ClickOnce signing & 0.5.0 version requiring sign beta 0.9.1 manual installation

[petrimac]

Hello devs, and thanks for bringing us this build action! We are using clickonce for our desktop app delivery, and the new version was highly appreciated, as our current non-MS cert is expiring. However, building seems to require a beta version of sign tool, is it expected that it has to be installed? We have our own on-premise build agents, not using Azure DevOps ones.

Also, are the new ClickOnce properties expected to be visible as fields in the non-yaml build task (can't see them)?

[japarson]

Hi @petrimac , could you share with me the error you're hitting that has you wondering:

building seems to require a beta version of sign tool,

Regarding the properties not being visible, I'll have a fix out for that soon. Thank you for reporting it.

[petrimac]

Hi, here is the full log of the build task from my test build agent:

Starting: TrustedSigning client
==============================================================================
Task         : Trusted Signing
Description  : This task enables users to sign their files with the Trusted Signing service.
Version      : 0.5.1
Author       : Microsoft
Help         : 
==============================================================================
Checking for required dependencies.
	Build tools package installed: True
	Trusted signing package installed: True
	Sign CLI package installed: False
	All required dependencies are installed.

Creating metadata file: C:\Users\petri\AppData\Local\TrustedSigning\Microsoft.Trusted.Signing.Client\Microsoft.Trusted.Signing.Client.1.0.53\bin\x64\metadata.json

Getting the list of files to be signed.
	Getting files from list.
	Listed files: 1
		C:\agent\_work\27\s\MORS\MORS.WPF.Client\bin\publish\MORS.WPF.Client.application

	No files folder was provided.
	Filtered files: 0

	No catalog file was provided.
	Catalog files: 0

Formatting the list of files to be signed.

Batching the list of files to be signed by SignTool.
	No SignTool files were found to sign.

Batching the list of files to be signed by SignCli.
	Batched SignCli files: 1

Signing SignCli file batch 1 of 1.
	Executing sign.dll: dotnet "C:\Users\petri\AppData\Local\TrustedSigning\sign\sign.0.9.1-beta.24469.1\tools\net8.0\any\sign.dll" code trusted-signing -v debug -tse "[https://weu.codesigning.azure.net/"](https://weu.codesigning.azure.net/%22) -tsa "xxxx" -tscp "xxxx" -fd SHA256 -t http://timestamp.acs.microsoft.com/ -td SHA256 "C:\agent\_work\27\s\MORS\MORS.WPF.Client\bin\publish\MORS.WPF.Client.application"
Could not execute because the specified command or file was not found.
Possible reasons for this include:
  * You misspelled a built-in dotnet command.
  * You intended to execute a .NET program, but dotnet-C:\Users\petri\AppData\Local\TrustedSigning\sign\sign.0.9.1-beta.24469.1\tools\net8.0\any\sign.dll does not exist.
  * You intended to run a global tool, but a dotnet-prefixed executable with this name could not be found on the PATH.
##[error]SignCli failed with exit code 1
Finishing: TrustedSigning client

[japarson]

1. Make sure .NET 8 is installed on your on-prem build agent. I think the error indicates that it is not available to run the "dotnet" command due to the missing runtime.
2. This input looks a bit wonky to me: -tse "[https://weu.codesigning.azure.net/"](https://weu.codesigning.azure.net/%22). I think normally you would just need https://weu.codesigning.azure.net/. See this repo's README for an example.

[petrimac]

Thank you! I should have been more explicit: it actually works perfectly if I copy the sign tool files (extracted from the nuget package) to the location mentioned in the error message (C:\Users\petri\AppData\Local\TrustedSigning\sign\sign.0.9.1-beta.24469.1\tools\net8.0\any). I was just wondering if it was expected... and .NET 8 is definitely installed:

C:\Users\petri>dotnet --version 8.0.403

BTW, I had not included sign nuget package into the solution (I did not initially find it, but now did; needed to check 'Include prerelease' before it becomes visible). I had included Microsoft.Trusted.Signing.Client, not sure if it is necessary...

[japarson]

Hi @petrimac, sorry for the misunderstanding. You're totally right. There is a bug here. The workaround should be to clear your GitHub Actions cache. What's happening is that we are determining that all dependencies are installed only when 2/3 dependencies are installed, so the third one gets left out. If you clear your cache, all 3 will be installed. I'll put out a fix ASAP.

[petrimac]

Thank you, that should do it.