dotnet / dotnet/sign

Signing VSIX may fail with `Azure.Identity.CredentialUnavailableException` when Visual Studio is also installed

Open
#561 0 comments 0 reactions 1 assignee Claimed by @dtivel View on GitHub
Priority:2
Dominant language
C#
Stars
581
Forks
116
Avg merge
1d 2h
Merged PRs (30d)
8

Description

## Repro steps

1. Download InstallerProjects.vsix from https://marketplace.visualstudio.com/items?itemName=VisualStudioClient.MicrosoftVisualStudio2017InstallerProjects.
2. Execute

```text
sign code azure-key-vault -kvu **** -kvc MyCertificate -kvm -d Description -u http://description.test -t http://timestamp.digicert.com -b E:\testpass .\InstallerProjects.vsix
```

## Result

```PS
info: Sign.Core.Signer[0]
Submitting E:\testpass\InstallerProjects.vsix for signing.
info: Sign.Core.Signer[0]
SignAsync called for E:\testpass\InstallerProjects.vsix. Using C:\Users\dtivel\AppData\Local\Temp\qgueuuhu.q23\cyrpatbb.vsix locally.
info: Sign.Core.IDirectoryService[0]
Extracting container C:\Users\dtivel\AppData\Local\Temp\qgueuuhu.q23\cyrpatbb.vsix to C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc.
info: Sign.Core.ISignatureProvider[0]
Signing SignTool job with 21 files.
info: Sign.Core.ISignatureProvider[0]
Signing SignTool job with 4 files.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\dpplg.dll.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\dpedt.dll.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\DPCA.dll.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\$PublicAssemblies\Microsoft.VisualStudio.DeployWizard.dll.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\VsDeploy\dpdplidl.tlb.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\VsDeploy\dpedt.tlb.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\VsDeploy\dpplg.tlb.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\VsDeploy\projectsIdl.tlb.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\lregdll.dll.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\Microsoft.VisualStudio.InstallerProjects.dll.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\msvbver.dll.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\msvcr110.dll.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\regcap.exe.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\DisableOutOfProcBuild\DisableOutOfProcBuild.exe.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\1033\dpedtui.dll.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\1033\dpplgui.dll.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\VsdSchema\Schema.msi.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\VsdSchema\Schema.msm.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\vspkgs\dpdpl.dll.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\vspkgs\dpprj.dll.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\x64\lregdll.dll.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\x64\msvbver.dll.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\x64\regcap.exe.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\vspkgs\1033\dpdplui.dll.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\bin\vspkgs\1033\dpprjui.dll.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
fail: Sign.Core.ISignatureProvider[0]
Error calling Key Vault
System.Security.Cryptography.CryptographicException: Error calling Key Vault
---> Azure.Identity.CredentialUnavailableException: Process "E:\Microsoft Visual Studio\2022\Preview\Common7\IDE\CommonExtensions\Microsoft\Asal\TokenService\Microsoft.Asal.TokenService.exe" has failed to get access token in 30 seconds.
at Azure.Identity.VisualStudioCredential.RunProcessesAsync(List`1 processStartInfos, Boolean async, CancellationToken cancellationToken)
at Azure.Identity.VisualStudioCredential.GetTokenImplAsync(TokenRequestContext requestContext, Boolean async, CancellationToken cancellationToken)
at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage)
at Azure.Identity.VisualStudioCredential.GetTokenImplAsync(TokenRequestContext requestContext, Boolean async, CancellationToken cancellationToken)
at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted[T](ValueTask`1 task)
at Azure.Identity.VisualStudioCredential.GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
at Azure.Identity.DefaultAzureCredential.GetTokenFromCredentialAsync(TokenCredential credential, TokenRequestContext requestContext, Boolean async, CancellationToken cancellationToken)
at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage)
at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted[T](ValueTask`1 task)
at Azure.Identity.DefaultAzureCredential.GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.AuthenticateRequestAsync(HttpMessage message, Boolean async, AuthenticationChallenge challenge)
at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.ProcessCoreAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted(ValueTask task)
at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.RedirectPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted(ValueTask task)
at Azure.Core.Pipeline.RedirectPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted(ValueTask task)
at Azure.Core.Pipeline.RetryPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipeline.Send(HttpMessage message, CancellationToken cancellationToken)
at Azure.Core.Pipeline.HttpPipeline.SendRequest(Request request, CancellationToken cancellationToken)
at Azure.Security.KeyVault.KeyVaultPipeline.SendRequest(Request request, CancellationToken cancellationToken)
at Azure.Security.KeyVault.KeyVaultPipeline.SendRequest[TResult](RequestMethod method, Func`1 resultFactory, CancellationToken cancellationToken, String[] path)
at Azure.Security.KeyVault.Keys.Cryptography.RemoteCryptographyClient.GetKey(CancellationToken cancellationToken)
at Azure.Security.KeyVault.Keys.Cryptography.CryptographyClient.Initialize(String operation, CancellationToken cancellationToken)
at Azure.Security.KeyVault.Keys.Cryptography.CryptographyClient.Sign(SignatureAlgorithm algorithm, Byte[] digest, CancellationToken cancellationToken)
at RSAKeyVaultProvider.KeyVaultContext.SignDigest(Byte[] digest, HashAlgorithmName hashAlgorithm, KeyVaultSignatureAlgorithm signatureAlgorithm) in /_/RSAKeyVaultProvider/KeyVaultContext.cs:line 95
at RSAKeyVaultProvider.RSAKeyVault.SignHash(Byte[] hash, HashAlgorithmName hashAlgorithm, RSASignaturePadding padding) in /_/RSAKeyVaultProvider/RSAKeyVault.cs:line 41
--- End of inner exception stack trace ---
at RSAKeyVaultProvider.RSAKeyVault.SignHash(Byte[] hash, HashAlgorithmName hashAlgorithm, RSASignaturePadding padding) in /_/RSAKeyVaultProvider/RSAKeyVault.cs:line 45
at AzureSign.Core.AuthenticodeKeyVaultSigner.SignCallback(IntPtr pCertContext, IntPtr pvExtra, UInt32 algId, Byte[] pDigestToSign, UInt32 dwDigestToSign, CRYPTOAPI_BLOB& blob)
at AzureSign.Core.Interop.mssign32.SignerSignEx3(SignerSignEx3Flags dwFlags, SIGNER_SUBJECT_INFO* pSubjectInfo, SIGNER_CERT* pSignerCert, SIGNER_SIGNATURE_INFO* pSignatureInfo, IntPtr pProviderInfo, SignerSignTimeStampFlags dwTimestampFlags, Byte* pszTimestampAlgorithmOid, Char* pwszHttpTimeStamp, IntPtr psRequest, Void* pSipData, IntPtr* ppSignerContext, IntPtr pCryptoPolicy, SIGN_INFO* pSignInfo, IntPtr pReserved)
at AzureSign.Core.AuthenticodeKeyVaultSigner.SignFile(ReadOnlySpan`1 path, ReadOnlySpan`1 description, ReadOnlySpan`1 descriptionUrl, Nullable`1 pageHashing, ILogger logger)
at Sign.Core.AzureSignToolSignatureProvider.RunSignTool(AuthenticodeKeyVaultSigner signer, FileInfo file, SignOptions options) in /_/src/Sign.Core/SignatureProviders/AzureSignToolSignatureProvider.cs:line 157
fail: Sign.Core.ISignatureProvider[0]
Signing failed with error 0.
info: Sign.Core.ISignatureProvider[0]
Performing attempt #2 of 3 attempts after 5s.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing succeeded.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\VsDeploy\dpdplidl.tlb.
fail: Sign.Core.ISignatureProvider[0]
Signing failed with error -2147024864.
info: Sign.Core.ISignatureProvider[0]
Performing attempt #3 of 3 attempts after 11.1803398s.
info: Sign.Core.ISignatureProvider[0]
Signing C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\VsDeploy\dpdplidl.tlb.
fail: Sign.Core.ISignatureProvider[0]
Signing failed with error -2147024864.
fail: Sign.Core.ISignatureProvider[0]
Failed to sign. Attempts exceeded.
warn: Sign.Core.IDirectoryService[0]
An exception occurred while attempting to delete directory C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc.
System.IO.IOException: The process cannot access the file 'dpdplidl.tlb' because it is being used by another process.
at System.IO.FileSystem.RemoveDirectoryRecursive(String fullPath, WIN32_FIND_DATA& findData, Boolean topLevel)
at System.IO.FileSystem.RemoveDirectory(String fullPath, Boolean recursive)
at Sign.Core.DirectoryService.Delete(DirectoryInfo directory) in /_/src/Sign.Core/FileSystem/DirectoryService.cs:line 52
fail: Sign.Core.Signer[0]
Could not sign C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\VsDeploy\dpdplidl.tlb.
System.Exception: Could not sign C:\Users\dtivel\AppData\Local\Temp\i5gmg5o2.2cc\VsDeploy\dpdplidl.tlb.
at Sign.Core.AzureSignToolSignatureProvider.<>c__DisplayClass6_0.<b__0>d.MoveNext() in /_/src/Sign.Core/SignatureProviders/AzureSignToolSignatureProvider.cs:line 104
--- End of stack trace from previous location ---
at System.Threading.Tasks.Parallel.<>c__50`1.<b__50_0>d.MoveNext()
--- End of stack trace from previous location ---
at Sign.Core.AzureSignToolSignatureProvider.SignAsync(IEnumerable`1 files, SignOptions options) in /_/src/Sign.Core/SignatureProviders/AzureSignToolSignatureProvider.cs:line 98
at Sign.Core.AggregatingSignatureProvider.SignAsync(IEnumerable`1 files, SignOptions options) in /_/src/Sign.Core/SignatureProviders/AggregatingSignatureProvider.cs:line 204
at Sign.Core.AggregatingSignatureProvider.SignAsync(IEnumerable`1 files, SignOptions options) in /_/src/Sign.Core/SignatureProviders/AggregatingSignatureProvider.cs:line 92
at Sign.Core.Signer.<>c__DisplayClass2_0.<b__0>d.MoveNext() in /_/src/Sign.Core/Signer.cs:line 154
--- End of stack trace from previous location ---
at System.Threading.Tasks.Parallel.<>c__50`1.<b__50_0>d.MoveNext()
--- End of stack trace from previous location ---
at Sign.Core.Signer.SignAsync(IReadOnlyList`1 inputFiles, String outputFile, FileInfo fileList, DirectoryInfo baseDirectory, String publisherName, String description, Uri descriptionUrl, Uri timestampUrl, Int32 maxConcurrency, HashAlgorithmName fileHashAlgorithm, HashAlgorithmName timestampHashAlgorithm, TokenCredential tokenCredential, Uri keyVaultUrl, String certificateName) in /_/src/Sign.Core/Signer.cs:line 86
```

## Workaround

Set the environment variable [`ExcludeVisualStudioCredential`](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.defaultazurecredentialoptions.excludevisualstudiocredential?view=azure-dotnet) to `true`.

CC @clairernovotny

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.