Signing NuGet packages relies on reflection on internal property of a NuGet class
- Dominant language
- C#
- Stars
- 581
- Forks
- 116
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 8
Description
The [`RSAKeyVaultProvider.RSAKeyVault`](https://github.com/novotnyllc/RSAKeyVaultProvider/blob/v2.1.1/RSAKeyVaultProvider/RSAKeyVault.cs) class is the "magic" that enables Sign CLI to integrate with Azure Key Vault with libraries (like NuGet) which otherwise lack native support for Azure Key Vault. Because `RSAKeyVault` subclasses [`System.Security.Cryptography.RSA`](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsa?view=net-7.0), it is a drop-in replacement anywhere an `RSA` instance is accepted.
The problem is that NuGet does not expose an easy way to pass in this `RSAKeyVault` instance. NuGet's `SigningOptions` only allows you to pass in a custom [`ISignatureProvider`](https://github.com/NuGet/NuGet.Client/blob/release-6.4.x/src/NuGet.Core/NuGet.Packaging/Signing/Authoring/SigningOptions.cs#L57). So, Sign CLI reimplemented NuGet's [`X509SignatureProvider`](https://github.com/NuGet/NuGet.Client/blob/release-6.4.x/src/NuGet.Core/NuGet.Packaging/Signing/Authoring/X509SignatureProvider.cs) with [`KeyVaultSignatureProvider`](https://github.com/novotnyllc/NuGetKeyVaultSignTool/blob/v3.2.3/NuGetKeyVaultSignTool.Core/KeyVaultSignatureProvider.cs).
Unfortunately, this approach necessitated copying and modifying some NuGet implementation and using [reflection to obtain the value of an internal property of a NuGet class](https://github.com/novotnyllc/NuGetKeyVaultSignTool/blob/v3.2.3/NuGetKeyVaultSignTool.Core/KeyVaultSignatureProvider.cs#L126-L129).
CC @clairernovotny, @aortiz-msft
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.