[Project Support]: Code signing for Linux binaries?

[bradwilson]

Project

xUnit.net

Project Url

https://github.com/xunit

Description

We are planning to ship some Linux test runner binaries that are built using Native AOT, and I wondered if the code signing process supports Linux binaries. I sort of suspect based on the Windows-centric focus of the signing tool, the answer is "no", in which case my next question is: Can it be made to do so? (Note: I'm asking for it to sign Linux binaries, built via dotnet publish on a Windows machine during CI, in a way that makes sense for Linux; I am not asking for the signing process to take place on Linux).

Since these binaries will be shipped inside of NuGet packages, I would like them to be signed if possible, akin to the Windows binaries (which I assume will sign successfully; I guess I'll found out when I send the branch up for CI 😁).

I put "N/A" in the due by date, since I don't yet have a release date planned for our 4.0 release, which will be the first release to feature these new Native AOT runner binaries.

Due By

N/A

[glennawatson]

Potentially you can use https://ebourg.github.io/jsign/ instead. I've used it in the past for signing on linux.

[bradwilson]

I'm not trying to sign on Linux, I'm trying to sign for Linux.

[glennawatson]

What do you mean by signing then. On Windows that generally means authenticode signing.

On linux that can mean multiple things:

• SHA256 checksums + a signature (GPG/minisign), or
• Sigstore/Cosign signatures/attestations over the artifacts.

Like that isn't a universal thing on Linux.

[bradwilson]

That's the guidance I'm looking for: to understand what .NET Foundation expects to be signed, and how to achieve that. I thought it worth the discussion here if this subject has never been considered yet (including the technical details of how to achieve whatever is recommended).

I can put unsigned Linux and macOS binaries into my otherwise signed NuGet packages if that is the norm and what's expected of foundation projects.

[glennawatson]

I think our guidance will be since there's no established standards even amongst the Linux community we aren't going to enforce it on our community.

As long as you are using the sign tool against the nupkg I think you have made a best effort attempt.