Some fixes for signing on internal CI

.gitignore

@@ -417,3 +417,4 @@ FodyWeavers.xsd
 *.msm
 *.msp
 .DS_Store
+.dotnet

Directory.Build.props

@@ -19,6 +19,7 @@
     <IsShipping>false</IsShipping>
     <!-- Disable strong naming: MAUI and Platform.Maui packages are not strong-named -->
     <SignAssembly>false</SignAssembly>
+    <NoSwixBuildPlugin>true</NoSwixBuildPlugin>
   </PropertyGroup>
 
   <!-- Import shared packaging properties for NuGet packages -->

Directory.Build.targets

@@ -3,4 +3,17 @@
   <Import Project="Sdk.targets" Sdk="Microsoft.DotNet.Arcade.Sdk" />
   <Import Project="$(MSBuildThisFileDirectory)eng/Common.targets" />
 
+  <!-- Workaround for dotnet/arcade#16611: Arcade SDK Sign.proj expects
+       WixToolsPath at .packages/microsoft.wixtoolset.sdk/{ver}/tools/net472/{Platform}
+       but the WiX 5 SDK package has no platform subfolder under tools/net472/.
+       Create the expected directory so SignToolTask's existence check passes. -->
+  <Target Name="CreateWixToolsPathWorkaround"
+          BeforeTargets="Build"
+          Condition=" '$(OS)' == 'Windows_NT' And Exists('$(NuGetPackageRoot)microsoft.wixtoolset.sdk\$(MicrosoftWixToolsetSdkVersion)')">
+    <MakeDir Directories="$(NuGetPackageRoot)microsoft.wixtoolset.sdk\$(MicrosoftWixToolsetSdkVersion)\tools\net472\x64"
+             Condition="!Exists('$(NuGetPackageRoot)microsoft.wixtoolset.sdk\$(MicrosoftWixToolsetSdkVersion)\tools\net472\x64')" />
+    <MakeDir Directories="$(NuGetPackageRoot)microsoft.wixtoolset.sdk\$(MicrosoftWixToolsetSdkVersion)\tools\net472\arm64"
+             Condition="!Exists('$(NuGetPackageRoot)microsoft.wixtoolset.sdk\$(MicrosoftWixToolsetSdkVersion)\tools\net472\arm64')" />
+  </Target>
+
 </Project>

NuGet.config

@@ -5,6 +5,10 @@
   </solution>
   <packageSources>
     <clear />
+    <!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
+    <!--  Begin: Package sources from dotnet-dotnet -->
+    <!--  End: Package sources from dotnet-dotnet -->
+    <!--End: Package sources managed by Dependency Flow automation. Do not edit the sources above.-->
     <add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" protocolVersion="3" />
     <add key="dotnet-tools" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json" protocolVersion="3" />
     <add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" protocolVersion="3" />

eng/SignCheckExclusionsFile.txt

@@ -0,0 +1,3 @@
+;; Exclusions for SignCheck. Corresponds to info in Signing.props.
+;; Format: https://github.com/dotnet/arcade/blob/397316e195639450b6c76bfeb9823b40bee72d6d/src/SignCheck/Microsoft.SignCheck/Verification/Exclusion.cs#L23-L35
+*.js;; We do not sign JavaScript files.

eng/Version.Details.xml

@@ -12,26 +12,26 @@
     </Dependency>
     <!-- dotnet/runtime -->
     <Dependency Name="Microsoft.Extensions.Http" Version="10.0.5">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>0000000000000000000000000000000000000000</Sha>
+      <Uri>https://github.com/dotnet/dotnet</Uri>
+      <Sha>73b3b5ac0e4a5658c7a0555b67d91a22ad39de4b</Sha>
     </Dependency>
     <Dependency Name="Microsoft.Extensions.Hosting" Version="10.0.5">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>0000000000000000000000000000000000000000</Sha>
+      <Uri>https://github.com/dotnet/dotnet</Uri>
+      <Sha>73b3b5ac0e4a5658c7a0555b67d91a22ad39de4b</Sha>
     </Dependency>
     <Dependency Name="Microsoft.Extensions.Logging.Abstractions" Version="10.0.5">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>0000000000000000000000000000000000000000</Sha>
+      <Uri>https://github.com/dotnet/dotnet</Uri>
+      <Sha>73b3b5ac0e4a5658c7a0555b67d91a22ad39de4b</Sha>
     </Dependency>
     <Dependency Name="System.Text.Json" Version="10.0.5">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>0000000000000000000000000000000000000000</Sha>
+      <Uri>https://github.com/dotnet/dotnet</Uri>
+      <Sha>73b3b5ac0e4a5658c7a0555b67d91a22ad39de4b</Sha>
     </Dependency>
   </ProductDependencies>
   <ToolsetDependencies>
-    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="10.0.0-beta.26164.1">
-      <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>e365cfcb58176841c2fb80d1a40926f394776970</Sha>
+    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="10.0.0-beta.26168.104">
+      <Uri>https://github.com/dotnet/dotnet</Uri>
+      <Sha>73b3b5ac0e4a5658c7a0555b67d91a22ad39de4b</Sha>
     </Dependency>
   </ToolsetDependencies>
-</Dependencies>
+</Dependencies>

eng/pipelines/devflow-official.yml

@@ -20,6 +20,10 @@ variables:
 - template: /eng/pipelines/common-variables.yml@self
 - name: _BuildConfig
   value: Release
+- name: _SignType
+  value: real
+- name: PostBuildSign
+  value: false
 
 resources:
   repositories:
@@ -33,16 +37,20 @@ extends:
   parameters:
     pool:
       name: NetCore1ESPool-Internal
-      image: windows.vs2022.amd64
+      image: windows.vs2026preview.scout.amd64
       os: windows
+    # Required for publishing to external feeds like nuget.org
+    settings:
+      networkIsolationPolicy: Permissive
 
     stages:
     - stage: build
       displayName: Build
       jobs:
       - template: /eng/common/templates-official/jobs/jobs.yml@self
         parameters:
-          enablePublishUsingPipelines: ${{ parameters.publishPackages }}
+          enableMicrobuild: true
+          enablePublishBuildAssets: true
           enablePublishBuildArtifacts: true
           enablePublishTestResults: true
           testResultsFormat: xunit
@@ -51,14 +59,13 @@ extends:
           - job: Windows
             pool:
               name: NetCore1ESPool-Internal
-              demands: ImageOverride -equals windows.vs2022.amd64
+              demands: ImageOverride -equals windows.vs2026preview.scout.amd64
             strategy:
               matrix:
                 Release:
                   _BuildConfig: Release
-                  _OfficialBuildArgs: /p:DotNetSignType=test
+                  _OfficialBuildArgs: /p:DotNetSignType=$(_SignType)
                     /p:TeamName=$(_TeamName)
-                    /p:DotNetPublishUsingPipelines=${{ parameters.publishPackages }}
                     /p:OfficialBuildId=$(BUILD.BUILDNUMBER)
             steps:
             - task: UseDotNet@2
@@ -75,10 +82,44 @@ extends:
                 -projects $(Build.SourcesDirectory)\src\DevFlow\DevFlow.slnf
                 $(_OfficialBuildArgs)
               displayName: Build and Test
+
+    - template: /eng/common/templates-official/post-build/post-build.yml@self
+      parameters:
+        enableSourceLinkValidation: false
+        enableSigningValidation: true
+        enableNugetValidation: true
 
+    # Publish to NuGet.org using 1ES.PublishNuget task
+    # Pattern from dotnet/aspire release-publish-nuget.yml:
+    # - useDotNetTask: false (required - DotNetCoreCLI@2 doesn't support encrypted API keys)
+    # - nuGetFeedType: external + publishFeedCredentials for NuGet.org
     - ${{ if eq(parameters.publishPackages, true) }}:
-      - template: /eng/common/templates-official/post-build/post-build.yml@self
-        parameters:
-          enableSourceLinkValidation: false
-          enableSigningValidation: true
-          enableNugetValidation: true
+      - stage: publish_nuget
+        displayName: 'Publish to NuGet.org'
+        dependsOn:
+        - Validate
+        - publish_using_darc
+        jobs:
+        - job: PublishNuGet
+          displayName: 'Push Packages to NuGet.org'
+          timeoutInMinutes: 30
+          pool:
+            name: NetCore1ESPool-Internal
+            image: windows.vs2022.amd64
+            os: windows
+          templateContext:
+            type: releaseJob
+            isProduction: true
+            inputs:
+            - input: pipelineArtifact
+              artifactName: PackageArtifacts
+              targetPath: '$(Pipeline.Workspace)/PackageArtifacts'
+          steps:
+          - task: 1ES.PublishNuget@1
+            displayName: 'Push Packages to NuGet.org'
+            inputs:
+              useDotNetTask: false
+              packagesToPush: '$(Pipeline.Workspace)/PackageArtifacts/*.nupkg'
+              packageParentPath: '$(Pipeline.Workspace)/PackageArtifacts'
+              nuGetFeedType: external
+              publishFeedCredentials: 'NuGet.org - dotnet/maui-labs' # TODO: Create this service connection in dnceng

global.json

@@ -1,13 +1,13 @@
 {
   "sdk": {
-    "version": "10.0.104",
+    "version": "10.0.105",
     "rollForward": "latestMinor",
     "allowPrerelease": false
   },
   "tools": {
-    "dotnet": "10.0.104"
+    "dotnet": "10.0.105"
   },
   "msbuild-sdks": {
-    "Microsoft.DotNet.Arcade.Sdk": "10.0.0-beta.26164.1"
+    "Microsoft.DotNet.Arcade.Sdk": "10.0.0-beta.26168.104"
   }
 }