoreExitCode=true, the .cat was silently never produced, signed, or bundled into the VSIX. Insertions therefore shipped 33 unsigned .js/.xml template files and were rejected by the VS insertion SignCheck. Resolve makecat.exe explicitly from the Windows 10 SDK (ToolLocationHelper with a registry fallback) and fail the build loudly if the catalog cannot be produced, so an unsigned payload can never ship silently again. Bug: 2982241 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2 * Exclude zero-byte files from content catalog makecat.exe cannot hash a 0-byte file: it aborts with 'NOT processed: calculating the indirect data' / 'Errors found in parsing the CDF file' and produces no catalog. EmptyJs.js is a 0-byte placeholder template, so it broke catalog generation once the makecat.exe exit code was no longer ignored. Filter zero-byte files out of the catalog source list via a RoslynCodeTaskFactory inline task before writing the CDF. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2 * Fix catalog source paths and VSIX embedding hook Two bugs prevented the content catalog from actually protecting the template files, so the build went green while still shipping 32 unsigned .js/.xml files: 1. _CatalogSourceDir used '..\Nodejs\...' / '..\..\Extras' / '..\TestAdapter\...', which resolve one level too high from Nodejs\Product\ and do not exist, so zero files were collected and makecat never ran (guarded on count > 0). 2. IncludeCatalogInVsix hooked BeforeTargets=CreateVsixContainer, but CreateVsixContainer depends on GetVsixSourceItems, which had already enumerated the package contents - so the signed .cat was never added to the VSIX. Hook BeforeTargets=GetVsixSourceItems instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2 * Give each catalog member a unique tag to prevent hash drop-out makecat keeps only one entry per member name, so template files that share a basename across directories (the five UnitTest.js item templates and the six roletemplatedata.xml cloud-role templates) collided under a single '<hash>UnitTest.js' / '<hash>roletemplatedata.xml' tag - only the first was cataloged and the other 9 shipped unsigned. Assign a unique CatTag (index_filename) per file in the CDF. Verified locally: NodejsToolsVsix 26/26 and TestAdapterVsix 12/12 non-empty js/xml now covered. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2 * Make EmptyJs.js template non-empty so it can be catalog-signed The 0-byte EmptyJs.js template cannot be hashed by makecat, leaving it uncovered by the content catalog and flagged by the VS Insertion Sign Check. Add a minimal newline so all 33 shipped template files are catalog-signed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Joaquin Jares (joj)
pushed a commit
that referenced
this pull request
Aug 24, 2026
#2556) * Fix content catalog signing: resolve makecat.exe from Windows SDK The GenerateContentCatalog target invoked a bare `makecat.exe`, which is not on PATH on the official build agents. It failed with exit code 9009 and, because the Exec used IgnoreExitCode=true, the .cat was silently never produced, signed, or bundled into the VSIX. Insertions therefore shipped 33 unsigned .js/.xml template files and were rejected by the VS insertion SignCheck. Resolve makecat.exe explicitly from the Windows 10 SDK (ToolLocationHelper with a registry fallback) and fail the build loudly if the catalog cannot be produced, so an unsigned payload can never ship silently again. Bug: 2982241 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2 * Exclude zero-byte files from content catalog makecat.exe cannot hash a 0-byte file: it aborts with 'NOT processed: calculating the indirect data' / 'Errors found in parsing the CDF file' and produces no catalog. EmptyJs.js is a 0-byte placeholder template, so it broke catalog generation once the makecat.exe exit code was no longer ignored. Filter zero-byte files out of the catalog source list via a RoslynCodeTaskFactory inline task before writing the CDF. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2 * Fix catalog source paths and VSIX embedding hook Two bugs prevented the content catalog from actually protecting the template files, so the build went green while still shipping 32 unsigned .js/.xml files: 1. _CatalogSourceDir used '..\Nodejs\...' / '..\..\Extras' / '..\TestAdapter\...', which resolve one level too high from Nodejs\Product\ and do not exist, so zero files were collected and makecat never ran (guarded on count > 0). 2. IncludeCatalogInVsix hooked BeforeTargets=CreateVsixContainer, but CreateVsixContainer depends on GetVsixSourceItems, which had already enumerated the package contents - so the signed .cat was never added to the VSIX. Hook BeforeTargets=GetVsixSourceItems instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2 * Give each catalog member a unique tag to prevent hash drop-out makecat keeps only one entry per member name, so template files that share a basename across directories (the five UnitTest.js item templates and the six roletemplatedata.xml cloud-role templates) collided under a single '<hash>UnitTest.js' / '<hash>roletemplatedata.xml' tag - only the first was cataloged and the other 9 shipped unsigned. Assign a unique CatTag (index_filename) per file in the CDF. Verified locally: NodejsToolsVsix 26/26 and TestAdapterVsix 12/12 non-empty js/xml now covered. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2 * Make EmptyJs.js template non-empty so it can be catalog-signed The 0-byte EmptyJs.js template cannot be hashed by makecat, leaving it uncovered by the content catalog and flagged by the VS Insertion Sign Check. Add a minimal newline so all 33 shipped template files are catalog-signed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2f944511-9280-4ed2-aa0c-045bd63b66f2 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
VS insertions of Node.js Tools are rejected by the Insertion Sign Check with 33 unsigned
.js/.xmlfilesFix
In
Nodejs/Product/ProjectAfter.targets:makecat.exeexplicitly from the Windows 10 SDKThe catalog target only runs for signed builds (
SignType != ''), so local/dev builds are unaffected.Verification
...\Windows Kits\10\bin\10.0.26100.0\x64\makecat.exe(exists). The CI agent has the same SDK (it resolvesresgen.exefrom the Windows SDK in the same build).Bug: 2982241