Skip to content

Add .cab and ReconnectModal.razor.js to signing config #35026

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kubaflo merged 3 commits into from
May 1, 2026
Merged

Add .cab and ReconnectModal.razor.js to signing config #35026

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
833c2d1
Add .cab and ReconnectModal.razor.js to signing config
jesuszarate Apr 18, 2026
a0caf74
Move ReconnectModal.razor.js to its own Microsoft files ItemGroup
jesuszarate Apr 23, 2026
e96211c
Add Label attribute to cab ItemGroup for consistency
jesuszarate Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion eng/Signing.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,11 +25,20 @@
<FileSignInfo Include="SegoeUI-Semibold.ttf" CertificateName="3PartyScriptsSHA2" />
</ItemGroup>

Comment thread
jesuszarate marked this conversation as resolved.
<ItemGroup Label="Microsoft files">
<FileSignInfo Include="ReconnectModal.razor.js" CertificateName="Microsoft400" />
</ItemGroup>

<ItemGroup>
<!-- Sign cab files embedded inside MSI workload packs -->
<FileExtensionSignInfo Include=".cab" CertificateName="Microsoft400" />

@github-actions github-actions Bot Apr 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 MINOR (2/3 reviewers) — FileExtensionSignInfo matches all .cab files in the signing scope, not just the specific cab files in MAUI workload MSIs.

If a third-party .cab were ever introduced into the artifact tree, it would be silently signed with a Microsoft certificate. Currently MAUI ships no third-party .cab files, so this is not an active defect — just a latent risk worth being aware of.

Non-blocking — all reviewers agreed this is acceptable for MAUI's current build pipeline.

@MauiBot MauiBot Apr 30, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[minor] Build & MSBuild — FileExtensionSignInfo for .cab is a repo-wide catch-all: it will sign any .cab file that enters the signing scope in the future, including potential third-party or toolchain cabs that should use 3PartySHA2 instead of Microsoft400. The inline comment documents intent well, but consider whether a filename-specific rule (or per-pack explicit listing) would be safer long-term. Not a blocker — the current signing scope contains only Microsoft-owned workload pack cabs.

</ItemGroup>

@github-actions github-actions Bot Apr 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 MINOR (2/3 reviewers) — Consider adding a Label attribute to this ItemGroup for consistency.

The "Third Party Assemblies" group (line 6) and the new "Microsoft files" group (line 28) both carry Label attributes, but this ItemGroup has none. A label like Label="MSI workload cab files" would improve scanability and maintain the file's existing convention.

Non-blocking — the XML comment on line 33 partially serves the same purpose.


<ItemGroup>
<ItemsToSign Include="$(ArtifactsShippingPackagesDir)\**\*.msi" Condition="'$(PostBuildSign)' != 'true'" />
<ItemsToSign Include="$(ArtifactsShippingPackagesDir)**\*.wixpack.zip" Condition="'$(PostBuildSign)' != 'true'" />
<ItemsToSignPostBuild Include="$(ArtifactsShippingPackagesDir)\**\*.msi" Condition="'$(PostBuildSign)' == 'true'" />
<ItemsToSign Include="$(ArtifactsShippingPackagesDir)\**\*.zip" Condition="'$(PostBuildSign)' != 'true'" />
<ItemsToSignPostBuild Include="$(ArtifactsShippingPackagesDir)\**\*.zip" Condition="'$(PostBuildSign)' == 'true'" />
</ItemGroup>
</Project>
</Project>
Loading