Wrong timestamp with English (Denmark) regional settings when signing a .VSIX

[ErikEJ]

Describe the bug

Using "Recommended" which was "English (Denmark)"

Certificate is invalid, as the format of the signaturetime does not match the value

<SignatureTime xmlns="http://schemas.openxmlformats.org/package/2006/digital-signature"><Format>YYYY-MM-DDThh:mm:ss.sTZD</Format><Value>2025-03-24T10.56.12.2-07:00</Value></SignatureTime>
Repro steps

sign code certificate-store -cfp ABC... -k BEEF -csp "SimplySign CSP" -t http://time.certum.pl "EF Core Power Pack v2.6.959.vsix"

Additional context

as you can see I am signing a .vsix file. I had my regional settings set to English (Denmark). Switching to Danish (Denmark) fixes the issue, and produces a valid cert

<SignatureTime xmlns="http://schemas.openxmlformats.org/package/2006/digital-signature"><Format>YYYY-MM-DDThh:mm:ss.sTZD</Format><Value>2025-03-24T11:20:22.5-07:00</Value></SignatureTime>

• Include the output of sign --version. : 0.9.1-beta.25169.2+c14370f70687ab46f23e7dbcaf1a401ca2a0c494
• Include the output of dotnet --info.

.NET SDK:
 Version:           9.0.201
 Commit:            071aaccdc2
 Workload version:  9.0.200-manifests.a3a1a094
 MSBuild version:   17.13.13+1c2026462

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.26100
 OS Platform: Windows
 RID:         win-x64
 Base Path:   C:\Program Files\dotnet\sdk\9.0.201\

.NET workloads installed:
There are no installed workloads to display.
Configured to use loose manifests when installing new manifests.

Host:
  Version:      9.0.3
  Architecture: x64
  Commit:       831d23e561

.NET SDKs installed:
  8.0.407 [C:\Program Files\dotnet\sdk]
  9.0.201 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 8.0.14 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 9.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 8.0.14 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 9.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 8.0.14 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 9.0.3 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
  x86   [C:\Program Files (x86)\dotnet]
    registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables:
  Not set

global.json file:
  Not found

[ErikEJ]

Most likely caused by this: https://github.com/vcsjones/OpenOpcSignTool/blob/main/src/OpenVsixSignTool.Core/XmlSignatureBuilder.cs#L209

[ErikEJ]

Ah, you pulled in the code https://github.com/dotnet/sign/blob/main/src/Sign.Core/Tools/VsixSignTool/XmlSignatureBuilder.cs#L229

[dtivel]

@ErikEJ, thanks for the bug report. I have a fix (#839) in review.

[dtivel]

@ErikEJ, the fix should be in https://www.nuget.org/packages/sign/0.9.1-beta.25181.2.

[ErikEJ]

@dtivel Wonderful, and thanks for a great tool helping OSS developers.

Now we just need simple pipeline based NuGet signing of NuGet packages with Azure Trusted Signing as an affordable and flexible signing solution, that is usable on a build agent.