From: Matt Mitchell <mmitche@microsoft.com>
Date: Wed, 11 Nov 2020 23:15:31 +0000 (-0800)
Subject: Add signing information to asset manifest (port #41889 and #42688) (#43896)
X-Git-Tag: submit/tizen/20210909.063632~4669
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=905a367719110c04197bf3a186a64109e7a3a219;p=platform%2Fupstream%2Fdotnet%2Fruntime.git

Add signing information to asset manifest (port #41889 and #42688) (#43896)

* Post build signing

* Add PostBuildSign flag
---

diff --git a/eng/Signing.props b/eng/Signing.props
index 471473f..5ebb3ba 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -1,140 +1,174 @@
 <Project>
 
+  <!-- If this file was pulled in via prepare-artifacts.proj (a non-SDK project, these files are already
+       imported. -->
+  <Import Project="$(RepositoryEngineeringDir)Configurations.props" Condition="'$(PrepareArtifacts)' != 'true'" />
+  <Import Project="$(RepositoryEngineeringDir)liveBuilds.targets" Condition="'$(PrepareArtifacts)' != 'true'" />
+
   <PropertyGroup>
     <!--
       Windows arm/arm64 jobs don't have MSIs to sign. Keep it simple: allow not finding any matches
       here and rely on overall signing validation.
+
+      During post build signing, there are no packages to sign during SignFinalPackages.
     -->
-    <AllowEmptySignList Condition="'$(SignFinalPackages)' != 'true'">true</AllowEmptySignList>
+    <AllowEmptySignList Condition="'$(SignFinalPackages)' != 'true' or '$(PostBuildSign)' == 'true'">true</AllowEmptySignList>
   </PropertyGroup>
 
-  <!-- Get artifact locations to sign. -->
-  <Import Project="$(RepositoryEngineeringDir)Configurations.props" />
-  <Import Project="$(RepositoryEngineeringDir)liveBuilds.targets" />
-
-  <!-- We need  this to be inside a target to workaround: https://github.com/microsoft/msbuild/issues/5445 -->
-  <Target Name="PrepareItemsToSign" BeforeTargets="Sign">
-
-    <ItemGroup>
-      <!--
-        Replace the default items to sign with the specific set we want. This allows the build to call
-        Arcade's Sign.proj multiple times for different sets of files as the build progresses.
-      -->
-      <ItemsToSign Remove="@(ItemsToSign)" />
-
-      <!-- Find bundle artifacts, which need multiple stages to fully sign. -->
-      <BundleInstallerEngineArtifact Include="$(ArtifactsPackagesDir)**/*engine.exe" />
-      <BundleInstallerExeArtifact Include="$(ArtifactsPackagesDir)**/*.exe" />
-
-      <!-- apphost and comhost template files are not signed, by design. -->
-      <FileSignInfo Include="apphost.exe;singlefilehost.exe;comhost.dll" CertificateName="None" />
-
-      <!-- Third-party components which should be signed.  -->
-      <FileSignInfo Include="Newtonsoft.Json.dll" CertificateName="3PartySHA2" />
-      <FileSignInfo Include="Mono.Cecil.dll" CertificateName="3PartySHA2" />
-      <FileSignInfo Include="Mono.Cecil.Mdb.dll" CertificateName="3PartySHA2" />
-      <FileSignInfo Include="Mono.Cecil.Pdb.dll" CertificateName="3PartySHA2" />
-      <FileSignInfo Include="Mono.Cecil.Rocks.dll" CertificateName="3PartySHA2" />
-    </ItemGroup>
-
-    <ItemGroup Condition="'$(CoreCLRCrossTargetComponentDirName)' != ''">
-      <CoreCLRCrossTargetItemsToSign Include="$(CoreCLRArtifactsPath)$(CoreCLRCrossTargetComponentDirName)/sharedFramework/*.dll" />
-      <CoreCLRCrossTargetItemsToSign Include="$(CoreCLRArtifactsPath)$(CoreCLRCrossTargetComponentDirName)/sharedFramework/*.exe" />
-    </ItemGroup>
-
-    <ItemGroup Condition="'$(SignBinaries)' == 'true'">
-      <!-- Sign CoreCLR. -->
-      <ItemsToSign Include="$(CoreCLRSharedFrameworkDir)*.dll" />
-      <ItemsToSign Include="$(CoreCLRSharedFrameworkDir)*.exe" />
-
-      <ItemsToSign Include="$(CoreCLRArtifactsPath)System.Private.CoreLib.dll" />
-
-      <ItemsToSign Include="$(CoreCLRCrossgen2Dir)crossgen2.exe" />
-      <ItemsToSign Include="$(CoreCLRCrossgen2Dir)crossgen2.dll" />
-      <ItemsToSign Include="$(CoreCLRCrossgen2Dir)ILCompiler.DependencyAnalysisFramework.dll" />
-      <ItemsToSign Include="$(CoreCLRCrossgen2Dir)ILCompiler.ReadyToRun.dll" />
-      <ItemsToSign Include="$(CoreCLRCrossgen2Dir)ILCompiler.TypeSystem.ReadyToRun.dll" />
-      <ItemsToSign Include="$(CoreCLRCrossgen2Dir)jitinterface_$(TargetArchitecture).dll" />
-
-      <ItemsToSign Include="$(CoreCLRCrossgen2Dir)clrjit_win_x86_$(TargetArchitecture).dll" />
-      <ItemsToSign Include="$(CoreCLRCrossgen2Dir)clrjit_win_arm_$(TargetArchitecture).dll" />
-      <ItemsToSign Include="$(CoreCLRCrossgen2Dir)clrjit_unix_arm_$(TargetArchitecture).dll" />
-      <ItemsToSign Condition="'$(TargetArchitecture)' == 'arm64' or  '$(TargetArchitecture)' == 'x64'" Include="$(CoreCLRCrossgen2Dir)clrjit_win_x64_$(TargetArchitecture).dll" />
-      <ItemsToSign Condition="'$(TargetArchitecture)' == 'arm64' or  '$(TargetArchitecture)' == 'x64'" Include="$(CoreCLRCrossgen2Dir)clrjit_win_arm64_$(TargetArchitecture).dll" />
-      <ItemsToSign Condition="'$(TargetArchitecture)' == 'arm64' or  '$(TargetArchitecture)' == 'x64'" Include="$(CoreCLRCrossgen2Dir)clrjit_unix_x64_$(TargetArchitecture).dll" />
-      <ItemsToSign Condition="'$(TargetArchitecture)' == 'arm64' or  '$(TargetArchitecture)' == 'x64'" Include="$(CoreCLRCrossgen2Dir)clrjit_unix_arm64_$(TargetArchitecture).dll" />
-
-      <ItemsToSign Include="@(CoreCLRCrossTargetItemsToSign)" />
-
-      <FileSignInfo Include="mscordaccore.dll" CertificateName="MicrosoftSHA2" />
-
-      <!-- Sign api-ms-win-core-xstate-l2-1-0 binary as it is only catalog signed in the current SDK. -->
-      <ItemsToSign
-        Condition="'$(Configuration)' == 'Release' and '$(TargetArchitecture)' == 'x86'"
-        Include="$(CoreCLRArtifactsPath)Redist\ucrt\DLLs\$(TargetArchitecture)\api-ms-win-core-xstate-l2-1-0.dll" />
-
-      <!-- Sign libraries. -->
-      <ItemsToSign Include="$(LibrariesNativeArtifactsPath)*.dll" />
-      <ItemsToSign Include="$(LibrariesSharedFrameworkRefArtifactsPath)*.dll" />
-      <!-- Most runtime artifacts will be crossgenned, so sign them post-crossgen. mscorlib isn't. -->
-      <ItemsToSign Include="$(LibrariesSharedFrameworkBinArtifactsPath)mscorlib.dll" />
-
-      <!-- Sign the host. -->
-      <ItemsToSign Include="$(BaseOutputRootPath)corehost/**/hostfxr.dll" />
-      <ItemsToSign Include="$(BaseOutputRootPath)corehost/**/hostpolicy.dll" />
-      <ItemsToSign Include="$(BaseOutputRootPath)corehost/**/dotnet.exe" />
-      <ItemsToSign Include="$(BaseOutputRootPath)corehost/**/ijwhost.dll" />
-      <ItemsToSign Include="$(BaseOutputRootPath)corehost/**/nethost.dll" />
-
-      <!-- Sign managed libraries in installer subset. -->
-      <ItemsToSign Include="$(ArtifactsBinDir)Microsoft.NET.HostModel/**/*.dll" />
-    </ItemGroup>
-
-    <!-- Sign ready-to-run binaries after crossgen is applied. -->
-    <ItemGroup Condition="'$(SignR2RBinaries)' == 'true'">
-      <ItemsToSign Include="$(CrossGenRootPath)**/*.dll" />
-    </ItemGroup>
-
-    <ItemGroup Condition="'$(SignMsiFiles)' == 'true'">
-      <ItemsToSign Include="$(ArtifactsPackagesDir)**/*.msi" />
-      <ItemsToSign Include="$(ArtifactsPackagesDir)**/*.cab" />
-    </ItemGroup>
-
-    <ItemGroup Condition="'$(SignBurnEngineFiles)' == 'true'">
-      <ItemsToSign Include="@(BundleInstallerEngineArtifact)" />
-    </ItemGroup>
-
-    <ItemGroup Condition="'$(SignBurnBundleFiles)' == 'true'">
-      <!-- Sign the bundles, now that the engine is reattached. Avoid re-signing the engine. -->
-      <ItemsToSign
-        Include="@(BundleInstallerExeArtifact)"
-        Exclude="@(BundleInstallerEngineArtifact)" />
-      <!-- Note: wixstdba is internal to the engine bundle and does not get signed. -->
-    </ItemGroup>
-
-    <ItemGroup Condition="'$(SignFinalPackages)' == 'true'">
-      <DownloadedSymbolPackages Include="$(DownloadDirectory)**\*.symbols.nupkg" />
-      <ItemsToSign Include="$(DownloadDirectory)**\*.nupkg" Exclude="@(DownloadedSymbolPackages)" />
-
-      <!-- The cross OS diagnostics symbol packages need to be signed as they are the only packages
-      that have a specific version of assets that are only meant to be indexed in symbol servers.
-      Since only *symbols.nupkg get indexed, and installer doesn't produce these, we need to glob them for signing. -->
-      <ItemsToSign Include="$(DownloadDirectory)**\*CrossOsDiag*.symbols.nupkg" />
-
-      <ItemsToSign Include="$(DownloadDirectory)**\*.deb" />
-      <ItemsToSign Include="$(DownloadDirectory)**\*.rpm" />
-    </ItemGroup>
-
-    <ItemGroup>
-      <ItemsToSign Update="@(ItemsToSign)" Authenticode="$(CertificateId)" />
-    </ItemGroup>
-
-  </Target>
-
   <ItemGroup>
+    <!--
+      Replace the default items to sign with the specific set we want. This allows the build to call
+      Arcade's Sign.proj multiple times for different sets of files as the build progresses.
+    -->
+    <ItemsToSign Remove="@(ItemsToSign)" />
+
+    <!-- Find bundle artifacts, which need multiple stages to fully sign. -->
+    <BundleInstallerEngineArtifact Include="$(ArtifactsPackagesDir)**/*engine.exe" />
+    <BundleInstallerExeArtifact Include="$(ArtifactsPackagesDir)**/*.exe" />
+
+    <!-- apphost and comhost template files are not signed, by design. -->
+    <FileSignInfo Include="apphost.exe;singlefilehost.exe;comhost.dll" CertificateName="None" />
+
+    <!-- Third-party components which should be signed.  -->
+    <FileSignInfo Include="Newtonsoft.Json.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="Mono.Cecil.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="Mono.Cecil.Mdb.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="Mono.Cecil.Pdb.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="Mono.Cecil.Rocks.dll" CertificateName="3PartySHA2" />
+
+    <FileSignInfo Include="mscordaccore.dll" CertificateName="MicrosoftSHA2" />
+
+    <!-- Exclude symbol packages from have a NuGet signature. These are never pushed to NuGet.org or
+         other feeds (in fact, that have identical identity to their non-symbol variant) -->
+    <DownloadedSymbolPackages Include="$(DownloadDirectory)**\*.symbols.nupkg" />
+    <DownloadedSymbolPackagesWithoutPaths Include="@(DownloadedSymbolPackages->'%(Filename)%(Extension)')" />
+    <FileSignInfo Include="@(DownloadedSymbolPackagesWithoutPaths->Distinct())" CertificateName="None" />
+
     <FileExtensionSignInfo Include=".msi" CertificateName="Microsoft400" />
     <FileExtensionSignInfo Include=".pkg" CertificateName="8003" />
     <FileExtensionSignInfo Include=".deb;.rpm" CertificateName="LinuxSign" />
   </ItemGroup>
 
+  <!-- When doing post build signing, the file containers (e.g. nupkg, msi, etc.) are
+       processed for signing (opened up, individually signed, etc.) and these individual ItemsToSign
+       elements are unnecessary. When signing within the build, we need to individually process
+       dll's, exes, etc. that go into msi's because these containers are not able to be processed
+       by SignTool after they are packed up. What makes this possible for post build signing
+       is that the build will produce a zip file containing the inputs to the Wix light linker
+       which can be used to create the installer later, after the inputs have been signed and replaced. -->
+  <Choose>
+    <When Condition="'$(PostBuildSign)' != 'true'">
+      <ItemGroup Condition="'$(SignBinaries)' == 'true'">
+        <!-- Sign CoreCLR. -->
+        <ItemsToSign Include="$(CoreCLRSharedFrameworkDir)*.dll" />
+        <ItemsToSign Include="$(CoreCLRSharedFrameworkDir)*.exe" />
+
+        <ItemsToSign Include="$(CoreCLRArtifactsPath)System.Private.CoreLib.dll" />
+
+        <ItemsToSign Include="$(CoreCLRCrossgen2Dir)crossgen2.exe" />
+        <ItemsToSign Include="$(CoreCLRCrossgen2Dir)crossgen2.dll" />
+        <ItemsToSign Include="$(CoreCLRCrossgen2Dir)ILCompiler.DependencyAnalysisFramework.dll" />
+        <ItemsToSign Include="$(CoreCLRCrossgen2Dir)ILCompiler.ReadyToRun.dll" />
+        <ItemsToSign Include="$(CoreCLRCrossgen2Dir)ILCompiler.TypeSystem.ReadyToRun.dll" />
+        <ItemsToSign Include="$(CoreCLRCrossgen2Dir)jitinterface_$(TargetArchitecture).dll" />
+
+        <ItemsToSign Include="$(CoreCLRCrossgen2Dir)clrjit_win_x86_$(TargetArchitecture).dll" />
+        <ItemsToSign Include="$(CoreCLRCrossgen2Dir)clrjit_win_arm_$(TargetArchitecture).dll" />
+        <ItemsToSign Include="$(CoreCLRCrossgen2Dir)clrjit_unix_arm_$(TargetArchitecture).dll" />
+        <ItemsToSign Condition="'$(TargetArchitecture)' == 'arm64' or '$(TargetArchitecture)' == 'x64'" Include="$(CoreCLRCrossgen2Dir)clrjit_win_x64_$(TargetArchitecture).dll" />
+        <ItemsToSign Condition="'$(TargetArchitecture)' == 'arm64' or '$(TargetArchitecture)' == 'x64'" Include="$(CoreCLRCrossgen2Dir)clrjit_win_arm64_$(TargetArchitecture).dll" />
+        <ItemsToSign Condition="'$(TargetArchitecture)' == 'arm64' or '$(TargetArchitecture)' == 'x64'" Include="$(CoreCLRCrossgen2Dir)clrjit_unix_x64_$(TargetArchitecture).dll" />
+        <ItemsToSign Condition="'$(TargetArchitecture)' == 'arm64' or '$(TargetArchitecture)' == 'x64'" Include="$(CoreCLRCrossgen2Dir)clrjit_unix_arm64_$(TargetArchitecture).dll" />
+
+        <ItemsToSign Include="$(CoreCLRArtifactsPath)$(CoreCLRCrossTargetComponentDirName)/sharedFramework/*.dll" Condition="'$(CoreCLRCrossTargetComponentDirName)' != ''" />
+        <ItemsToSign Include="$(CoreCLRArtifactsPath)$(CoreCLRCrossTargetComponentDirName)/sharedFramework/*.exe" Condition="'$(CoreCLRCrossTargetComponentDirName)' != ''" />
+
+        <!-- Sign api-ms-win-core-xstate-l2-1-0 binary as it is only catalog signed in the current SDK. -->
+        <ItemsToSign
+          Condition="'$(Configuration)' == 'Release' and '$(TargetArchitecture)' == 'x86'"
+          Include="$(CoreCLRArtifactsPath)Redist\ucrt\DLLs\$(TargetArchitecture)\api-ms-win-core-xstate-l2-1-0.dll" />
+
+        <!-- Sign libraries. -->
+        <ItemsToSign Include="$(LibrariesNativeArtifactsPath)*.dll" />
+        <ItemsToSign Include="$(LibrariesSharedFrameworkRefArtifactsPath)*.dll" />
+        <!-- Most runtime artifacts will be crossgenned, so sign them post-crossgen. mscorlib isn't. -->
+        <ItemsToSign Include="$(LibrariesSharedFrameworkBinArtifactsPath)mscorlib.dll" />
+
+        <!-- Sign the host. -->
+        <ItemsToSign Include="$(BaseOutputRootPath)corehost/**/hostfxr.dll" />
+        <ItemsToSign Include="$(BaseOutputRootPath)corehost/**/hostpolicy.dll" />
+        <ItemsToSign Include="$(BaseOutputRootPath)corehost/**/dotnet.exe" />
+        <ItemsToSign Include="$(BaseOutputRootPath)corehost/**/ijwhost.dll" />
+        <ItemsToSign Include="$(BaseOutputRootPath)corehost/**/nethost.dll" />
+
+        <!-- Sign managed libraries in installer subset. -->
+        <ItemsToSign Include="$(ArtifactsBinDir)Microsoft.NET.HostModel/**/*.dll" />
+      </ItemGroup>
+
+      <!-- Sign ready-to-run binaries after crossgen is applied. -->
+      <ItemGroup Condition="'$(SignR2RBinaries)' == 'true'">
+        <ItemsToSign Include="$(CrossGenRootPath)**/*.dll" />
+      </ItemGroup>
+
+      <ItemGroup Condition="'$(SignMsiFiles)' == 'true'">
+        <ItemsToSign Include="$(ArtifactsPackagesDir)**/*.msi" />
+        <ItemsToSign Include="$(ArtifactsPackagesDir)**/*.cab" />
+      </ItemGroup>
+
+      <ItemGroup Condition="'$(SignBurnEngineFiles)' == 'true'">
+        <ItemsToSign Include="@(BundleInstallerEngineArtifact)" />
+      </ItemGroup>
+
+      <ItemGroup Condition="'$(SignBurnBundleFiles)' == 'true'">
+        <!-- Sign the bundles, now that the engine is reattached. Avoid re-signing the engine. -->
+        <ItemsToSign
+          Include="@(BundleInstallerExeArtifact)"
+          Exclude="@(BundleInstallerEngineArtifact)" />
+        <!-- Note: wixstdba is internal to the engine bundle and does not get signed. -->
+      </ItemGroup>
+
+      <ItemGroup Condition="'$(SignFinalPackages)' == 'true'">
+        <DownloadedSymbolPackages Include="$(DownloadDirectory)**\*.symbols.nupkg" />
+        <ItemsToSign Include="$(DownloadDirectory)**\*.nupkg" Exclude="@(DownloadedSymbolPackages)" />
+
+        <!-- The cross OS diagnostics symbol packages need to be signed as they are the only packages
+        that have a specific version of assets that are only meant to be indexed in symbol servers.
+        Since only *symbols.nupkg get indexed, and installer doesn't produce these, we need to glob them for signing. -->
+        <ItemsToSign Include="$(DownloadDirectory)**\*CrossOsDiag*.symbols.nupkg" />
+
+        <ItemsToSign Include="$(DownloadDirectory)**\*.deb" />
+        <ItemsToSign Include="$(DownloadDirectory)**\*.rpm" />
+      </ItemGroup>
+    </When>
+
+    <!-- When doing post build signing, we sign all artifacts we would push.
+         Symbol packages are included too. -->
+    <When Condition="'$(PostBuildSign)' == 'true'">
+      <ItemGroup>
+        <ItemsToSignWithPaths Include="$(DownloadDirectory)**/*.msi" Condition="'$(PrepareArtifacts)' == 'true'" />
+        <ItemsToSignWithPaths Include="$(DownloadDirectory)**/*.exe" Condition="'$(PrepareArtifacts)' == 'true'" />
+        <ItemsToSignWithPaths Include="$(DownloadDirectory)**/*.nupkg" Condition="'$(PrepareArtifacts)' == 'true'" />
+        <ItemsToSignWithPaths Include="$(DownloadDirectory)**/*.zip" Condition="'$(PrepareArtifacts)' == 'true'" />
+
+        <ItemsToSignWithoutPaths Include="@(ItemsToSignWithPaths->'%(Filename)%(Extension)')" />
+        <ItemsToSignPostBuild Include="@(ItemsToSignWithoutPaths->Distinct())" />
+      </ItemGroup>
+
+      <!-- Even when doing post build signing, sign mscordaccore*.dll and mscordbi.dll -->
+      <ItemGroup Condition="'$(SignBinaries)' == 'true'">
+        <ItemsToSign Include="$(CoreCLRSharedFrameworkDir)mscordaccore*.dll" />
+        <ItemsToSign Include="$(CoreCLRSharedFrameworkDir)mscordbi.dll" />
+        <ItemsToSign Include="$(CoreCLRArtifactsPath)$(CoreCLRCrossTargetComponentDirName)/sharedFramework/mscordaccore*.dll" Condition="'$(CoreCLRCrossTargetComponentDirName)' != ''" />
+        <ItemsToSign Include="$(CoreCLRArtifactsPath)$(CoreCLRCrossTargetComponentDirName)/sharedFramework/mscordbi.dll" Condition="'$(CoreCLRCrossTargetComponentDirName)' != ''" />
+      </ItemGroup>
+
+      <ItemGroup Condition="'$(SignFinalPackages)' == 'true'">
+        <!-- The cross OS diagnostics symbol packages need to be signed as they are the only packages
+        that have a specific version of assets that are only meant to be indexed in symbol servers.
+        Since only *symbols.nupkg get indexed, and installer doesn't produce these, we need to glob them for signing. -->
+        <ItemsToSign Include="$(DownloadDirectory)**\*CrossOsDiag*.nupkg" />
+      </ItemGroup>
+    </When>
+  </Choose>
+
 </Project>
diff --git a/eng/pipelines/common/download-artifact-step.yml b/eng/pipelines/common/download-artifact-step.yml
index 6bb0462..b3f4973 100644
--- a/eng/pipelines/common/download-artifact-step.yml
+++ b/eng/pipelines/common/download-artifact-step.yml
@@ -19,6 +19,6 @@ steps:
   - task: ExtractFiles@1
     displayName: 'Unzip ${{ parameters.displayName }}'
     inputs:
-      archiveFilePatterns: $(Build.SourcesDirectory)/__download__/${{ parameters.artifactName }}/${{ parameters.artifactFileName }}
+      archiveFilePatterns: $(Build.SourcesDirectory)/__download__/${{ parameters.artifactName }}/**/${{ parameters.artifactFileName }}
       destinationFolder: ${{ parameters.unpackFolder }}
       cleanDestinationFolder: ${{ parameters.cleanUnpackFolder }}
diff --git a/eng/pipelines/installer/jobs/base-job.yml b/eng/pipelines/installer/jobs/base-job.yml
index 5ace7f3..64d4da3 100644
--- a/eng/pipelines/installer/jobs/base-job.yml
+++ b/eng/pipelines/installer/jobs/base-job.yml
@@ -560,7 +560,8 @@ jobs:
       condition: and(
         succeeded(),
         eq(variables['_BuildConfig'], 'Release'),
-        ne(variables['DisableVSPublish'], 'true'))
+        ne(variables['DisableVSPublish'], 'true'),
+        ne(variables['PostBuildSign'], 'true'))
 
   - template: steps/upload-job-artifacts.yml
     parameters:
diff --git a/eng/pipelines/official/jobs/prepare-signed-artifacts.yml b/eng/pipelines/official/jobs/prepare-signed-artifacts.yml
index 42c8bb6..7b0eba0 100644
--- a/eng/pipelines/official/jobs/prepare-signed-artifacts.yml
+++ b/eng/pipelines/official/jobs/prepare-signed-artifacts.yml
@@ -10,7 +10,7 @@ jobs:
   dependsOn: ${{ parameters.dependsOn }}
   pool:
     name: NetCoreInternal-Pool
-    queue: buildpool.windows.10.amd64.vs2017
+    queue: buildpool.windows.10.amd64.vs2019
   # Double the default timeout.
   timeoutInMinutes: 120
   workspace:
@@ -33,7 +33,8 @@ jobs:
       zipSources: false
       feedSource: https://dnceng.pkgs.visualstudio.com/_packaging/MicroBuildToolset/nuget/v3/index.json
     continueOnError: false
-    condition: and(succeeded(), in(variables['SignType'], 'real', 'test'))
+    condition: and(succeeded(), 
+                in(variables['SignType'], 'real', 'test'))
 
   - task: DownloadBuildArtifacts@0
     displayName: Download IntermediateUnsignedArtifacts
diff --git a/eng/pipelines/runtime-official.yml b/eng/pipelines/runtime-official.yml
index 62c07cb..91e8529 100644
--- a/eng/pipelines/runtime-official.yml
+++ b/eng/pipelines/runtime-official.yml
@@ -32,6 +32,8 @@ variables:
   value: .NETCore
 - name: _DotNetValidationArtifactsCategory
   value: .NETCoreValidation
+- name: PostBuildSign
+  value: false
 
 stages:
 - stage: Build
diff --git a/src/installer/publish/Directory.Build.targets b/src/installer/publish/Directory.Build.targets
index 7c618f5..24576c8 100644
--- a/src/installer/publish/Directory.Build.targets
+++ b/src/installer/publish/Directory.Build.targets
@@ -15,10 +15,16 @@
       $(DownloadDirectory)IntermediateUnsignedArtifacts\Windows_x64\Shipping\a.nupkg
   -->
   <Target Name="FindDownloadedArtifacts">
+
     <ItemGroup>
       <DownloadedArtifactFile Include="$(DownloadDirectory)**" />
 
+      <Error
+        Condition="'@(DownloadedArtifactFile)' == ''"
+        Text="No downloaded artifacts found." />
+
       <DownloadedSymbolNupkgFile Include="$(DownloadDirectory)**\*.symbols.nupkg" />
+      <DownloadedWixPdbFile Include="$(DownloadDirectory)**\*.wixpdb" />
       <DownloadedNupkgFile
         Include="$(DownloadDirectory)**\*.nupkg"
         Exclude="@(DownloadedSymbolNupkgFile)" />
@@ -26,7 +32,7 @@
       <!-- Add files that are not affected by filtering. -->
       <UploadToBlobStorageFile
         Include="@(DownloadedArtifactFile)"
-        Exclude="@(DownloadedSymbolNupkgFile);@(DownloadedNupkgFile)" />
+        Exclude="@(DownloadedSymbolNupkgFile);@(DownloadedNupkgFile);@(DownloadedWixPdbFile)" />
 
       <!--
         Filter out the RID-specific (Runtime) nupkgs and RID-agnostic nupkgs. RID-specific packages
@@ -94,6 +100,16 @@
       <SymbolNupkgToPublishFile
         Include="@(PotentialSymbolNupkgToPublishFile -> Distinct())"
         Condition="Exists('%(Identity)')" />
+    
+      <!-- Split nupkgs into shipping/nonshipping for BAR categorization. -->
+      <ShippingNupkgToPublishFile
+        Include="@(NupkgToPublishFile)"
+        Condition="$([System.String]::new('%(Identity)').Contains('\Shipping\'))" />
+
+      <NonShippingNupkgToPublishFile
+        Include="@(NupkgToPublishFile)"
+        Exclude="@(ShippingNupkgToPublishFile)" />
+
     </ItemGroup>
 
     <Error
diff --git a/src/installer/publish/prepare-artifacts.proj b/src/installer/publish/prepare-artifacts.proj
index fdd37b8..a2643b2 100644
--- a/src/installer/publish/prepare-artifacts.proj
+++ b/src/installer/publish/prepare-artifacts.proj
@@ -1,5 +1,15 @@
 <Project DefaultTargets="Build">
   <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
+  
+  <!-- When doing post build sign, pull in the arcade sign.props file, which will
+       create some initial sign groups and then pulls in the repo's custom Signing.props overrides.
+       Before importing the signing props. Set PrepareArtifactst=true. Depending on context (SDK project vs. not),
+       the initial imports of livebuilds.targets and Configuration.props are already imported and thus cannot
+       be imported again. Without those imports, the globbing of files to sign will not work properly. -->
+  <PropertyGroup>
+    <PrepareArtifacts>true</PrepareArtifacts>
+  </PropertyGroup>
+  <Import Project="../tools/Sign.props" Sdk="Microsoft.DotNet.Arcade.Sdk" />
 
   <UsingTask TaskName="GenerateChecksums" AssemblyFile="$(InstallerTasksAssemblyPath)" />
 
@@ -55,72 +65,19 @@
       Properties="DownloadDirectory=$(DownloadDirectory)" />
   </Target>
 
-  <Target Name="PreparePublishToAzureBlobFeed">
+  <Target Name="PreparePublishToAzureBlobFeed"
+          DependsOnTargets="GetProductVersions;FindDownloadedArtifacts">
     <Error Condition="'$(PackagesUrl)'==''" Text="Missing property PackagesUrl" />
 
     <PropertyGroup>
-      <ExpectedFeedUrl>$(PackagesUrl)</ExpectedFeedUrl>
       <AssetManifestFilename>Manifest.xml</AssetManifestFilename>
       <AssetManifestFile>$(ArtifactsLogDir)AssetManifest/$(AssetManifestFilename)</AssetManifestFile>
 
       <!-- Create temp dir to store generated asset manifest, per Arcade guidance. -->
       <TempWorkingDir>$(ArtifactsObjDir)TempWorkingDir\$([System.Guid]::NewGuid())\</TempWorkingDir>
-    </PropertyGroup>
-
-    <ItemGroup>
-      <!-- Split nupkgs into shipping/nonshipping for BAR categorization. -->
-      <ShippingNupkgToPublishFile
-        Include="@(NupkgToPublishFile)"
-        Condition="$([System.String]::new('%(Identity)').Contains('\Shipping\'))" />
-
-      <NonShippingNupkgToPublishFile
-        Include="@(NupkgToPublishFile)"
-        Exclude="@(ShippingNupkgToPublishFile)" />
-
-      <ItemsToPush Remove="@(ItemsToPush)" />
-
-      <ItemsToPush Include="@(ShippingNupkgToPublishFile)" />
-      <ItemsToPush Include="@(NonShippingNupkgToPublishFile)" ManifestArtifactData="NonShipping=true" />
-      <ItemsToPush Include="@(SymbolNupkgToPublishFile)" />
-    </ItemGroup>
-
-    <!-- Push items to AzDO as build artifacts, generating the asset manifest as a side effect. -->
-    <PushToAzureDevOpsArtifacts
-      ItemsToPush="@(ItemsToPush)"
-      ManifestBuildData="@(ManifestBuildData)"
-      ManifestRepoUri="$(BUILD_REPOSITORY_NAME)"
-      ManifestBranch="$(BUILD_SOURCEBRANCH)"
-      ManifestBuildId="$(BUILD_BUILDNUMBER)"
-      ManifestCommit="$(BUILD_SOURCEVERSION)"
-      IsStableBuild="$(IsStableBuild)"
-      AssetManifestPath="$(AssetManifestFile)"
-      AssetsTemporaryDirectory="$(TempWorkingDir)"
-      PublishingVersion="3" />
-
-    <!-- Copy the generated manifest to the build's artifacts -->
-    <Copy SourceFiles="$(AssetManifestFile)" DestinationFolder="$(TempWorkingDir)" />
-
-    <Message Importance="High" Text="Uploading $(AssetManifestFilename) to pipeline" />
-    <Message
-      Text="##vso[artifact.upload containerfolder=AssetManifests;artifactname=AssetManifests]$(TempWorkingDir)$(AssetManifestFilename)"
-      Importance="High" />
-  </Target>
-
-  <Target Name="PreparePublishFilesToAzureBlobFeed"
-          DependsOnTargets="GetProductVersions">
-    <Error Condition="'$(PackagesUrl)'==''" Text="Missing property PackagesUrl" />
-
-    <PropertyGroup>
-      <ExpectedFeedUrl>$(PackagesUrl)</ExpectedFeedUrl>
-      <AssetManifestFilename>Manifest_Installers.xml</AssetManifestFilename>
-      <AssetManifestFile>$(ArtifactsLogDir)AssetManifest/$(AssetManifestFilename)</AssetManifestFile>
-
-      <!-- Create temp dir to store generated asset manifest, per Arcade guidance. -->
-      <TempWorkingDir>$(ArtifactsObjDir)TempWorkingDir\$([System.Guid]::NewGuid())\</TempWorkingDir>
-
+      
       <ProductVersionTxtContents Condition="'$(StabilizePackageVersion)'=='true'">$(ProductionVersion)</ProductVersionTxtContents>
       <ProductVersionTxtContents Condition="'$(StabilizePackageVersion)'!='true'">$(ProductVersion)</ProductVersionTxtContents>
-
     </PropertyGroup>
 
     <!-- Generate productVersion.txt containing the value of $(PackageVersion) -->
@@ -129,29 +86,43 @@
       Lines="$(ProductVersionTxtContents)"
       Overwrite="true"
       Encoding="ASCII" />
-
+      
     <ItemGroup>
       <ItemsToPush Remove="@(ItemsToPush)" />
 
+      <ItemsToPush Include="@(ShippingNupkgToPublishFile)" />
+      <ItemsToPush Include="@(NonShippingNupkgToPublishFile)" ManifestArtifactData="NonShipping=true" />
+      <ItemsToPush Include="@(SymbolNupkgToPublishFile)" />
+      
       <ItemsToPush
         Include="@(UploadToBlobStorageFile)"
         Exclude="@(NupkgToPublishFile);@(SymbolNupkgToPublishFile)">
         <RelativeBlobPath>$(InstallersRelativePath)%(Filename)%(Extension)</RelativeBlobPath>
+        <PublishFlatContainer>true</PublishFlatContainer>
       </ItemsToPush>
 
       <ItemsToPush Include="@(GeneratedChecksumFile)">
         <RelativeBlobPath>$(InstallersRelativePath)%(Filename)%(Extension)</RelativeBlobPath>
         <Category>Checksum</Category>
+        <PublishFlatContainer>true</PublishFlatContainer>
       </ItemsToPush>
 
       <ItemsToPush Include="$(ArtifactsShippingPackagesDir)productVersion.txt">
         <RelativeBlobPath>$(InstallersRelativePath)productVersion.txt</RelativeBlobPath>
+        <PublishFlatContainer>true</PublishFlatContainer>
       </ItemsToPush>
 
     </ItemGroup>
 
     <!-- Push items to AzDO as build artifacts, generating the asset manifest as a side effect. -->
     <PushToAzureDevOpsArtifacts
+      AzureDevOpsCollectionUri="$(SYSTEM_TEAMFOUNDATIONCOLLECTIONURI)"
+      AzureDevOpsProject="$(SYSTEM_TEAMPROJECT)"
+      AzureDevOpsBuildId="$(BUILD_BUILDID)"
+      ItemsToSign="@(ItemsToSignPostBuild)"
+      StrongNameSignInfo="@(StrongNameSignInfo)"
+      FileSignInfo="@(FileSignInfo)"
+      FileExtensionSignInfo="@(FileExtensionSignInfo)"
       ItemsToPush="@(ItemsToPush)"
       ManifestBuildData="@(ManifestBuildData)"
       ManifestRepoUri="$(BUILD_REPOSITORY_NAME)"
@@ -159,7 +130,6 @@
       ManifestBuildId="$(BUILD_BUILDNUMBER)"
       ManifestCommit="$(BUILD_SOURCEVERSION)"
       IsStableBuild="$(IsStableBuild)"
-      PublishFlatContainer="true"
       AssetManifestPath="$(AssetManifestFile)"
       AssetsTemporaryDirectory="$(TempWorkingDir)"
       PublishingVersion ="3" />
@@ -184,8 +154,7 @@
             FindDownloadedArtifacts;
             SignPackages;
             CreateChecksums;
-            PreparePublishToAzureBlobFeed;
-            PreparePublishFilesToAzureBlobFeed">
+            PreparePublishToAzureBlobFeed">
     <Message Importance="High" Text="Complete!" />
   </Target>