KX-11391 - SignFile replaced with AzureSignTool (#5)

* KX-11391 - SignFile replaced with AzureSignTool * KX-11391 - Update Directory.build.targets --------- Co-authored-by: Zdenek Strach <[email protected]>
Kentico · Mar 6, 2024 · 92e5de0 · 92e5de0
1 parent fd79b3e
commit 92e5de0
Show file tree

Hide file tree

Showing 4 changed files with 26 additions and 3 deletions.
diff --git a/.azuredevops/pipelines/build-and-release.yml b/.azuredevops/pipelines/build-and-release.yml
@@ -31,7 +31,7 @@ stages:
               - Agent.Name -equals ${{ parameters.AgentName }}
 
         variables:
-          - group: 14.0 Authenticode signature parameters
+          - group: Code Sign KV Auth
 
           - name: Configuration
             value: Release
@@ -67,6 +67,14 @@ stages:
               packageType: sdk
               useGlobalJson: true
 
+          - task: DotNetCoreCLI@2
+            displayName: Restore dotnet tools
+            inputs:
+              command: custom
+              custom: tool
+              arguments: restore
+              workingDirectory: $(System.DefaultWorkingDirectory)
+
           - task: DotNetCoreCLI@2
             displayName: Restore dependencies
             inputs:
@@ -95,6 +103,8 @@ stages:
               projects: ${{ variables.ProjectPath }}
               configuration: ${{ variables.Configuration }}
               arguments: --no-restore --verbosity Detailed
+            env:
+              AuthenticodeClientSecret: $(AuthenticodeClientSecret)
 
           - task: DotNetCoreCLI@2
             displayName: Create NuGet package

diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {
+    "azuresigntool": {
+      "version": "4.0.1",
+      "commands": [
+        "azuresigntool"
+      ]
+    }
+  }
+}
diff --git a/Directory.Build.props b/Directory.Build.props
@@ -32,6 +32,7 @@
     <CopyDebugSymbolFilesFromPackages>true</CopyDebugSymbolFilesFromPackages>
     <NoWarn>$(NoWarn);1591</NoWarn>
     <EnableDefaultEmbeddedResourceItems>false</EnableDefaultEmbeddedResourceItems>
+    <TimestampServerUrl>http://timestamp.digicert.com</TimestampServerUrl>
   </PropertyGroup>
 
   <PropertyGroup Condition=" $(Configuration) == 'Release' ">

diff --git a/Directory.build.targets b/Directory.build.targets
@@ -9,7 +9,7 @@
             <AssemblyToSign Include="$(XmlSerializersTargetPath)" Condition="Exists('$(XmlSerializersTargetPath)')" />
         </ItemGroup>
 
-        <SignFile CertificateThumbprint="$(AuthenticodeCertificateThumbprint)" TimestampUrl="http://time.certum.pl" SigningTarget="%(AssemblyToSign.Identity)" />
+        <Exec Command="dotnet AzureSignTool sign --azure-key-vault-url $(AuthenticodeKeyVaultUrl) --azure-key-vault-tenant-id $(AuthenticodeTenantId) --azure-key-vault-client-id $(AuthenticodeClientId) --azure-key-vault-client-secret $(AuthenticodeClientSecret) --azure-key-vault-certificate $(AuthenticodeCertificateName) --timestamp-rfc3161 $(TimestampServerUrl) --skip-signed %(AssemblyToSign.Identity)" />
     </Target>
 
     <ItemGroup>
@@ -18,4 +18,4 @@
         <None Remove="package.json" />
         <None Remove="*lock.json" />
     </ItemGroup>
-</Project>
+</Project>