MicroBuild Plugin Causes Automatic Signing Without `--sign`
Open
- Dominant language
- C#
- Stars
- 729
- Forks
- 397
- Avg merge
- 3d 15m
- Merged PRs (30d)
- 149
Description
When the MicroBuild plugin is installed and a project containing `FilesToSign` and a MicroBuild package reference is built, MicroBuild signing will run — **even if the `--sign` flag was not passed**.
This leads to unintended behavior: files may be signed automatically without an explicit request to do so, which can result in accidental signing.
When a repo is built via arcade, files should only be signed when explicitly requested — such as by passing the `--sign` flag.
Contributor guide
Assessment
This issue has not been assessed yet.