Troubleshooting in Signing Builds - Dotnet-install-scripts

[epananth]

Dotnet-install-scripts are failing to sign builds

Link to the build -> https://dev.azure.com/dnceng/internal/_build/results?buildId=2197153&view=logs&j=fa59fe4e-195c-56fa-189b-58fd241f10dd&t=61a8c1b1-69ee-5f1b-2254-ea408c9586cb

cc: @MichalPavlik

Release Note Category

• Feature changes/additions
• Bug fixes
• Internal Infrastructure Improvements

Release Note Description

[epananth]

Findings so far

Okay, I looked at your build https://dev.azure.com/dnceng/internal/_build/results?buildId=2197153&view=logs&j=fa59fe4e-195c-56fa-189b-58fd241f10dd&t=5b5b83fe-23ef-52ba-399a-317ee80daf24, one thing I noticed which seems weird. Why do you have Microbuild plugin download twice?

this downloads 3.5.1 version https://dev.azure.com/dnceng/internal/_build/results?buildId=2197153&view=logs&j=fa59fe4e-195c-56fa-189b-58fd241f10dd&t=5b5b83fe-23ef-52ba-399a-317ee80daf24

this downloads 4.2.19 https://dev.azure.com/dnceng/internal/_build/results?buildId=2197153&view=logs&j=fa59fe4e-195c-56fa-189b-58fd241f10dd&t=118a5c5d-fc7a-5843-3b69-4cbb52b05cb7

[epananth]

General question - Are you planning to use arcade to sign? or do you want to use some other way to sign? I see in your repo, you are trying to do both.

Arcade already brings in Microsoft.VisualStudioEng.MicroBuild.Core and its dependencies. So you don't have to do that again. Probably you will have to clean that up.

[epananth]

Also you can run Build.cmd locally, so you don't have to wait for your CI to complete. That will make testing easy

[donJoseLuis]

@MichalPavlik heads up on the above questions

[MichalPavlik]

Hello, I removed the MicroBuild task we added, but the NullReferenceException from SignToolTask is still there (pipeline run). Unfortunately, I'm not able to build locally right now due to errors I don't see in CI.

To answer your question about signing stack: We would like to use the stack that is compliant, easy to use and supports GPG signing with custom key :) I started with ESRP onboarding wiki, but I was told later that MicroBuild is the compliant way. The PS1 script signing was authored by a teammate which unfortunately left the company some time ago. We are not against to unify signing for both scripts if it doesn't require too much effort (this project is in maintenance mode). I think using same way for both scripts would make it easier to understand and maintain the pipeline.

We appreciate your help. No one in our team is experienced with signing and we spent considerable amount of time on it so far :(

[epananth]

If you want to use arcade way of signing. It's pretty straight forward, look for the documentation here -> https://github.com/dotnet/arcade/blob/main/Documentation/CorePackages/Signing.md

[epananth]

I would recommend onboarding on to arcade way of signing. Because I have seen this telemetry error before. I have a way to disable telemetry

dotnet/arcade#7638

[epananth]

How to call SignToolTask -> https://github.com/dotnet/arcade/blob/main/Documentation/CorePackages/Signing.md#7-how-should-i-call-the-signtooltask

[epananth]

Looks like @MichalPavlik, you were able to resolve the error with the steps mentioned.

[epananth]

Going to close this one, this seems to be have been resolved.