Feature request: Support full-signing when running on CoreCLR.

[joperezr]

On corefx repo, we started using an Open key to fully sign some of our libraries. This key contains both public and private keys, and can be located here. This worked fine in Windows with the Full MSBuild and x-plat with Mono MSBuild, but it started failing x-plat once we moved to .Net Core MSBuild and the portable compilers. The exception we get is:

CSC : error CS7027: Error signing output with public key from file '.../corefx/Tools/Open.snk' -- Cannot marshal 'return value': Invalid managed [.../corefx/src/System.Diagnostics.DiagnosticSource/src/System.Diagnostics.DiagnosticSource.csproj]

We would really like this issue to get addressed so that we are able to fully sign this libraries in non-Windows builds.

[joperezr]

cc @weshaggard @agocke

[agocke]

This may be an issue with my snk file parser, I'll take it.

[agocke]

Looks like this works in dotnet cli. Can you provide an isolated repro?

[joperezr]

@agocke sorry it took so long to respond, sure there is an easy way to repro this exact scenario. If you remove this line from that file, and then try to build the latest corefx in Ubuntu or OSX you should get an exception like the one previously specified. If you need any more info, please let me know.

[agocke]

I looked through the corefx repo. As far as I can tell, you're not actually setting public sign anywhere in the repo, even after disabling that property. Checking the msbuild log, there is no /publicsign parameter being passed. The error message produced is thus the failure of the compiler to real sign on Linux/Mac.

I'm going to close this for now -- if new info is found then we can re-open.

[weshaggard]

@agocke I'm a little unclear what you are suggesting. Are you suggesting you cannot repro it or that we are just missing an extra flag we need to pass? Even if there is an extra property that isn't getting set it seems like the error message should be improved.

[agocke]

@weshaggard You're right about the error message -- I've filed #9288 to address that.

As to this bug, I understood this to be an issue with public sign -- full signing is not currently supported on coreclr. Did you want to re-categorize as a feature request?

[weshaggard]

Yes we should re-categorize it as a feature request because it is something I think we need to support.

[agocke]

@weshaggard Do you have a corefx bug we can follow? :) Roslyn currently PInvokes to the CLR for signing support and we'll continue to either use a CLR or CoreFX signing utility for full signing.

[tmat]

Re full signing - we have discussed this already. @jkotas wrote a prototype. I think we can productize that code in the new PE writer.

[joperezr]

@agocke Is there any kind of ETA of when this feature might come online? We are hitting some issues in corefx given that this is not yet supported.

[agocke]

@joperezr No ETA, sorry.

[agocke]

@jaredpar Have we costed this at all?

[eerhardt]

@jaredpar - Any plan when this will be fixed? This works with project.json based projects, but doesn't for MSBuild projects.

[jaredpar]

Update on this: the work to do strong name signing on CoreClr is complete. It did not make the cut off for the Dev15.5 release but will be in the following release. It should be merged in one of the main branches in the next few days.

[jnm2]

Thanks! Good to know because I was considering sinking some time into a workaround package.

[ghost]

strong name signing on CoreClr is complete

Couldn't find any reference to a pull-request, could you provide one?

It should be merged in one of the main branches in the next few days.

Reference to this issue in pull request would be great when that happens. Must be interesting to see work done that took about 23 months.

[jaredpar]

Here is the PR that merged this into the post-dev15.5-contrib branch. This is "master" for our dev15.6 work.

#23061

[nguerrera]

👏

[akoeplinger]

For the record: the new cross-plat strong name signing provider works fine on Mono too 😄 (tested with Roslyn 2.7.0.62620)