Skip to content

Commit bcabd7f

Browse files
ellahathawayYuliiaKovalova
ellahathaway
authored and
YuliiaKovalova
committedMar 20, 2025
Enable StrongName verification in SignCheck (#15602)
1 parent 5c0159d commit bcabd7f

26 files changed

+1271
-1141
lines changed
 

‎Arcade.sln

+14
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,8 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.DotNet.MacOsPkg.C
151151
EndProject
152152
Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.DotNet.MacOsPkg.Tests", "src\Microsoft.DotNet.MacOsPkg.Tests\Microsoft.DotNet.MacOsPkg.Tests.csproj", "{1F5118A8-A5C5-4D18-AF34-FFB60FECCD45}"
153153
EndProject
154+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.DotNet.StrongName", "src\Microsoft.DotNet.StrongName\Microsoft.DotNet.StrongName.csproj", "{B65809A4-C6DB-4994-BBDE-D5B8396958A6}"
155+
EndProject
154156
Global
155157
GlobalSection(SolutionConfigurationPlatforms) = preSolution
156158
Debug|Any CPU = Debug|Any CPU
@@ -1001,6 +1003,18 @@ Global
10011003
{1F5118A8-A5C5-4D18-AF34-FFB60FECCD45}.Release|x64.Build.0 = Release|Any CPU
10021004
{1F5118A8-A5C5-4D18-AF34-FFB60FECCD45}.Release|x86.ActiveCfg = Release|Any CPU
10031005
{1F5118A8-A5C5-4D18-AF34-FFB60FECCD45}.Release|x86.Build.0 = Release|Any CPU
1006+
{B65809A4-C6DB-4994-BBDE-D5B8396958A6}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
1007+
{B65809A4-C6DB-4994-BBDE-D5B8396958A6}.Debug|Any CPU.Build.0 = Debug|Any CPU
1008+
{B65809A4-C6DB-4994-BBDE-D5B8396958A6}.Debug|x64.ActiveCfg = Debug|Any CPU
1009+
{B65809A4-C6DB-4994-BBDE-D5B8396958A6}.Debug|x64.Build.0 = Debug|Any CPU
1010+
{B65809A4-C6DB-4994-BBDE-D5B8396958A6}.Debug|x86.ActiveCfg = Debug|Any CPU
1011+
{B65809A4-C6DB-4994-BBDE-D5B8396958A6}.Debug|x86.Build.0 = Debug|Any CPU
1012+
{B65809A4-C6DB-4994-BBDE-D5B8396958A6}.Release|Any CPU.ActiveCfg = Release|Any CPU
1013+
{B65809A4-C6DB-4994-BBDE-D5B8396958A6}.Release|Any CPU.Build.0 = Release|Any CPU
1014+
{B65809A4-C6DB-4994-BBDE-D5B8396958A6}.Release|x64.ActiveCfg = Release|Any CPU
1015+
{B65809A4-C6DB-4994-BBDE-D5B8396958A6}.Release|x64.Build.0 = Release|Any CPU
1016+
{B65809A4-C6DB-4994-BBDE-D5B8396958A6}.Release|x86.ActiveCfg = Release|Any CPU
1017+
{B65809A4-C6DB-4994-BBDE-D5B8396958A6}.Release|x86.Build.0 = Release|Any CPU
10041018
EndGlobalSection
10051019
GlobalSection(SolutionProperties) = preSolution
10061020
HideSolutionNode = FALSE

‎src/Microsoft.DotNet.SignTool.Tests/SignToolTests.cs

+26-25
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
using Xunit;
1717
using Xunit.Abstractions;
1818
using Microsoft.DotNet.Build.Tasks.Installers;
19+
using Microsoft.DotNet.StrongName;
1920

2021
namespace Microsoft.DotNet.SignTool.Tests
2122
{
@@ -3028,11 +3029,11 @@ public void RunWixToolThrowsErrorIfWixToolsProvidedButDirDoesNotExist()
30283029
[Fact]
30293030
public void MissingStrongNameSignaturesDoNotValidate()
30303031
{
3031-
StrongName.IsSigned(GetResourcePath("AspNetCoreCrossLib.dll")).Should().BeFalse();
3032-
StrongName.IsSigned(GetResourcePath("CoreLibCrossARM.dll")).Should().BeFalse();
3033-
StrongName.IsSigned(GetResourcePath("EmptyPKT.dll")).Should().BeFalse();
3034-
StrongName.IsSigned(GetResourcePath("DelaySigned.dll")).Should().BeFalse();
3035-
StrongName.IsSigned(GetResourcePath("ProjectOne.dll")).Should().BeFalse();
3032+
StrongNameHelper.IsSigned(GetResourcePath("AspNetCoreCrossLib.dll")).Should().BeFalse();
3033+
StrongNameHelper.IsSigned(GetResourcePath("CoreLibCrossARM.dll")).Should().BeFalse();
3034+
StrongNameHelper.IsSigned(GetResourcePath("EmptyPKT.dll")).Should().BeFalse();
3035+
StrongNameHelper.IsSigned(GetResourcePath("DelaySigned.dll")).Should().BeFalse();
3036+
StrongNameHelper.IsSigned(GetResourcePath("ProjectOne.dll")).Should().BeFalse();
30363037
}
30373038

30383039
/// <summary>
@@ -3099,9 +3100,9 @@ public void NoFlipButWriteShouldVerify()
30993100

31003101
PEHeaders peHeaders = new PEHeaders(inputStream);
31013102
inputStream.Position = 0;
3102-
int checksumStart = peHeaders.PEHeaderStartOffset + StrongName.ChecksumOffsetInPEHeader;
3103+
int checksumStart = peHeaders.PEHeaderStartOffset + Microsoft.DotNet.StrongName.Constants.ChecksumOffsetInPEHeader;
31033104
WriteBytesToLocation(inputStream, outputStream, checksumStart, peHeaders.PEHeader.CheckSum);
3104-
StrongName.IsSigned(outputStream).Should().BeTrue();
3105+
StrongNameHelper.IsSigned(outputStream).Should().BeTrue();
31053106
}
31063107

31073108
[Fact]
@@ -3113,9 +3114,9 @@ public void IncorrectChecksumsDoNotValidate()
31133114

31143115
PEHeaders peHeaders = new PEHeaders(inputStream);
31153116
inputStream.Position = 0;
3116-
int checksumStart = peHeaders.PEHeaderStartOffset + StrongName.ChecksumOffsetInPEHeader;
3117+
int checksumStart = peHeaders.PEHeaderStartOffset + Microsoft.DotNet.StrongName.Constants.ChecksumOffsetInPEHeader;
31173118
WriteBytesToLocation(inputStream, outputStream, checksumStart, peHeaders.PEHeader.CheckSum ^ 0x1);
3118-
StrongName.IsSigned(outputStream).Should().BeFalse();
3119+
StrongNameHelper.IsSigned(outputStream).Should().BeFalse();
31193120
}
31203121

31213122
// This binary has had a resource added after it was strong name. This invalidated the checksum too,
@@ -3129,25 +3130,25 @@ public void InvalidatedSNSignatureDoesNotValidate()
31293130
PEHeaders peHeaders = new PEHeaders(inputStream);
31303131
inputStream.Position = 0;
31313132

3132-
int checksumStart = peHeaders.PEHeaderStartOffset + StrongName.ChecksumOffsetInPEHeader;
3133+
int checksumStart = peHeaders.PEHeaderStartOffset + Microsoft.DotNet.StrongName.Constants.ChecksumOffsetInPEHeader;
31333134
// Write the checksum that would be expected after editing the binary.
31343135
WriteBytesToLocation(inputStream, outputStream, checksumStart, 110286);
31353136

3136-
StrongName.IsSigned(outputStream).Should().BeFalse();
3137+
StrongNameHelper.IsSigned(outputStream).Should().BeFalse();
31373138
}
31383139

31393140
[Fact]
31403141
public void ValidStrongNameSignaturesValidate()
31413142
{
3142-
StrongName.IsSigned(GetResourcePath("SignedLibrary.dll")).Should().BeTrue();
3143-
StrongName.IsSigned(GetResourcePath("StrongNamedWithEcmaKey.dll")).Should().BeTrue();
3143+
StrongNameHelper.IsSigned(GetResourcePath("SignedLibrary.dll")).Should().BeTrue();
3144+
StrongNameHelper.IsSigned(GetResourcePath("StrongNamedWithEcmaKey.dll")).Should().BeTrue();
31443145
}
31453146

31463147
[WindowsOnlyFact]
31473148
public void ValidStrongNameSignaturesValidateWithFallback()
31483149
{
3149-
StrongName.IsSigned_Legacy(GetResourcePath("SignedLibrary.dll"), s_snPath).Should().BeTrue();
3150-
StrongName.IsSigned_Legacy(GetResourcePath("StrongNamedWithEcmaKey.dll"), s_snPath).Should().BeTrue();
3150+
StrongNameHelper.IsSigned_Legacy(GetResourcePath("SignedLibrary.dll"), s_snPath).Should().BeTrue();
3151+
StrongNameHelper.IsSigned_Legacy(GetResourcePath("StrongNamedWithEcmaKey.dll"), s_snPath).Should().BeTrue();
31513152
}
31523153

31533154
[Theory]
@@ -3157,12 +3158,12 @@ public void SigningSignsAsExpected(string file, string key, bool initiallySigned
31573158
{
31583159
// Make sure this is unique
31593160
string resourcePath = GetResourcePath(file, Guid.NewGuid().ToString());
3160-
StrongName.IsSigned(resourcePath).Should().Be(initiallySigned);
3161-
StrongName.Sign(resourcePath, GetResourcePath(key));
3162-
StrongName.IsSigned(resourcePath).Should().BeTrue();
3161+
StrongNameHelper.IsSigned(resourcePath).Should().Be(initiallySigned);
3162+
StrongNameHelper.Sign(resourcePath, GetResourcePath(key));
3163+
StrongNameHelper.IsSigned(resourcePath).Should().BeTrue();
31633164

31643165
// Legacy sn verification works on on Windows only
3165-
StrongName.IsSigned_Legacy(resourcePath, s_snPath).Should().Be(
3166+
StrongNameHelper.IsSigned_Legacy(resourcePath, s_snPath).Should().Be(
31663167
RuntimeInformation.IsOSPlatform(OSPlatform.Windows));
31673168
}
31683169

@@ -3174,11 +3175,11 @@ public void SigningSignsAsExpectedWithLegacyAndVerifiesWithNonLegacy(string file
31743175
{
31753176
// Make sure this is unique
31763177
string resourcePath = GetResourcePath(file, Guid.NewGuid().ToString());
3177-
StrongName.IsSigned_Legacy(resourcePath, s_snPath).Should().Be(initiallySigned);
3178+
StrongNameHelper.IsSigned_Legacy(resourcePath, s_snPath).Should().Be(initiallySigned);
31783179
// Unset the strong name bit first
3179-
StrongName.ClearStrongNameSignedBit(resourcePath);
3180-
StrongName.Sign_Legacy(resourcePath, GetResourcePath(key), s_snPath).Should().BeTrue();
3181-
StrongName.IsSigned(resourcePath).Should().BeTrue();
3180+
StrongNameHelper.ClearStrongNameSignedBit(resourcePath);
3181+
StrongNameHelper.Sign_Legacy(resourcePath, GetResourcePath(key), s_snPath).Should().BeTrue();
3182+
StrongNameHelper.IsSigned(resourcePath).Should().BeTrue();
31823183
}
31833184

31843185
[Fact]
@@ -3187,7 +3188,7 @@ public void CannotSignWithTheEcmaKey()
31873188
// Using stream variant so that legacy fallback doesn't swallow the exception.
31883189
using (var inputStream = File.OpenRead(GetResourcePath("StrongNamedWithEcmaKey.dll")))
31893190
{
3190-
Action shouldFail = () => StrongName.Sign(inputStream, GetResourcePath("OpenSignedCorrespondingKey.snk"));
3191+
Action shouldFail = () => StrongNameHelper.Sign(inputStream, GetResourcePath("OpenSignedCorrespondingKey.snk"));
31913192
shouldFail.Should().Throw<NotImplementedException>();
31923193
}
31933194
}
@@ -3198,7 +3199,7 @@ public void DelaySignedBinaryFailsToSignWithDifferentKey()
31983199
// Using stream variant so that legacy fallback doesn't swallow the exception.
31993200
using (var inputStream = File.OpenRead(GetResourcePath("DelaySigned.dll")))
32003201
{
3201-
Action shouldFail = () => StrongName.Sign(inputStream, GetResourcePath("OpenSignedCorrespondingKey.snk"));
3202+
Action shouldFail = () => StrongNameHelper.Sign(inputStream, GetResourcePath("OpenSignedCorrespondingKey.snk"));
32023203
shouldFail.Should().Throw<InvalidOperationException>();
32033204
}
32043205
}

‎src/Microsoft.DotNet.SignTool/Microsoft.DotNet.SignTool.csproj

+1
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737

3838
<ItemGroup>
3939
<ProjectReference Include="..\Microsoft.DotNet.Build.Tasks.Installers\Microsoft.DotNet.Build.Tasks.Installers.csproj" />
40+
<ProjectReference Include="..\Microsoft.DotNet.StrongName\Microsoft.DotNet.StrongName.csproj" />
4041
</ItemGroup>
4142

4243
</Project>

‎src/Microsoft.DotNet.SignTool/src/Configuration.cs

+2-1
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
using System.Runtime.Versioning;
1313
using Microsoft.Build.Framework;
1414
using Microsoft.Build.Utilities;
15+
using Microsoft.DotNet.StrongName;
1516

1617
namespace Microsoft.DotNet.SignTool
1718
{
@@ -562,7 +563,7 @@ bool IsSigned(PathWithHash file, SigningStatus signingStatus)
562563

563564
bool IsStrongNameSigned(PathWithHash file)
564565
{
565-
bool isAlreadyStrongNamed = StrongName.IsSigned(file.FullPath, snPath: _snPath, log: _log);
566+
bool isAlreadyStrongNamed = StrongNameHelper.IsSigned(file.FullPath, snPath: _snPath);
566567
if (!isAlreadyStrongNamed)
567568
{
568569
_log.LogMessage(MessageImportance.Low, $"PE file {file.FullPath} does not have a valid strong name signature.");

‎src/Microsoft.DotNet.SignTool/src/ContentUtil.cs

-21
Original file line numberDiff line numberDiff line change
@@ -60,27 +60,6 @@ public static ImmutableArray<byte> StringToHash(string hash)
6060

6161
}
6262

63-
/// <summary>
64-
/// Returns true if the PE file meets all of the pre-conditions to be Open Source Signed.
65-
/// Returns false and logs msbuild errors otherwise.
66-
/// </summary>
67-
public static bool IsPublicSigned(PEReader peReader)
68-
{
69-
if (!peReader.HasMetadata)
70-
{
71-
return false;
72-
}
73-
74-
var mdReader = peReader.GetMetadataReader();
75-
if (!mdReader.IsAssembly)
76-
{
77-
return false;
78-
}
79-
80-
CorHeader header = peReader.PEHeaders.CorHeader;
81-
return (header.Flags & CorFlags.StrongNameSigned) == CorFlags.StrongNameSigned;
82-
}
83-
8463
public static bool IsManaged(string filePath)
8564
{
8665
try

‎src/Microsoft.DotNet.SignTool/src/RealSignTool.cs

+3-2
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
using System.Reflection.PortableExecutable;
1111
using System.Text;
1212
using System.Collections.Generic;
13+
using Microsoft.DotNet.StrongName;
1314

1415
namespace Microsoft.DotNet.SignTool
1516
{
@@ -110,7 +111,7 @@ public override bool RunMSBuild(IBuildEngine buildEngine, string projectFilePath
110111

111112
public override void RemoveStrongNameSign(string assemblyPath)
112113
{
113-
StrongName.ClearStrongNameSignedBit(assemblyPath);
114+
StrongNameHelper.ClearStrongNameSignedBit(assemblyPath);
114115
}
115116

116117
public override SigningStatus VerifySignedPEFile(Stream assemblyStream)
@@ -131,7 +132,7 @@ public override SigningStatus VerifyStrongNameSign(string fileFullPath)
131132
return SigningStatus.Signed;
132133
}
133134

134-
return StrongName.IsSigned(fileFullPath, snPath:_snPath, log: _log) ? SigningStatus.Signed : SigningStatus.NotSigned;
135+
return StrongNameHelper.IsSigned(fileFullPath, snPath:_snPath) ? SigningStatus.Signed : SigningStatus.NotSigned;
135136
}
136137

137138
public override SigningStatus VerifySignedDeb(TaskLoggingHelper log, string filePath)

‎src/Microsoft.DotNet.SignTool/src/SignTool.cs

+2-1
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
using Microsoft.Build.Framework;
1313
using Microsoft.Build.Utilities;
1414
using NuGet.Packaging;
15+
using Microsoft.DotNet.StrongName;
1516

1617
namespace Microsoft.DotNet.SignTool
1718
{
@@ -248,7 +249,7 @@ protected bool LocalStrongNameSign(FileSignInfo file)
248249
{
249250
_log.LogMessage($"Strong-name signing '{file.FullPath}' locally with key '{file.SignInfo.StrongName}'.");
250251

251-
return StrongName.Sign(file.FullPath, file.SignInfo.StrongName, _args.SNBinaryPath, _log);
252+
return StrongNameHelper.Sign(file.FullPath, file.SignInfo.StrongName, _args.SNBinaryPath);
252253
}
253254
}
254255
}

0 commit comments

Comments
 (0)
Please sign in to comment.