dotnet / dotnet/msbuild

Allow explicit specification of certificate chains in SecurityUtil.SignFile

Open
#13,287 5 comments 1 reaction 1 assignee Claimed by @MichalPavlik View on GitHub
Dominant language
C#
Stars
5.5k
Forks
1.5k
Avg merge
1d 8h
Merged PRs (30d)
141

Description

### Summary

It would be really great if there was an overload of `SecurityUtil.SignFile`(https://github.com/dotnet/msbuild/blob/b3eba18a92fc2171a656151290d319b58cd6a26b/src/Tasks/ManifestUtil/SecurityUtil.cs#L636) that allows passing in the certificate chain that will be attached to the signature explicitly (without having to go through the certificate store).

### Background and Motivation

We're using the code in an automated system that runs code in parallel and therefore cannot reliably add the certificate chain to the Windows certificate store to allow correct resolution and adding of the chain certificates to the signature. Therefore we would appreciate an overload that allows us to explicitly pass in the whole certificate chain.

This is kind of similar to the fact that there are already overloads that take a certificate thumbprint (and therefore go through the Windows certificate store) and ones that explicitly take a `X509Certificate2`.

### Proposed Feature

Add an overload that allows passing in a certificate chain explicitly (probably as `X509Certificate2Collection`?).

### Alternative Designs

_No response_

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.