From fd00a0a18b02652006e5591eb92738d5935b2584 Mon Sep 17 00:00:00 2001
From: Jerome Laban <jerome@platform.uno>
Date: Thu, 9 Apr 2026 16:06:43 -0400
Subject: [PATCH 1/2] ci: Adjust signing

---
 .azure-pipelines.yml   | 13 ++++++++-----
 build/SignClient.json  | 13 -------------
 build/sign-package.ps1 | 28 +++++++++++++++++++++-------
 3 files changed, 29 insertions(+), 25 deletions(-)
 delete mode 100644 build/SignClient.json

diff --git a/.azure-pipelines.yml b/.azure-pipelines.yml
index d61c7dc..da55e33 100644
--- a/.azure-pipelines.yml
+++ b/.azure-pipelines.yml
@@ -70,12 +70,15 @@ steps:
     inputs:
       filePath: build/Sign-Package.ps1
     env:
-      SignClientUser: $(SignClientUser)
-      SignClientSecret: $(SignClientSecret)
-      SignPackageName: "Uno.PackageDiff"
-      SignPackageDescription: "Uno.PackageDiff"
+      VaultSignTenantId: $(VaultSignTenantId)
+      VaultSignClientId: $(VaultSignClientId)
+      VaultSignClientSecret: $(VaultSignClientSecret)
+      VaultSignCertificate: $(VaultSignCertificate)
+      VaultSignUrl: $(VaultSignUrl)
+      SignPackageName: "Uno.Core"
+      SignPackageDescription: "Uno.Core"
       ArtifactDirectory: $(build.artifactstagingdirectory)
-    condition: and(succeeded(), not(eq(variables['build.reason'], 'PullRequest')), not(eq(variables['SignClientSecret'], '')), not(eq(variables['SignClientUser'], '')))
+    condition: and(succeeded(), not(eq(variables['build.reason'], 'PullRequest')), not(eq(variables['VaultSignClientSecret'], '')), not(eq(variables['VaultSignClientId'], '')))
 
   - task: PublishBuildArtifacts@1
     inputs:
diff --git a/build/SignClient.json b/build/SignClient.json
deleted file mode 100644
index 173e169..0000000
--- a/build/SignClient.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "SignClient": {
-	"AzureAd": {
-	"AADInstance": "https://login.microsoftonline.com/",
-	"ClientId": "8138ef14-0570-432c-8aad-9f73f05297d5",
-	"TenantId": "6d53ef61-b6d1-4150-ae0b-43b90e75e0cd"
-	},
-	"Service": {
-	  "Url": "https://nv-signservice.azurewebsites.net",
-	  "ResourceId": "https://SignService/715027a2-5a78-4271-9a16-f4502f1706fe"
-	}
-  }
-}
diff --git a/build/sign-package.ps1 b/build/sign-package.ps1
index 41dbc56..44b6bb7 100644
--- a/build/sign-package.ps1
+++ b/build/sign-package.ps1
@@ -1,21 +1,35 @@
 $currentDirectory = split-path $MyInvocation.MyCommand.Definition
 
 # See if we have the ClientSecret available
-if ([string]::IsNullOrEmpty($env:SignClientSecret)) {
+if ([string]::IsNullOrEmpty($env:VaultSignClientSecret)) {
     Write-Host "Client Secret not found, not signing packages"
     return;
 }
 
-dotnet tool install --tool-path . SignClient
+dotnet tool install --tool-path . sign --version 0.9.1-beta.25278.1
 
-# Setup Variables we need to pass into the sign client tool
-$appSettings = "$currentDirectory\SignClient.json"
-
-$filesToSign = Get-ChildItem -Recurse $Env:ArtifactDirectory\* -Include *.nupkg,*.vsix | Select-Object -ExpandProperty FullName
+$filesToSign = Get-ChildItem -Recurse $Env:ArtifactDirectory\* -Include *.nupkg | Select-Object -ExpandProperty FullName
 
 foreach ($fileToSign in $filesToSign) {
     Write-Host "Submitting $fileToSign for signing"
-    .\SignClient 'sign' -c $appSettings -i $fileToSign -r $env:SignClientUser -s $env:SignClientSecret -n "$env:SignPackageName" -d "$env:SignPackageDescription" -u "$env:build_repository_uri"
+
+    .\sign code azure-key-vault `
+        $fileToSign `
+        --publisher-name "$env:SignPackageName" `
+        --description "$env:SignPackageDescription" `
+        --description-url "$env:build_repository_uri" `
+        --azure-key-vault-tenant-id "$env:VaultSignTenantId" `
+        --azure-key-vault-client-id "$env:VaultSignClientId" `
+        --azure-key-vault-client-secret "$env:VaultSignClientSecret" `
+        --azure-key-vault-certificate "$env:VaultSignCertificate" `
+        --azure-key-vault-url "$env:VaultSignUrl" `
+        --verbosity information
+
+    if ($LASTEXITCODE -ne 0) {
+        Write-Error "Failed to sign $fileToSign"
+        exit $LASTEXITCODE
+    }
+
     Write-Host "Finished signing $fileToSign"
 }
 

From 3055c6fe7f02f049d04f3ec72d9760df37348a83 Mon Sep 17 00:00:00 2001
From: Jerome Laban <jerome@platform.uno>
Date: Thu, 9 Apr 2026 16:08:30 -0400
Subject: [PATCH 2/2] chore: Adjust for sign group

---
 .azure-pipelines.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.azure-pipelines.yml b/.azure-pipelines.yml
index da55e33..b42ec6b 100644
--- a/.azure-pipelines.yml
+++ b/.azure-pipelines.yml
@@ -10,7 +10,7 @@ trigger:
       - stable
       - release/stable/*
 
-pr: 
+pr:
   branches:
     include:
       - master
@@ -19,6 +19,9 @@ pr:
       - stable
       - release/stable/*
 
+variables:
+  - group: uno-codesign-vault
+
 steps:
   - checkout: self
     clean: 'true'