Repository navigation
Ensure signed 3P DLLs are included in publish output - #685
Merged
Merged
Conversation
embetten
changed the title
…blish - Remove DependsOnTargets='Build' from Add3rdPartyFilesToSign to fix MSB4006 circular dependency (BeforeTargets='SignFiles' is sufficient) - Add CopySignedDepsToPublish target to overwrite unsigned 3P DLLs in publish output with signed copies from OutDir (only runs when SignType set)
embetten
force-pushed
the
users/embetten/fix-3p-signing
branch
from
June 5, 2026 20:03
56005e9 to
0b35f37
Compare
John Schmeichel (JohnSchmeichel)
approved these changes
Jun 5, 2026
embetten
added a commit
that referenced
this pull request
Jun 8, 2026
## Problem `dotnet publish --no-build` resolves 3P NuGet dependencies (Newtonsoft.Json.dll, PowerArgs.dll) from the global NuGet cache rather than from OutDir. MicroBuild signs these DLLs in-place in OutDir during build, but publish never picks up those signed copies — resulting in unsigned 3P binaries in tarballs/zips. Additionally, `Add3rdPartyFilesToSign` had `DependsOnTargets='Build'` which caused a circular dependency (MSB4006). ## Fix 1. Add `CopySignedDepsToPublish` target (`AfterTargets='Publish'`) that copies the MicroBuild-signed 3P DLLs from OutDir over the unsigned copies in PublishDir. Only runs when `SignType` is set (official builds). 2. Remove `DependsOnTargets='Build'` from `Add3rdPartyFilesToSign` — `BeforeTargets='SignFiles'` alone is sufficient and avoids the circular dependency. ## Verification - Build succeeds locally (0 errors) - Confirmed VSIX artifact from pipeline build contains properly Authenticode-signed Newtonsoft.Json.dll and PowerArgs.dll - Tested locally: tampered OutDir DLL, then published — publish folder received the OutDir copy (not NuGet cache), proving the target works
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
dotnet publish --no-buildresolves 3P NuGet dependencies (Newtonsoft.Json.dll, PowerArgs.dll) from the global NuGet cache rather than from OutDir. MicroBuild signs these DLLs in-place in OutDir during build, but publish never picks up those signed copies — resulting in unsigned 3P binaries in tarballs/zips.Additionally,
Add3rdPartyFilesToSignhadDependsOnTargets='Build'which caused a circular dependency (MSB4006).Fix
CopySignedDepsToPublishtarget (AfterTargets='Publish') that copies the MicroBuild-signed 3P DLLs from OutDir over the unsigned copies in PublishDir. Only runs whenSignTypeis set (official builds).DependsOnTargets='Build'fromAdd3rdPartyFilesToSign—BeforeTargets='SignFiles'alone is sufficient and avoids the circular dependency.Verification