Repository navigation
XPlat Signing and verification for dotnet core & monoΒ #7939
Description
This epic covers the work needed in order to fully port NuGet's package signing and verification features to all platforms, including mono, as well as the dotnet command itself.
The dotnet APIs have specific XPLAT behaviors that we need to address when tackling signing and verification XPLAT. This will mean either document known behavior or do functional changes in specific platforms.
Some things are:
- X509RevocationMode.Offline is not supported on macOS
- OSCP are not supported in Linux
Note: Make sure to read the document before implementing since it might change.
There is an initial PR and a summary of remaining work in that PR over at NuGet/NuGet.Client#2706
Activity
clairernovotny commentedon Apr 10, 2019
Note this PR shows it working: NuGet/NuGet.Client#2545
There are a couple of comments in there w.r.t. a
ComputeSignatureoverload that needs to be changed as well.bruno-garcia commentedon Jun 19, 2019
Any update on this? We've got a certificate laying around since August last year but having to get a Windows VM just to run the signing (Thanks @onovotny for SignService) is not ideal.
karann-msft commentedon Jul 12, 2019
hey @bruno-garcia - we are actively working on this.
bruno-garcia commentedon Jul 12, 2019
Highly appreciated!
[-]Work on xplat verification / signing for dotnet core & mono[/-][+]Support package verification / signing for dotnet core & mono (xplat)[/+]44 remaining items
heng-liu commentedon Aug 2, 2021
There is no work left for xplat signing and verification for dotnet core based on the current plan.
Pls refer to the following documents for xplat signing and verification related commands:
https://docs.microsoft.com/en-us/dotnet/core/tools/dotnet-nuget-verify
https://docs.microsoft.com/en-us/dotnet/core/tools/dotnet-nuget-trust
https://docs.microsoft.com/en-us/dotnet/core/tools/dotnet-nuget-sign
For Mono, currently there is no plan for enabling signing and verification.
raffaeler commentedon Oct 26, 2021
@heng-liu The docs do not mention how to sign on Ubuntu (which is the default for GitHub actions).
Should I create the pfx from the base64 and then use the file command line? Suggested tooling?
To avoid reinventing the wheel, could you please add here (and then in the docs) the relevant details please?
heng-liu commentedon Oct 26, 2021
Hi @raffaeler , thanks for your question!
May I know what's the original format of the cert you have on Ubuntu?
Or could you check if any command in page https://www.openssl.org/docs/man1.1.0/man1/openssl-pkcs12.html is helpful?
Can you please let us know if you find out any workable commands? Thanks!
raffaeler commentedon Oct 27, 2021
Thank you @heng-liu
I got the certificate from DigiCert. I installed it on Windows certification store but I also downloaded the .crt which is the usually preferred method on Linux.
I would ask you to publish the exact commands to be added to the GitHub actions when an Ubuntu machine is used.
I believe this is a very popular use-case as Nuget is pushing towards signing the packages.
frivard-coveo commentedon Oct 27, 2021
The dotnet-nuget-sign command expects a PFX file, which is quite uncommon on Linux-based systems. In my case I see PEM files in our infrastructure.
I found the following Stack Overflow answer which might be very useful : https://stackoverflow.com/a/808742/15480824
Basically, the OpenSSL tool can be used to combine a CRT and a PEM file into a PFX file.
This seems like an unfortunate workaround, since the .NET Core libraries now support working with formats other than PFX. But the nuget sign command does not seem to have been updated.
raffaeler commentedon Oct 27, 2021
Thank you very much @frivard-coveo
In may personal case I can export the pfx from Windows and encode using base64 ubuntu utility from WSL, put it in the GitHub secrets and decode it in the GitHub action.
But I am very worried for the missing pieces (both in the tool and the documentation) for the Linux scenario given that now is so popular (and the default on GitHub actions).
I kindly ask @heng-liu to provide some kind of feedback about the missing pieces and hope they will soon filled in.
janstaelensskyline commentedon Jan 20, 2023
Did someone ever get this working? dotnet-nuget-sign with a pfx file on a github action running on Ubuntu?
We've been unable to get it running nor have we found any clear documentation on how to get the signing to work.
Even when providing a pfx file containing the full chain we get the errors:
error: NU3018: PartialChain: unable to get local issuer certificate
error: NU3018: Certificate chain validation failed.