dotnet / dotnet/arcade

SignTool: Process.WaitForExit() calls can block indefinitely

Open
#16,517 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
729
Forks
397
Avg merge
3d 15m
Merged PRs (30d)
149

Description

## Summary

Several process execution call sites in Microsoft.DotNet.SignTool use Process.WaitForExit() without a timeout, which can block indefinitely if the child process hangs. This could cause signing builds to hang with no diagnostics.

Affected Locations:

All in src/Microsoft.DotNet.SignTool/src/:

| File | Method | What it runs |
|------|--------|-------------|
| `ZipData.cs` | `RunPkgProcess` | `dotnet exec` for pkg tool |
| `ZipData.cs` | `RunTarProcess` | `dotnet exec` for tar tool (.NET Framework) |
| `ZipData.cs` | `RunExternalProcess` | `bash` for cpio/RPM operations |
| `BatchSignUtil.cs` | `RunWixTool` | `cmd /c` for WiX tools |

Note: RealSignTool.RunMSBuild already handles this correctly using a configurable _dotnetTimeout with process.Kill() on timeout.

Suggested Approach

Consider consolidating process execution into a shared utility with:

- Configurable timeout (with a sensible default)
- Kill + wait on timeout
- Consistent logging of command, stdout, stderr, and exit code
- Consistent error reporting

The existing Microsoft.Arcade.Common.Command / ICommand utility could be extended with timeout support (it also calls WaitForExit() without a timeout today), or the proven pattern from RealSignTool.RunMSBuild could be extracted into a reusable helper.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.