dotnet / dotnet/arcade

MicroBuild Plugin Causes Automatic Signing Without `--sign`

Open
#16,057 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
729
Forks
397
Avg merge
3d 15m
Merged PRs (30d)
149

Description

When the MicroBuild plugin is installed and a project containing `FilesToSign` and a MicroBuild package reference is built, MicroBuild signing will run — **even if the `--sign` flag was not passed**.

This leads to unintended behavior: files may be signed automatically without an explicit request to do so, which can result in accidental signing.

When a repo is built via arcade, files should only be signed when explicitly requested — such as by passing the `--sign` flag.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.