Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sign the DAC and DBI during the build process instead of in separate steps #111416

Merged
merged 4 commits into from
Jan 28, 2025

Conversation

jkoritzinsky
Copy link
Member

@jkoritzinsky jkoritzinsky commented Jan 14, 2025

This provides a few benefits:

  • Signing the DAC in the VMR is possible
  • The singlefilehost can be built once with a signed DAC as a resource instead of being post-patched to have it.

The infrastructure to install the certs and pass them to ESRP has been validated with test certificates and a test Azure Key Vault. Actual signing validation hasn't been done yet (as the certs are really locked down and I can't validate the end-to-end).

Contributes to dotnet/source-build#4067

Copy link
Contributor

Tagging subscribers to this area: @hoyosjs
See info in area-owners.md if you want to be subscribed.

eng/native/sign-with-dac-certificate.ps1 Show resolved Hide resolved
eng/pipelines/install-diagnostic-certs.ps1 Outdated Show resolved Hide resolved
eng/native/sign-with-dac-certificate.ps1 Show resolved Hide resolved
eng/native/signing/input.template.json Outdated Show resolved Hide resolved
@jkoritzinsky
Copy link
Member Author

/ba-g timeouts are unrelated

@jkoritzinsky jkoritzinsky merged commit 9b24fb6 into dotnet:main Jan 28, 2025
142 of 151 checks passed
@jkoritzinsky jkoritzinsky deleted the dac-sign branch January 28, 2025 19:19
grendello added a commit to grendello/runtime that referenced this pull request Jan 28, 2025
* main: (31 commits)
  Fix linux-x86 build (dotnet#111861)
  Add FrozenDictionary specialization for integers / enums (dotnet#111886)
  [SRM] Refactor reading from streams. (dotnet#111323)
  Sign the DAC and DBI during the build process instead of in separate steps (dotnet#111416)
  Removing Entry2MethodDesc as it is unnecessary (dotnet#111756)
  Cross Product for Vector2 and Vector4 (dotnet#111265)
  Handle unicode in absolute URI path for combine. (dotnet#111710)
  Drop RequiresProcessIsolation on mcc tests (dotnet#111887)
  [main] Update dependencies from dotnet/roslyn (dotnet#111691)
  new trimmer feature System.TimeZoneInfo.Invariant (dotnet#111215)
  [browser] reduce msbuild memory footprint (dotnet#111751)
  Add debugging checks for stack overflow tests failure (dotnet#111867)
  Localized file check-in by OneLocBuild Task: Build definition ID 679: Build ID 2629821 (dotnet#111884)
  Bump main to preview2 (dotnet#111882)
  Avoid generic virtual dispatch for frozen collections alternate lookup (dotnet#108732)
  Bump main versioning to preview1 (dotnet#111880)
  Switch OneLoc to main (dotnet#111872)
  Improve docs on building ILVerify (dotnet#111851)
  Update Debian version to 13 (dotnet#111768)
  win32: add fallback to environment vars for system folder (dotnet#109673)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

2 participants