From 8a722f3cd733b4461fed75a5dc91bbf49186c9f2 Mon Sep 17 00:00:00 2001
From: Zdenek Strach <ZdenekS@kentico.com>
Date: Tue, 5 Mar 2024 14:03:19 +0100
Subject: [PATCH 1/2] KX-11391 - SignFile replaced with AzureSignTool

---
 .azuredevops/pipelines/build-and-release.yml | 12 +++++++++++-
 .config/dotnet-tools.json                    | 12 ++++++++++++
 Directory.Build.props                        |  4 ++++
 Directory.Build.targets                      |  2 +-
 4 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100644 .config/dotnet-tools.json

diff --git a/.azuredevops/pipelines/build-and-release.yml b/.azuredevops/pipelines/build-and-release.yml
index bfe63f8..532d58a 100644
--- a/.azuredevops/pipelines/build-and-release.yml
+++ b/.azuredevops/pipelines/build-and-release.yml
@@ -31,7 +31,7 @@ stages:
               - Agent.Name -equals ${{ parameters.AgentName }}
 
         variables:
-          - group: 14.0 Authenticode signature parameters
+          - group: Code Sign KV Auth
 
           - name: Configuration
             value: Release
@@ -46,6 +46,14 @@ stages:
               packageType: sdk
               useGlobalJson: true
 
+          - task: DotNetCoreCLI@2
+            displayName: Restore dotnet tools
+            inputs:
+              command: custom
+              custom: tool
+              arguments: restore
+              workingDirectory: $(System.DefaultWorkingDirectory)
+
           - task: DotNetCoreCLI@2
             displayName: Restore dependencies
             inputs:
@@ -61,6 +69,8 @@ stages:
               projects: ${{ variables.ProjectPath }}
               configuration: ${{ variables.Configuration }}
               arguments: --no-restore
+            env:
+              AuthenticodeClientSecret: $(AuthenticodeClientSecret)
 
           - task: DotNetCoreCLI@2
             displayName: Create NuGet package
diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
new file mode 100644
index 0000000..708a45c
--- /dev/null
+++ b/.config/dotnet-tools.json
@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {
+    "azuresigntool": {
+      "version": "4.0.1",
+      "commands": [
+        "azuresigntool"
+      ]
+    }
+  }
+}
\ No newline at end of file
diff --git a/Directory.Build.props b/Directory.Build.props
index c4e5978..383ac68 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -5,4 +5,8 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
   </ItemGroup>
+
+  <PropertyGroup>
+    <TimestampServerUrl>http://timestamp.digicert.com</TimestampServerUrl>
+  </PropertyGroup>
 </Project>
\ No newline at end of file
diff --git a/Directory.Build.targets b/Directory.Build.targets
index 89c3c2e..70360ed 100644
--- a/Directory.Build.targets
+++ b/Directory.Build.targets
@@ -9,6 +9,6 @@
             <AssemblyToSign Include="$(XmlSerializersTargetPath)" Condition="Exists('$(XmlSerializersTargetPath)')" />
         </ItemGroup>
 
-        <SignFile CertificateThumbprint="$(AuthenticodeCertificateThumbprint)" TimestampUrl="http://time.certum.pl" SigningTarget="%(AssemblyToSign.Identity)" />
+        <Exec Command="AzureSignTool sign --azure-key-vault-url $(AuthenticodeKeyVaultUrl) --azure-key-vault-tenant-id $(AuthenticodeTenantId) --azure-key-vault-client-id $(AuthenticodeClientId) --azure-key-vault-client-secret $(AuthenticodeClientSecret) --azure-key-vault-certificate $(AuthenticodeCertificateName) --timestamp-rfc3161 $(TimestampServerUrl) --skip-signed %(AssemblyToSign.Identity)" />
     </Target>
 </Project>
\ No newline at end of file

From 888631c1f4add5a814dd17b3f16d7760ea7ef04f Mon Sep 17 00:00:00 2001
From: Zdenek Strach <zdenek.strach@gmail.com>
Date: Wed, 6 Mar 2024 09:38:44 +0100
Subject: [PATCH 2/2] KX-11391 - Update Directory.Build.targets

---
 Directory.Build.targets | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Directory.Build.targets b/Directory.Build.targets
index 70360ed..6578a1b 100644
--- a/Directory.Build.targets
+++ b/Directory.Build.targets
@@ -9,6 +9,6 @@
             <AssemblyToSign Include="$(XmlSerializersTargetPath)" Condition="Exists('$(XmlSerializersTargetPath)')" />
         </ItemGroup>
 
-        <Exec Command="AzureSignTool sign --azure-key-vault-url $(AuthenticodeKeyVaultUrl) --azure-key-vault-tenant-id $(AuthenticodeTenantId) --azure-key-vault-client-id $(AuthenticodeClientId) --azure-key-vault-client-secret $(AuthenticodeClientSecret) --azure-key-vault-certificate $(AuthenticodeCertificateName) --timestamp-rfc3161 $(TimestampServerUrl) --skip-signed %(AssemblyToSign.Identity)" />
+        <Exec Command="dotnet AzureSignTool sign --azure-key-vault-url $(AuthenticodeKeyVaultUrl) --azure-key-vault-tenant-id $(AuthenticodeTenantId) --azure-key-vault-client-id $(AuthenticodeClientId) --azure-key-vault-client-secret $(AuthenticodeClientSecret) --azure-key-vault-certificate $(AuthenticodeCertificateName) --timestamp-rfc3161 $(TimestampServerUrl) --skip-signed %(AssemblyToSign.Identity)" />
     </Target>
-</Project>
\ No newline at end of file
+</Project>