From 29c856de9169725843f497a3379396fecd17ef6d Mon Sep 17 00:00:00 2001
From: wtgodbe <wigodbe@microsoft.com>
Date: Wed, 19 Mar 2025 11:04:21 -0700
Subject: [PATCH 01/11] Make signing less custom

---
 eng/Publishing.props | 25 --------------
 eng/Signing.props    | 77 ++++++++++++++++----------------------------
 2 files changed, 28 insertions(+), 74 deletions(-)

diff --git a/eng/Publishing.props b/eng/Publishing.props
index 123a29d63ffd..6eb6251e223c 100644
--- a/eng/Publishing.props
+++ b/eng/Publishing.props
@@ -30,31 +30,6 @@
   <ItemGroup>
     <!-- Include our "loose" PDBs when publishing symbols. -->
     <FilesToPublishToSymbolServer Include="$(ArtifactsDir)symbols\**\*.pdb" />
-
-    <!-- Prepare for _PublishInstallersAndChecksums target. -->
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.jar" UploadPathSegment="jar/" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.pom" UploadPathSegment="jar/" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
-    <!-- All builds produce npm assets - only publish them once -->
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.tgz" UploadPathSegment="npm/"  Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
-    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.version" UploadPathSegment="Runtime/" Condition="'$(PublishInstallerBaseVersion)' == 'true'" />
-
-    <!-- The following installers create checksums -->
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.deb" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.rpm" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.tar.gz" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.zip" Exclude="$(ArtifactsPackagesDir)**\*.wixpack.zip" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-
-    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.zip" Exclude="$(ArtifactsDir)installers\$(Configuration)\**\*.wixpack.zip" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-
-    <Artifact Include="@(_InstallersToPublish)" Kind="Blob">
-      <!-- Working around msbuild not being able to negate the result of Contains() outside of targets -->
-      <IsShipping Condition="$([System.String]::Copy('%(Filename)').ToLowerInvariant().Contains('internal')) == 'True'">false</IsShipping>
-      <IsShipping Condition="$([System.String]::Copy('%(Filename)').ToLowerInvariant().Contains('internal')) != 'True'">true</IsShipping>
-    </Artifact>
   </ItemGroup>
 
   <Target Name="GetNonStableProductVersion">
diff --git a/eng/Signing.props b/eng/Signing.props
index 398ba5709db0..2469b0a80644 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -2,61 +2,12 @@
   <!-- See https://github.com/dotnet/arcade/blob/master/Documentation/CorePackages/Signing.md for details. -->
   <Import Project="Common.props" />
 
-  <ItemGroup>
-    <!-- Reset Arcade's defaults. -->
-    <ItemsToSign Remove="@(ItemsToSign)" />
-    <ItemsToSignPostBuild Remove="@(ItemsToSignPostBuild)" />
-    <FileExtensionSignInfo Remove="@(FileExtensionSignInfo)" />
-  </ItemGroup>
-
   <PropertyGroup>
     <!-- Use the dotnet certificate for any remaining defaults (e.g. StrongNameSignInfo) -->
     <UseDotNetCertificate>true</UseDotNetCertificate>
   </PropertyGroup>
 
-  <!-- Files that should be always be signed -->
-  <ItemGroup Label="Common Files to Sign">
-    <ItemsToSign Include="$(ArtifactsPackagesDir)**\*.nupkg" />
-    <ItemsToSign Include="$(ArtifactsPackagesDir)**\*.exe" />
-    <ItemsToSign Include="$(ArtifactsPackagesDir)**\*.msi" />
-    <ItemsToSign Include="$(ArtifactsPackagesDir)**\*.jar"  />
-    <ItemsToSign Include="$(ArtifactsPackagesDir)**\*.zip" />
-    <ItemsToSign Include="$(VisualStudioSetupOutputPath)**\*.vsix" />
-    <ItemsToSign Include="$(ArtifactsDir)installers\$(Configuration)\**\*.exe" />
-    <ItemsToSign Include="$(ArtifactsDir)installers\$(Configuration)\**\*.msi" />
-    <ItemsToSign Include="$(ArtifactsDir)installers\$(Configuration)\**\*.zip" />
-    <ItemsToSign Remove="$(ArtifactsPackagesDir)**\*symbols.nupkg" />
-  </ItemGroup>
-
   <ItemGroup Label="File signing information">
-    <!--
-      Map file extensions to a code-sign cert.
-      "None" means don't sign the file itself, but still scan the contents for signable files.
-    -->
-    <FileExtensionSignInfo Include=".jar" CertificateName="MicrosoftJARSHA2" />
-    <FileExtensionSignInfo Include=".ps1;.psd1;.psm1;.psc1" CertificateName="MicrosoftDotNet500" />
-    <FileExtensionSignInfo Include=".dll;.exe" CertificateName="MicrosoftDotNet500" />
-    <FileExtensionSignInfo Include=".nupkg" CertificateName="NuGet" />
-    <FileExtensionSignInfo Include=".vsix" CertificateName="VsixSHA2" />
-    <FileExtensionSignInfo Include=".zip" CertificateName="None" />
-    <FileExtensionSignInfo Include=".cab" CertificateName="None" />
-    <FileExtensionSignInfo Include=".msi" CertificateName="MicrosoftDotNet500" />
-
-    <!-- Native .dll's. These don't have a public key token, but are from Microsoft and should be signed. -->
-    <FileSignInfo Include="aspnetcore.dll" CertificateName="MicrosoftDotNet500" />
-    <FileSignInfo Include="aspnetcorev2_inprocess.dll" CertificateName="MicrosoftDotNet500" />
-    <FileSignInfo Include="aspnetcorev2_outofprocess.dll" CertificateName="MicrosoftDotNet500" />
-    <FileSignInfo Include="aspnetcorev2.dll" CertificateName="MicrosoftDotNet500" />
-    <FileSignInfo Include="blazor-devserver.exe" CertificateName="MicrosoftDotNet500" />
-    <FileSignInfo Include="dotnet-dev-certs.exe" CertificateName="MicrosoftDotNet500" />
-    <FileSignInfo Include="dotnet-sql-cache.exe" CertificateName="MicrosoftDotNet500" />
-    <FileSignInfo Include="dotnet-user-secrets.exe" CertificateName="MicrosoftDotNet500" />
-    <FileSignInfo Include="dotnet-watch.exe" CertificateName="MicrosoftDotNet500" />
-    <FileSignInfo Include="dotnet-openapi.exe" CertificateName="MicrosoftDotNet500" />
-    <FileSignInfo Include="dotnet-user-jwts.exe" CertificateName="MicrosoftDotNet500" />
-    <FileSignInfo Include="Microsoft.AspNetCore.Blazor.Build.exe" CertificateName="MicrosoftDotNet500" />
-    <FileSignInfo Include="sni.dll" CertificateName="MicrosoftDotNet500" />
-
     <!-- Third-party components which should be signed.  -->
     <FileSignInfo Include="Newtonsoft.Json.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="AngleSharp.dll" CertificateName="3PartySHA2" />
@@ -121,4 +72,32 @@
     <FileSignInfo Include="Microsoft.Identity.Client.dll" CertificateName="None" />
   </ItemGroup>
 
+  <!-- $(InstallersOutputPath), $(SymbolsOutputPath), and $(ChecksumExtensions) are not defined. Root Directory.Build.props is not imported. -->
+  <ItemGroup>
+    <!-- Prepare for _PublishInstallersAndChecksums target. -->
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.jar" UploadPathSegment="jar/" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.pom" UploadPathSegment="jar/" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
+    <!-- All builds produce npm assets - only publish them once -->
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.tgz" UploadPathSegment="npm/"  Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
+    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.version" UploadPathSegment="Runtime/" Condition="'$(PublishInstallerBaseVersion)' == 'true'" />
+
+    <!-- The following installers create checksums -->
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.deb" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.rpm" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.tar.gz" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.zip" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
+
+    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
+    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
+    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.zip" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
+
+    <Artifact Include="@(_InstallersToPublish)" Kind="Blob">
+      <!-- Working around msbuild not being able to negate the result of Contains() outside of targets -->
+      <IsShipping Condition="$([System.String]::Copy('%(Filename)').ToLowerInvariant().Contains('internal')) == 'True'">false</IsShipping>
+      <IsShipping Condition="$([System.String]::Copy('%(Filename)').ToLowerInvariant().Contains('internal')) != 'True'">true</IsShipping>
+    </Artifact>
+  </ItemGroup>
+
 </Project>

From 77e4875f539326df777f96e22d4ebb81b34092c7 Mon Sep 17 00:00:00 2001
From: wtgodbe <wigodbe@microsoft.com>
Date: Wed, 19 Mar 2025 11:21:54 -0700
Subject: [PATCH 02/11] Don't upload checksums for wixpacks

---
 eng/Signing.props | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/eng/Signing.props b/eng/Signing.props
index 2469b0a80644..e1dda231e753 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -87,11 +87,13 @@
     <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.tar.gz" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
     <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
     <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.zip" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.zip" Exclude="$(ArtifactsPackagesDir)**\*.wixpack.zip" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.wixpack.zip" UploadPathSegment="Runtime/" />
 
     <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
     <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.zip" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
+    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.zip" Exclude="$(ArtifactsDir)installers\$(Configuration)\**\*.wixpack.zip" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
+    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.wixpack.zip" UploadPathSegment="Runtime/" />
 
     <Artifact Include="@(_InstallersToPublish)" Kind="Blob">
       <!-- Working around msbuild not being able to negate the result of Contains() outside of targets -->

From dad093929f3ff24bc89a6d7c5c9de5038498ba4f Mon Sep 17 00:00:00 2001
From: wtgodbe <wigodbe@microsoft.com>
Date: Wed, 19 Mar 2025 12:00:44 -0700
Subject: [PATCH 03/11] Fix checksum for wixpacks

---
 eng/Signing.props | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/eng/Signing.props b/eng/Signing.props
index e1dda231e753..8de0d1c0d325 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -87,13 +87,15 @@
     <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.tar.gz" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
     <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
     <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.zip" Exclude="$(ArtifactsPackagesDir)**\*.wixpack.zip" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.wixpack.zip" UploadPathSegment="Runtime/" />
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.zip" Exclude="$(ArtifactsPackagesDir)**\*.wixpack.zip" UploadPathSegment="Runtime/" >
+       <ChecksumPath Condition="$([System.String]::Copy('%(Filename)%(Extension)').EndsWith('.wixpack.zip')) != 'true'">%(FullPath).sha512"</ChecksumPath>
+    </_InstallersToPublish>
 
     <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
     <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.zip" Exclude="$(ArtifactsDir)installers\$(Configuration)\**\*.wixpack.zip" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.wixpack.zip" UploadPathSegment="Runtime/" />
+    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.zip" Exclude="$(ArtifactsDir)installers\$(Configuration)\**\*.wixpack.zip" UploadPathSegment="Runtime/" >
+      <ChecksumPath Condition="$([System.String]::Copy('%(Filename)%(Extension)').EndsWith('.wixpack.zip')) != 'true'">%(FullPath).sha512"</ChecksumPath>
+    </_InstallersToPublish>
 
     <Artifact Include="@(_InstallersToPublish)" Kind="Blob">
       <!-- Working around msbuild not being able to negate the result of Contains() outside of targets -->

From a708951817773cbbf9f93fac6205292a2ea9cbcb Mon Sep 17 00:00:00 2001
From: wtgodbe <wigodbe@microsoft.com>
Date: Wed, 19 Mar 2025 12:01:47 -0700
Subject: [PATCH 04/11] Add more checksums

---
 eng/Signing.props | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/eng/Signing.props b/eng/Signing.props
index 8de0d1c0d325..00d72f17b139 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -75,10 +75,10 @@
   <!-- $(InstallersOutputPath), $(SymbolsOutputPath), and $(ChecksumExtensions) are not defined. Root Directory.Build.props is not imported. -->
   <ItemGroup>
     <!-- Prepare for _PublishInstallersAndChecksums target. -->
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.jar" UploadPathSegment="jar/" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.pom" UploadPathSegment="jar/" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.jar" UploadPathSegment="jar/" ChecksumPath="%(FullPath).sha512" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.pom" UploadPathSegment="jar/" ChecksumPath="%(FullPath).sha512" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
     <!-- All builds produce npm assets - only publish them once -->
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.tgz" UploadPathSegment="npm/"  Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.tgz" UploadPathSegment="npm/"  ChecksumPath="%(FullPath).sha512" Condition="'$(PublishAllBuildsAssetsInThisJob)' == 'true'" />
     <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.version" UploadPathSegment="Runtime/" Condition="'$(PublishInstallerBaseVersion)' == 'true'" />
 
     <!-- The following installers create checksums -->

From 0920c4b57c854fea69891384611ef145131f6503 Mon Sep 17 00:00:00 2001
From: wtgodbe <wigodbe@microsoft.com>
Date: Wed, 19 Mar 2025 12:43:21 -0700
Subject: [PATCH 05/11] Add more checksums

---
 eng/Signing.props | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/eng/Signing.props b/eng/Signing.props
index 00d72f17b139..ad933527a0a5 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -24,10 +24,10 @@
 
   <ItemGroup Label="Code sign exclusions">
     <!-- We don't need to code sign .js files because they are not used in Windows Script Host. -->
-    <FileExtensionSignInfo Include=".js" CertificateName="None" />
+    <FileExtensionSignInfo Update=".js" CertificateName="None" />
     <!-- We don't produce font files. We rebundle some for using the web browser, so they do not need to be signed. -->
-    <FileExtensionSignInfo Include=".otf" CertificateName="None" />
-    <FileExtensionSignInfo Include=".ttf" CertificateName="None" />
+    <FileExtensionSignInfo Update=".otf" CertificateName="None" />
+    <FileExtensionSignInfo Update=".ttf" CertificateName="None" />
     <!-- This is a text file which doesn't need to be code signed, even though some .mof files can be signed. -->
     <FileSignInfo Include="ancm.mof" CertificateName="None" />
     <!-- Exclude the apphost because this is expected to be code-signed by customers after the SDK modifies it. -->

From d197f170e87907006d1b8d868a811347ff93ee09 Mon Sep 17 00:00:00 2001
From: William Godbe <wigodbe@microsoft.com>
Date: Wed, 19 Mar 2025 13:14:14 -0700
Subject: [PATCH 06/11] Update eng/Signing.props

Co-authored-by: Viktor Hofer <viktor.hofer@microsoft.com>
---
 eng/Signing.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/Signing.props b/eng/Signing.props
index ad933527a0a5..56f7d675db44 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -87,7 +87,7 @@
     <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.tar.gz" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
     <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
     <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.zip" Exclude="$(ArtifactsPackagesDir)**\*.wixpack.zip" UploadPathSegment="Runtime/" >
+    <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.zip" UploadPathSegment="Runtime/" >
        <ChecksumPath Condition="$([System.String]::Copy('%(Filename)%(Extension)').EndsWith('.wixpack.zip')) != 'true'">%(FullPath).sha512"</ChecksumPath>
     </_InstallersToPublish>
 

From 5a92d4c5781c1e77ce66e9bed624421a4beb0f07 Mon Sep 17 00:00:00 2001
From: William Godbe <wigodbe@microsoft.com>
Date: Wed, 19 Mar 2025 13:14:43 -0700
Subject: [PATCH 07/11] Update eng/Signing.props

---
 eng/Signing.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/Signing.props b/eng/Signing.props
index 56f7d675db44..85c67a748a90 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -93,7 +93,7 @@
 
     <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
     <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
-    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.zip" Exclude="$(ArtifactsDir)installers\$(Configuration)\**\*.wixpack.zip" UploadPathSegment="Runtime/" >
+    <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.zip" UploadPathSegment="Runtime/" >
       <ChecksumPath Condition="$([System.String]::Copy('%(Filename)%(Extension)').EndsWith('.wixpack.zip')) != 'true'">%(FullPath).sha512"</ChecksumPath>
     </_InstallersToPublish>
 

From bb42b4740ed713df59c62eeb01e778688793ed09 Mon Sep 17 00:00:00 2001
From: William Godbe <wigodbe@microsoft.com>
Date: Wed, 19 Mar 2025 14:12:58 -0700
Subject: [PATCH 08/11] Update eng/Signing.props

---
 eng/Signing.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/Signing.props b/eng/Signing.props
index 85c67a748a90..779d2659992c 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -94,7 +94,7 @@
     <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
     <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
     <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.zip" UploadPathSegment="Runtime/" >
-      <ChecksumPath Condition="$([System.String]::Copy('%(Filename)%(Extension)').EndsWith('.wixpack.zip')) != 'true'">%(FullPath).sha512"</ChecksumPath>
+      <ChecksumPath Condition="$([System.String]::Copy('%(Filename)%(Extension)').EndsWith('.wixpack.zip')) != 'true'">%(FullPath).sha512</ChecksumPath>
     </_InstallersToPublish>
 
     <Artifact Include="@(_InstallersToPublish)" Kind="Blob">

From 0a299fe6bd321dccb5cd92e27b053836c3e76bde Mon Sep 17 00:00:00 2001
From: William Godbe <wigodbe@microsoft.com>
Date: Wed, 19 Mar 2025 14:13:19 -0700
Subject: [PATCH 09/11] Update eng/Signing.props

---
 eng/Signing.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/Signing.props b/eng/Signing.props
index 779d2659992c..529b8312b8d0 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -88,7 +88,7 @@
     <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
     <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.msi" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />
     <_InstallersToPublish Include="$(ArtifactsPackagesDir)**\*.zip" UploadPathSegment="Runtime/" >
-       <ChecksumPath Condition="$([System.String]::Copy('%(Filename)%(Extension)').EndsWith('.wixpack.zip')) != 'true'">%(FullPath).sha512"</ChecksumPath>
+       <ChecksumPath Condition="$([System.String]::Copy('%(Filename)%(Extension)').EndsWith('.wixpack.zip')) != 'true'">%(FullPath).sha512</ChecksumPath>
     </_InstallersToPublish>
 
     <_InstallersToPublish Include="$(ArtifactsDir)installers\$(Configuration)\**\*.exe" UploadPathSegment="Runtime/" ChecksumPath="%(FullPath).sha512" />

From 12844f9ec71ec017332b0db0cfa2e97bc27a226a Mon Sep 17 00:00:00 2001
From: wtgodbe <wigodbe@microsoft.com>
Date: Wed, 19 Mar 2025 14:56:23 -0700
Subject: [PATCH 10/11] Sign .js files

---
 eng/Signing.props | 2 --
 1 file changed, 2 deletions(-)

diff --git a/eng/Signing.props b/eng/Signing.props
index 529b8312b8d0..9b981c9c8abc 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -23,8 +23,6 @@
   </PropertyGroup>
 
   <ItemGroup Label="Code sign exclusions">
-    <!-- We don't need to code sign .js files because they are not used in Windows Script Host. -->
-    <FileExtensionSignInfo Update=".js" CertificateName="None" />
     <!-- We don't produce font files. We rebundle some for using the web browser, so they do not need to be signed. -->
     <FileExtensionSignInfo Update=".otf" CertificateName="None" />
     <FileExtensionSignInfo Update=".ttf" CertificateName="None" />

From a364d274c9061d8a9c1f4432726c6e28f83f374a Mon Sep 17 00:00:00 2001
From: wtgodbe <wigodbe@microsoft.com>
Date: Wed, 19 Mar 2025 15:08:14 -0700
Subject: [PATCH 11/11] Set sign info for .msi's

---
 eng/Signing.props | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/eng/Signing.props b/eng/Signing.props
index 9b981c9c8abc..5d4786646198 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -8,6 +8,9 @@
   </PropertyGroup>
 
   <ItemGroup Label="File signing information">
+    <!-- Arcade does not set a default for .msi's -->
+    <FileExtensionSignInfo Include=".msi" CertificateName="MicrosoftDotNet500" />
+
     <!-- Third-party components which should be signed.  -->
     <FileSignInfo Include="Newtonsoft.Json.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="AngleSharp.dll" CertificateName="3PartySHA2" />