Skip to content

Commit c974f16

Browse files
jesuszaratejesuszarate
committed
Add catalog signing for .js files and direct signing for .cab files
The VS signing scan requires every signable file to carry its own signature. The Mono workload packs contain 480 unsigned files: - 198 .js files (browser-wasm runtime scripts) - 282 .cab files (WiX cabinet archives inside MSIs) For .js files: keep CertificateName=None (same as dotnet/emsdk#1671) because these are customer-modifiable runtime files. Instead, generate a .cat catalog file covering all .js files, signed via FileExtensionSignInfo for .cat. The GenerateCatalogFiles target runs after AddMonoRuntimeFiles on Windows browser-wasm builds. For .cab files: add FileExtensionSignInfo with Microsoft400 so the Arcade SDK SignTool signs them directly. Both Microsoft400 entries are auto-replaced by MicrosoftDotNet500 since UseDotNetCertificate=true. Tracking: https://devdiv.visualstudio.com/DevDiv/_workitems/edit/2911494
1 parent 335fa34 commit c974f16

3 files changed

Lines changed: 124 additions & 2 deletions

File tree

‎eng/Signing.props‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,13 @@
4949
<MacOSPkg Include="$(ArtifactsPackagesDir)**/dotnet-runtime*.pkg" Exclude="$(ArtifactsPackagesDir)**/dotnet-runtime-internal*.pkg" />
5050
<FileSignInfo Include="@(MacOSPkg->'%(Filename)%(Extension)')" CertificateName="MacDeveloperWithNotarization" />
5151

52-
<!-- We don't need to code sign .js files because they are not used in Windows Script Host. -->
53-
<!-- WARNING: Needs to happed outside of any target -->
52+
<!-- JS files are customer-modifiable runtime/toolchain files. They cannot be
53+
Authenticode-signed because modifying a signed file breaks the signature.
54+
Instead, a catalog file (.cat) is generated and signed to provide integrity
55+
verification. See the GenerateCatalogFiles target in eng/mono.proj. -->
5456
<FileExtensionSignInfo Update=".js" CertificateName="None" />
57+
<FileExtensionSignInfo Include=".cab" CertificateName="Microsoft400" />
58+
<FileExtensionSignInfo Include=".cat" CertificateName="Microsoft400" />
5559

5660
<!-- Third-party components which should be signed. -->
5761
<FileSignInfo Include="Antlr4.Runtime.Standard.dll" CertificateName="3PartySHA2" />

‎eng/generate-catalog.ps1‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
<#
2+
.SYNOPSIS
3+
Generates a catalog definition file (.cdf) and catalog file (.cat) for all .js files
4+
in the specified root directory. Used for VS signing compliance - the .js files are
5+
customer-modifiable and cannot be directly Authenticode-signed.
6+
7+
.PARAMETER RootPath
8+
Root directory to search for .js files recursively.
9+
10+
.PARAMETER CatOutputPath
11+
Full path for the output .cat file.
12+
#>
13+
param(
14+
[Parameter(Mandatory)][string]$RootPath,
15+
[Parameter(Mandatory)][string]$CatOutputPath,
16+
[string]$WindowsSdkDir = '',
17+
[switch]$ErrorIfMakecatNotFound
18+
)
19+
20+
$ErrorActionPreference = 'Stop'
21+
22+
$cdfPath = [System.IO.Path]::ChangeExtension($CatOutputPath, '.cdf')
23+
24+
$files = Get-ChildItem -Path $RootPath -Recurse -Filter '*.js' -File
25+
if ($files.Count -eq 0) {
26+
Write-Warning "No .js files found under $RootPath - skipping catalog generation."
27+
exit 0
28+
}
29+
30+
$cdf = @()
31+
$cdf += '[CatalogHeader]'
32+
$cdf += "Name=$CatOutputPath"
33+
$cdf += 'CatalogVersion=2'
34+
$cdf += 'HashAlgorithms=SHA256'
35+
$cdf += ''
36+
$cdf += '[CatalogFiles]'
37+
38+
$i = 0
39+
foreach ($f in $files) {
40+
$label = "js_${i}_" + ($f.Name -replace '[^\w\.-]', '_')
41+
$cdf += "<hash>$label=$($f.FullName)"
42+
$i++
43+
}
44+
45+
$cdf | Set-Content -Path $cdfPath -Encoding ASCII
46+
Write-Host "Generated CDF with $($files.Count) .js files at $cdfPath"
47+
48+
$catDir = [System.IO.Path]::GetDirectoryName($CatOutputPath)
49+
if (-not (Test-Path $catDir)) {
50+
New-Item -ItemType Directory -Path $catDir -Force | Out-Null
51+
}
52+
53+
# Find makecat.exe - it ships with the Windows SDK and may not be on PATH.
54+
$makecat = $null
55+
if ($WindowsSdkDir -and (Test-Path $WindowsSdkDir)) {
56+
$makecat = Get-ChildItem -Path (Join-Path $WindowsSdkDir 'bin') -Recurse -Filter 'makecat.exe' -File |
57+
Where-Object { $_.DirectoryName -match 'x64' } |
58+
Sort-Object DirectoryName -Descending |
59+
Select-Object -First 1
60+
}
61+
62+
if (-not $makecat) {
63+
$makecat = Get-Command makecat.exe -ErrorAction SilentlyContinue
64+
}
65+
66+
if (-not $makecat) {
67+
# Fallback: search common Windows SDK locations
68+
$sdkRoot = "${env:ProgramFiles(x86)}\Windows Kits\10\bin"
69+
if (Test-Path $sdkRoot) {
70+
$makecat = Get-ChildItem -Path $sdkRoot -Recurse -Filter 'makecat.exe' -File |
71+
Where-Object { $_.DirectoryName -match 'x64' } |
72+
Sort-Object DirectoryName -Descending |
73+
Select-Object -First 1
74+
}
75+
}
76+
77+
if (-not $makecat) {
78+
if ($ErrorIfMakecatNotFound) {
79+
throw "makecat.exe not found. Catalog signing requires the Windows SDK which must be available in CI builds."
80+
}
81+
Write-Warning "makecat.exe not found - skipping catalog generation. Catalog signing requires the Windows SDK."
82+
exit 0
83+
}
84+
85+
$makecatPath = if ($makecat -is [System.Management.Automation.CommandInfo]) { $makecat.Source } else { $makecat.FullName }
86+
Write-Host "Using makecat.exe at: $makecatPath"
87+
88+
& $makecatPath $cdfPath
89+
if ($LASTEXITCODE -ne 0) {
90+
throw "makecat.exe failed with exit code $LASTEXITCODE"
91+
}
92+
93+
Write-Host "Generated catalog file: $CatOutputPath"

‎src/installer/pkg/sfx/Microsoft.NETCore.App/Microsoft.NETCore.App.Runtime.Mono.sfxproj‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,4 +70,29 @@
7070
<ReferenceCopyLocalPaths Include="@(MonoRuntimeFiles)" />
7171
</ItemGroup>
7272
</Target>
73+
74+
<!--
75+
Generate a catalog (.cat) file covering all .js files in the runtime pack.
76+
The .js files are customer-modifiable runtime/toolchain files that cannot be
77+
directly Authenticode-signed. The .cat provides integrity verification without
78+
preventing modification. Only runs on Windows (makecat.exe is a Windows SDK tool)
79+
and only for browser-wasm packs which contain .js files.
80+
-->
81+
<Target Name="GenerateCatalogFiles" AfterTargets="AddMonoRuntimeFiles"
82+
Condition="$([MSBuild]::IsOSPlatform('Windows')) and '$(RuntimeIdentifier)' == 'browser-wasm'">
83+
<PropertyGroup>
84+
<_CatOutputPath>$(ArtifactsObjDir)mono-pack\mono-runtime-js.cat</_CatOutputPath>
85+
<_ErrorIfMakecatNotFound Condition="'$(ContinuousIntegrationBuild)' == 'true' or '$(OfficialBuild)' == 'true'">-ErrorIfMakecatNotFound</_ErrorIfMakecatNotFound>
86+
</PropertyGroup>
87+
88+
<Exec Command="powershell.exe -NoProfile -ExecutionPolicy Bypass -Command &quot;&amp; '$(RepoRoot)eng\generate-catalog.ps1' -RootPath '$(MonoObjDir)' -CatOutputPath '$(_CatOutputPath)' -WindowsSdkDir '$(WindowsSdkDir)' $(_ErrorIfMakecatNotFound)&quot;" StandardOutputImportance="High" />
89+
90+
<ItemGroup Condition="Exists('$(_CatOutputPath)')">
91+
<ReferenceCopyLocalPaths Include="$(_CatOutputPath)">
92+
<TargetPath>runtimes/$(RuntimeIdentifier)/native/mono-runtime-js.cat</TargetPath>
93+
<ExcludeFromDataFiles>true</ExcludeFromDataFiles>
94+
</ReferenceCopyLocalPaths>
95+
</ItemGroup>
96+
<Message Condition="Exists('$(_CatOutputPath)')" Importance="High" Text="Generated catalog file: $(_CatOutputPath)" />
97+
</Target>
7398
</Project>

0 commit comments

Comments
 (0)
⚡