From 0e3c8463954e1ccc556cc79536828cffdaee12f6 Mon Sep 17 00:00:00 2001
From: Jeremy Koritzinsky <jekoritz@microsoft.com>
Date: Tue, 15 Oct 2024 14:48:31 -0700
Subject: [PATCH 1/3] Enable using -sign in VMR scenarios

---
 eng/Signing.props | 54 +++++++++++++++++++++++------------------------
 1 file changed, 26 insertions(+), 28 deletions(-)

diff --git a/eng/Signing.props b/eng/Signing.props
index f76a7aa22c248..429a7ec4484b7 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -1,21 +1,9 @@
 <Project>
   <PropertyGroup>
-    <!--
-      Windows arm/arm64 jobs don't have MSIs to sign. Keep it simple: allow not finding any matches
-      here and rely on overall signing validation.
-
-      During post build signing, there are no packages to sign during SignFinalPackages.
-    -->
-    <AllowEmptySignList>true</AllowEmptySignList>
+    <EnableDefaultArtifacts Condition="'$(DotNetBuild)' != 'true'">false</EnableDefaultArtifacts>
   </PropertyGroup>
 
   <ItemGroup>
-    <!--
-      Replace the default items to sign with the specific set we want. This allows the build to call
-      Arcade's Sign.proj multiple times for different sets of files as the build progresses.
-    -->
-    <ItemsToSign Remove="@(ItemsToSign)" />
-
     <!-- apphost and comhost template files are not signed, by design. -->
     <FileSignInfo Include="apphost.exe;singlefilehost.exe;comhost.dll" CertificateName="None" />
 
@@ -37,12 +25,6 @@
     <FileSignInfo Include="Mono.Cecil.Pdb.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="Mono.Cecil.Rocks.dll" CertificateName="3PartySHA2" />
 
-    <!-- Exclude symbol packages from have a NuGet signature. These are never pushed to NuGet.org or
-         other feeds (in fact, that have identical identity to their non-symbol variant) -->
-    <DownloadedSymbolPackages Include="$(DownloadDirectory)**\*.symbols.nupkg" />
-    <DownloadedSymbolPackagesWithoutPaths Include="@(DownloadedSymbolPackages->'%(Filename)%(Extension)')" />
-    <FileSignInfo Include="@(DownloadedSymbolPackagesWithoutPaths->Distinct())" CertificateName="None" />
-
     <FileExtensionSignInfo Include=".msi" CertificateName="MicrosoftDotNet500" />
     <FileExtensionSignInfo Include=".pkg" CertificateName="8003" />
     <FileExtensionSignInfo Include=".deb;.rpm" CertificateName="LinuxSign" />
@@ -55,14 +37,30 @@
     <FileSignInfo Update="@(FileSignInfo->WithMetadataValue('CertificateName','Microsoft400'))" CertificateName="MicrosoftDotNet500" />
   </ItemGroup>
 
-  <ItemGroup Condition="'$(PrepareArtifacts)' == 'true'">
-    <ItemsToSignWithPaths Include="$(DownloadDirectory)**\*.msi" />
-    <ItemsToSignWithPaths Include="$(DownloadDirectory)**\*.exe" />
-    <ItemsToSignWithPaths Include="$(DownloadDirectory)**\*.nupkg" />
-    <ItemsToSignWithPaths Include="$(DownloadDirectory)**\*.zip" />
+  <!-- In build signing and publishing without a join point -->
+  <ItemGroup Condition="'$(DotNetBuild)' == 'true'">
+    <Artifact Include="$(ArtifactsPackagesDir)**\*.tar.gz;
+                       $(ArtifactsPackagesDir)**\*.zip;
+                       $(ArtifactsPackagesDir)**\*.deb;
+                       $(ArtifactsPackagesDir)**\*.rpm;
+                       $(ArtifactsPackagesDir)**\*.pkg;
+                       $(ArtifactsPackagesDir)**\*.exe;
+                       $(ArtifactsPackagesDir)**\*.msi"
+              Exclude="$(ArtifactsPackagesDir)**\Symbols.runtime.tar.gz"
+              IsShipping="$([System.String]::Copy('%(RecursiveDir)').StartsWith('Shipping'))">
+      <!-- Exclude wixpack.zip files from checksum generation -->
+      <ChecksumPath Condition="$([System.String]::Copy('%(Filename)%(Extension)').EndsWith('.wixpack.zip')) != 'true'">%(FullPath).sha512</ChecksumPath>
+    </Artifact>
+  </ItemGroup>
 
-    <ItemsToSignWithoutPaths Include="@(ItemsToSignWithPaths->'%(Filename)%(Extension)')" />
-    <ItemsToSignPostBuild Include="@(ItemsToSignWithoutPaths->Distinct())" Condition="'$(PostBuildSign)' == 'true'" />
-    <ItemsToSign Include="@(ItemsToSignWithPaths->Distinct())" Condition="'$(PostBuildSign)' != 'true'" />
+  <!-- Only the following artifacts should be signed.
+       Set SkipPublish=true as those artifacts are added again in Publishing.props. -->
+  <ItemGroup Condition="'$(DotNetBuild)' != 'true'">
+    <Artifact Include="$(DownloadDirectory)**\*.msi;
+                       $(DownloadDirectory)**\*.exe;
+                       $(DownloadDirectory)**\*.nupkg;
+                       $(DownloadDirectory)**\*.zip"
+              SkipPublish="true" />
   </ItemGroup>
-</Project>
+
+</Project>
\ No newline at end of file

From 0d045ee7bde0a97d4535112fb02cfe667ab01af1 Mon Sep 17 00:00:00 2001
From: Jeremy Koritzinsky <jekoritz@microsoft.com>
Date: Tue, 15 Oct 2024 14:51:08 -0700
Subject: [PATCH 2/3] Remove old PrepareArtifacts controls and remove remaining
 infrastructure from multi-phase signing (which has been removed since
 wixpacks were added)

---
 eng/SubsetValidation.targets         |  6 ------
 eng/Subsets.props                    |  6 +++---
 src/installer/prepare-artifacts.proj | 12 ++----------
 3 files changed, 5 insertions(+), 19 deletions(-)

diff --git a/eng/SubsetValidation.targets b/eng/SubsetValidation.targets
index 182f711594142..e8e2a22465f26 100644
--- a/eng/SubsetValidation.targets
+++ b/eng/SubsetValidation.targets
@@ -5,12 +5,6 @@
     Each subset has its own '<subset>Project' items so that a project in the build can depend
     on a whole subset, and the dependency on the subset is disregarded automatically when Subset
     doesn't contain it.
-
-    %(ProjectToBuild.SignPhase): Indicates this project must be built before a certain signing
-      phase. Projects can depend on 'signing/stages/Sign<stage>.proj' to wait until all projects
-      that are part of a stage are complete. This allows the build to perform complex container
-      signing that isn't (can't be?) supported by Arcade's single pass, such as MSIs and bundles:
-      https://github.com/dotnet/arcade/issues/388
   -->
 
   <Target Name="FindInvalidSpecifiedSubsetNames">
diff --git a/eng/Subsets.props b/eng/Subsets.props
index d2ed52fb20114..d23e0690d6a90 100644
--- a/eng/Subsets.props
+++ b/eng/Subsets.props
@@ -462,17 +462,17 @@
 
   <!-- Host sets -->
   <ItemGroup Condition="$(_subset.Contains('+host.native+'))">
-    <CorehostProjectToBuild Include="$(SharedNativeRoot)corehost\corehost.proj" SignPhase="Binaries" />
+    <CorehostProjectToBuild Include="$(SharedNativeRoot)corehost\corehost.proj" />
     <ProjectToBuild Include="@(CorehostProjectToBuild)" AdditionalProperties="$(TargetCxxLibraryProperties)" Pack="true" Category="host" />
   </ItemGroup>
 
   <ItemGroup Condition="$(_subset.Contains('+host.tools+'))">
-    <ManagedProjectToBuild Include="$(InstallerProjectRoot)managed\**\*.csproj" SignPhase="Binaries" />
+    <ManagedProjectToBuild Include="$(InstallerProjectRoot)managed\**\*.csproj" />
     <ProjectToBuild Include="@(ManagedProjectToBuild)" BuildInParallel="true" Pack="true" Category="host" />
   </ItemGroup>
 
   <ItemGroup Condition="$(_subset.Contains('+host.pkg+')) and '$(BuildOnlyPgoInstrumentedAssets)' != 'true'">
-    <PkgprojProjectToBuild Include="$(InstallerProjectRoot)pkg\projects\host-packages.proj" SignPhase="MsiFiles" />
+    <PkgprojProjectToBuild Include="$(InstallerProjectRoot)pkg\projects\host-packages.proj" />
     <ProjectToBuild Include="@(PkgprojProjectToBuild)" Pack="true" Category="host" />
   </ItemGroup>
 
diff --git a/src/installer/prepare-artifacts.proj b/src/installer/prepare-artifacts.proj
index 393b50eafe206..f4e30a2efdd1f 100644
--- a/src/installer/prepare-artifacts.proj
+++ b/src/installer/prepare-artifacts.proj
@@ -15,12 +15,9 @@
 
   <!-- When doing post build sign, pull in the arcade sign.props file, which will
        create some initial sign groups and then pulls in the repo's custom Signing.props overrides.
-       Before importing the signing props. Set PrepareArtifactst=true. Depending on context (SDK project vs. not),
+       Before importing the signing props. Depending on context (SDK project vs. not),
        the initial imports of livebuilds.targets and Configuration.props are already imported and thus cannot
        be imported again. Without those imports, the globbing of files to sign will not work properly. -->
-  <PropertyGroup>
-    <PrepareArtifacts>true</PrepareArtifacts>
-  </PropertyGroup>
   <Import Project="../tools/Sign.props" Sdk="Microsoft.DotNet.Arcade.Sdk" />
 
   <Import Project="$(RepositoryEngineeringDir)Publishing.props" Condition="Exists('$(RepositoryEngineeringDir)Publishing.props')" />
@@ -68,18 +65,13 @@
     </ItemsToPush>
   </ItemDefinitionGroup>
 
-  <!--
-    Run Arcade's signing project directly. The 'eng/Signing.props' extensibility props file checks
-    if '$(<StageName>)' == 'true' and points Arcade to the correct files.
-  -->
   <Target Name="SignArtifacts"
           Condition="'$(PostBuildSign)' != 'true'" >
     <MSBuild
       Projects="$(ArcadeSdkSignProject)"
       Targets="Sign"
       Properties="
-        DownloadDirectory=$(DownloadDirectory);
-        PrepareArtifacts=$(PrepareArtifacts)" />
+        DownloadDirectory=$(DownloadDirectory)" />
   </Target>
 
   <!--

From 9482d1158d0e54bd02946c5ee56a8237044d9f1e Mon Sep 17 00:00:00 2001
From: Jeremy Koritzinsky <jekoritz@microsoft.com>
Date: Tue, 15 Oct 2024 15:04:16 -0700
Subject: [PATCH 3/3] Enable signing when we're invoked with `-sign` in a VMR
 scenario

---
 eng/DotNetBuild.props | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/eng/DotNetBuild.props b/eng/DotNetBuild.props
index fbf7cbb183e9b..26ee228da3e18 100644
--- a/eng/DotNetBuild.props
+++ b/eng/DotNetBuild.props
@@ -42,8 +42,9 @@
            This allows to build the repository using './build.sh <args> /p:DotNetBuildSourceOnly=true'.
            Properties that control flags from the VMR build, and the expected output for the VMR build should be added to this file. -->
 
-      <!-- Enable regular Arcade publishing in VMR build -->
+      <!-- Enable regular Arcade signing and publishing in VMR build -->
       <InnerBuildArgs Condition="'$(DotNetBuildOrchestrator)' == 'true'">$(InnerBuildArgs) $(FlagParameterPrefix)restore $(FlagParameterPrefix)build $(FlagParameterPrefix)publish</InnerBuildArgs>
+      <InnerBuildArgs Condition="'$(DotNetBuildOrchestrator)' == 'true' and '$(Sign)' == 'true'">$(InnerBuildArgs) $(FlagParameterPrefix)sign</InnerBuildArgs>
 
       <InnerBuildArgs>$(InnerBuildArgs) $(FlagParameterPrefix)arch $(TargetArch)</InnerBuildArgs>
       <InnerBuildArgs Condition="'$(DotNetBuildSourceOnly)' != 'true'">$(InnerBuildArgs) $(FlagParameterPrefix)os $(TargetOS)</InnerBuildArgs>