Arcade builds source-build-reference-packages with PublicSign = false
- Dominant language
- C#
- Stars
- 729
- Forks
- 397
- Avg merge
- 3d 15m
- Merged PRs (30d)
- 149
Description
- [ ] This issue is blocking
- [x] This issue is causing unreasonable pain
Building .NET 6 on RHEL 9 through source-build fails out of the box. There is a detailed investigation of the underlying issue at https://github.com/dotnet/runtime/issues/65874. The TLDR is that source-build uses RSA+SHA1 to sign assemblies, and that operation fails when SHA1 is not available - as is the case in RHEL 9 and [being planned for a future version of Fedora](https://lwn.net/Articles/887832/).
The errors building source-build look like this:
`/home/dotnet/dotnet-sdk-source-6.0.106/.dotnet/sdk/6.0.105/Roslyn/Microsoft.CSharp.Core.targets(75,5): error : Unhandled exception. Interop+Crypto+OpenSslCryptographicException: error:03000098:digital envelope routines::invalid digest [/home/dotnet/dotnet-sdk-source-6.0.106/src/source-build-reference-packages/artifacts/source-build/self/src/src/referencePackages/src/microsoft.bcl.asyncinterfaces/5.0.0/Microsoft.Bcl.AsyncInterfaces.5.0.0.csproj]`
`src/referencePackages/src/microsoft.bcl.asyncinterfaces/5.0.0/Microsoft.Bcl.AsyncInterfaces.5.0.0.csproj` has this bit of code:
```
netstandard2.0;netstandard2.1;net461
$(ArtifactsBinDir)microsoft.bcl.asyncinterfaces/5.0.0/microsoft.bcl.asyncinterfaces.nuspec
Open
false
```
Setting the `StrongNameKeyId` to `Open` makes arcade set `PublicSign` to false:
https://github.com/dotnet/arcade/blob/8b98a7cce03fa4f047082f3e9711e185620d70d3/src/Microsoft.DotNet.Arcade.Sdk/tools/StrongName.targets#L60-L68
And that uses full signing. Based on https://github.com/dotnet/runtime/issues/65874#issuecomment-1058345768, it sounds like we want to switch to `true`?
cc @jaredpar @jkotas @MichaelSimons @tmds
Contributor guide
Assessment
This issue has not been assessed yet.