dotnet / dotnet/sign

Signing NuGet packages relies on reflection on internal property of a NuGet class

Open
#557 0 comments 0 reactions 1 assignee Claimed by @dtivel View on GitHub
Priority:3
Dominant language
C#
Stars
581
Forks
116
Avg merge
1d 2h
Merged PRs (30d)
8

Description

The [`RSAKeyVaultProvider.RSAKeyVault`](https://github.com/novotnyllc/RSAKeyVaultProvider/blob/v2.1.1/RSAKeyVaultProvider/RSAKeyVault.cs) class is the "magic" that enables Sign CLI to integrate with Azure Key Vault with libraries (like NuGet) which otherwise lack native support for Azure Key Vault. Because `RSAKeyVault` subclasses [`System.Security.Cryptography.RSA`](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsa?view=net-7.0), it is a drop-in replacement anywhere an `RSA` instance is accepted.

The problem is that NuGet does not expose an easy way to pass in this `RSAKeyVault` instance. NuGet's `SigningOptions` only allows you to pass in a custom [`ISignatureProvider`](https://github.com/NuGet/NuGet.Client/blob/release-6.4.x/src/NuGet.Core/NuGet.Packaging/Signing/Authoring/SigningOptions.cs#L57). So, Sign CLI reimplemented NuGet's [`X509SignatureProvider`](https://github.com/NuGet/NuGet.Client/blob/release-6.4.x/src/NuGet.Core/NuGet.Packaging/Signing/Authoring/X509SignatureProvider.cs) with [`KeyVaultSignatureProvider`](https://github.com/novotnyllc/NuGetKeyVaultSignTool/blob/v3.2.3/NuGetKeyVaultSignTool.Core/KeyVaultSignatureProvider.cs).

Unfortunately, this approach necessitated copying and modifying some NuGet implementation and using [reflection to obtain the value of an internal property of a NuGet class](https://github.com/novotnyllc/NuGetKeyVaultSignTool/blob/v3.2.3/NuGetKeyVaultSignTool.Core/KeyVaultSignatureProvider.cs#L126-L129).

CC @clairernovotny, @aortiz-msft

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.