Skip to content

Add assembly signing for Microsoft.SqlServer.Server #4566

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
paulmedynski wants to merge 2 commits into from
Draft

Add assembly signing for Microsoft.SqlServer.Server #4566

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a222a0c
Add assembly signing for Microsoft.SqlServer.Server
paulmedynski Aug 21, 2026
ea6f3a1
Address PR 4566 review feedback in the SqlServer pack job
paulmedynski Aug 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 3 additions & 7 deletions eng/pipelines/ci/package/sqlclient-ci-package-pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ variables:
value: ${{ eq(variables['System.TeamProject'], 'ADO.Net') }}

# Signing key argument passed to build.proj. On internal builds this references the secure file
# downloaded by DownloadSecureFile@1; on public builds it expands to empty.
# downloaded by download-assembly-signing-key.yml; on public builds it expands to empty.
- name: signingKeyArg
${{ if eq(variables.isInternalBuild, true) }}:
value: -p:SigningKeyPath="$(driverKeyFile.secureFilePath)"
Expand Down Expand Up @@ -125,13 +125,9 @@ jobs:
Write-Host 'Done.'
displayName: Clean Packages Directory

# On internal builds, download the strong-name signing key.
# On internal builds, download the assembly signing key.
- ${{ if eq(variables.isInternalBuild, true) }}:
- task: DownloadSecureFile@1
displayName: Download Driver Signing Key
inputs:
secureFile: netfxKeypair.snk
name: driverKeyFile
- template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self

@paulmedynski paulmedynski Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR adds a shared helper template to download signing keys, so you will see changes to several pipeline like this.


# Run the Pack target via build.proj.
- task: DotNetCoreCLI@2
Expand Down
39 changes: 39 additions & 0 deletions eng/pipelines/common/steps/download-assembly-signing-key.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
################################################################################
# Licensed to the .NET Foundation under one or more agreements. The .NET
# Foundation licenses this file to you under the MIT license. See the LICENSE
# file in the project root for more information.
################################################################################

# Downloads a signing key from ADO secure files.
#
# When isTest is false, downloads the driver signing key and exports it as 'driverKeyFile'. When
# isTest is true, downloads the test signing key and exports it as 'testKeyFile'.
#
# Downstream steps reference the path via:
#
# $(driverKeyFile.secureFilePath) or
# $(testKeyFile.secureFilePath)

parameters:

# When false, download the driver signing key.
# When true, download the test signing key.
- name: isTest
type: boolean
default: false

steps:

- ${{ if eq(parameters.isTest, false) }}:
- task: DownloadSecureFile@1
displayName: Download Driver Signing Key
inputs:
secureFile: netfxKeypair.snk
name: driverKeyFile

- ${{ else }}:
- task: DownloadSecureFile@1
displayName: Download Test Signing Key
inputs:
secureFile: sqlclient-test-key.snk
name: testKeyFile
8 changes: 8 additions & 0 deletions eng/pipelines/dotnet-sqlclient-ci-core.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,12 @@ parameters:
- detailed
- diagnostic

# True when building on the internal ADO.Net project. Internal builds may perform additional or
# different steps, such as assembly signing.
- name: isInternalBuild
type: boolean
default: false

variables:
- template: /eng/pipelines/libraries/ci-build-variables.yml@self

Expand Down Expand Up @@ -149,6 +155,8 @@ stages:
buildConfiguration: ${{ parameters.buildConfiguration }}
debug: ${{ parameters.debug }}
dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
referenceType: ${{ parameters.referenceType }}
isInternalBuild: ${{ parameters.isInternalBuild }}

# Build the Logging package, and publish it to the pipeline artifacts
# under the given artifact name. This runs in parallel with the Secrets
Expand Down
1 change: 1 addition & 0 deletions eng/pipelines/dotnet-sqlclient-ci-package-reference-pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,3 +178,4 @@ extends:
testJobTimeout: ${{ parameters.testJobTimeout }}
testSets: ${{ parameters.testSets }}
useManagedSNI: ${{ parameters.useManagedSNI }}
isInternalBuild: ${{ eq(variables['System.TeamProject'], 'ADO.Net') }}
1 change: 1 addition & 0 deletions eng/pipelines/dotnet-sqlclient-ci-project-reference-pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,3 +178,4 @@ extends:
testJobTimeout: ${{ parameters.testJobTimeout }}
testSets: ${{ parameters.testSets }}
useManagedSNI: ${{ parameters.useManagedSNI }}
isInternalBuild: ${{ eq(variables['System.TeamProject'], 'ADO.Net') }}
58 changes: 46 additions & 12 deletions eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,21 @@ parameters:
- detailed
- diagnostic

# The C# project reference type to use when building and packing the packages.
- name: referenceType
type: string
default: Project
values:
# Reference sibling packages as NuGet packages.
- Package
# Reference sibling packages as C# projects.
- Project

# True when building on the internal ADO.Net project.
- name: isInternalBuild

@paulmedynski paulmedynski Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You will see this concept throughout the PR stack, used to determine when assembly signing is required.

The PR pipelines (legacy and modern) always use Project mode, and never sign any assemblies. They will not have this concept.

The modern CI pipeline always uses Package mode, and when running on ADO.Net, it will sign all assemblies (driver and test).

The legacy CI pipelines use both Project and Package mode. In Project mode, no signing occurs, so internal vs public doesn't matter. In Package mode and internal, we will be signing everything to satisfy InternalsVisibleTo safely.

type: boolean
default: false

jobs:

- job: pack_sqlserver_package_job
Expand Down Expand Up @@ -94,19 +109,38 @@ jobs:
parameters:
debug: ${{ parameters.debug }}

# Download the assembly signing key for internal Package-mode builds.
- ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}:
- template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self

Comment thread
paulmedynski marked this conversation as resolved.
# Create the NuGet packages.
- task: DotNetCoreCLI@2
displayName: Create NuGet Package
inputs:
command: pack
packagesToPack: $(project)
configurationToPack: ${{ parameters.buildConfiguration }}
packDirectory: $(dotnetPackagesDir)
verbosityToPack: ${{ parameters.dotnetVerbosity }}
# BuildNumber supplies the revision component of FileVersion
# (Major.Minor.Patch.Revision). Without it, FileVersionBuildNumber
# defaults to 0 and the assembly is stamped Major.Minor.Patch.0.
buildProperties: SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }};BuildNumber=$(Build.BuildNumber)
- ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}:
- task: DotNetCoreCLI@2
displayName: Create NuGet Package
inputs:
command: pack
packagesToPack: $(project)
configurationToPack: ${{ parameters.buildConfiguration }}
packDirectory: $(dotnetPackagesDir)
verbosityToPack: ${{ parameters.dotnetVerbosity }}
# BuildNumber supplies the revision component of FileVersion
# (Major.Minor.Patch.Revision). Without it, FileVersionBuildNumber
# defaults to 0 and the assembly is stamped Major.Minor.Patch.0.
buildProperties: SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }};BuildNumber=$(Build.BuildNumber);SigningKeyPath="$(driverKeyFile.secureFilePath)"

- ${{ else }}:
- task: DotNetCoreCLI@2
displayName: Create NuGet Package
inputs:
command: pack
packagesToPack: $(project)
configurationToPack: ${{ parameters.buildConfiguration }}
packDirectory: $(dotnetPackagesDir)
verbosityToPack: ${{ parameters.dotnetVerbosity }}
# BuildNumber supplies the revision component of FileVersion
# (Major.Minor.Patch.Revision). Without it, FileVersionBuildNumber
# defaults to 0 and the assembly is stamped Major.Minor.Patch.0.
buildProperties: SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }};BuildNumber=$(Build.BuildNumber)

- task: PublishPipelineArtifact@1
displayName: Publish Pipeline Artifact
Expand Down
4 changes: 2 additions & 2 deletions eng/pipelines/onebranch/jobs/validate-signed-package-job.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,8 +157,8 @@ jobs:
$nugetPackageInstallPath = "${{ variables.nugetPackageInstallPath }}"
echo "nugetPackageInstallPath= $nugetPackageInstallPath"

# Verify strong name signing #####################################
echo "> 1. Verifying strong name signing of DLLs ..."
# Verify strong-name signing ###################################
echo "> 1. Verifying strong-name signing of DLLs ..."

# @TODO: This path seems brittle to VS upgrades, can we make it more flexible?
$snPath = "C:\Program Files (x86)\Microsoft SDKs\Windows\*\bin\NETFX 4.8.1 Tools\sn.exe"
Expand Down
10 changes: 3 additions & 7 deletions eng/pipelines/onebranch/steps/build-buildproj-step.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,12 +57,8 @@ parameters:
type: string

steps:
# Download the strong name signing key from secure file storage
- task: DownloadSecureFile@1
displayName: 'Download Signing Key'
inputs:
secureFile: 'netfxKeypair.snk'
name: keyFile
# Download the assembly signing key from secure file storage.
- template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self

- task: DotNetCoreCLI@2
displayName: 'build.proj - Build${{ parameters.packageShortName }}'
Expand All @@ -74,7 +70,7 @@ steps:
-p:Configuration=${{ parameters.buildConfiguration }}
-p:ReferenceType=Package
-p:SkipDependencyPack=true
-p:SigningKeyPath="$(keyFile.secureFilePath)"
-p:SigningKeyPath="$(driverKeyFile.secureFilePath)"
-p:BuildNumber="${{ parameters.revision }}"
-p:PackageVersion${{ parameters.versionPropertySuffix }}="${{ parameters.packageVersion }}"
${{ parameters.dependencyArguments }}
Expand Down
17 changes: 17 additions & 0 deletions eng/pipelines/stages/build-sqlserver-package-ci-stage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,21 @@ parameters:
- detailed
- diagnostic

# The C# project reference type to use when building and packing the packages.
- name: referenceType
type: string
default: Project
values:
# Reference sibling packages as NuGet packages.
- Package
# Reference sibling packages as C# projects.
- Project

# True when building on the internal ADO.Net project.
- name: isInternalBuild
type: boolean
default: false

stages:

- stage: build_sqlserver_package_stage
Expand All @@ -83,3 +98,5 @@ stages:
# The version is computed by this stage (see the sqlServerPackageVersion variable above).
sqlServerPackageVersion: $(sqlServerPackageVersion)
dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
referenceType: ${{ parameters.referenceType }}
isInternalBuild: ${{ parameters.isInternalBuild }}
Loading