Automatically signing ALL compiled output files

Question

I have a .net-core 3.1 project (Microsoft.NET.Sdk.Web) in gitlab, and am setting up a CI/CD pipeline for it. As the final step, I want to have all the .dll and .exe output files signed by our key. I can do this by manually putting in some 'signtool' commands as a part of the gitlab-ci.yml file, however that requires going into each project and manually tweaking the file to reflect the specifics of that project.

On the other hand, I have been able to add a generic target in the .csproj file which calls signtool as an exec/command on $(TargetDir)$(TargetFileName). This works to a degree - but it doesn't sign everything. In this case, it signs (e.g.) cthulhu.dll, but not also cthulhu.Views.dll (both of which are shown in the CLI output of 'dotnet msbuild') and there's also a cthulhu.exe that is generated but is not shown in the msbuild output and also not signed.

The csproj file has this as the target (tried running both after rebuild and after publish):

And the gitlab-ci.yml file looks like this (I'm aware that I'm using the sdk docker container, but it seems to let me support .net-core builds anyway, whereas there is a bug preventing the specific .net-core container from working):

image: mcr.microsoft.com/dotnet/framework/sdk:4.8

stages:
  - build
  - release

build:
  stage: build
  script:
    - 'dotnet build -r win-x64'

release:
    stage: release
    script:
      - 'dotnet add package signtool --version 10.0.17763.132'
      - 'dotnet msbuild cthulhu.csproj /t:"Restore;Rebuild;SignAssembly;Publish" /p:SelfContained=True /p:PublishProtocol=FileSystem /p:Configuration=Release /p:Platform=x64 /p:TargetFrameworks=netcoreapp3.1 /p:PublishDir=bin\Release
etcoreapp3.1\publish\win-x64 /p:RuntimeIdentifier=win-x64 /p:PublishReadyToRun=False /p:PublishTrimmed=True'
    artifacts:
      name: "$CI_JOB_STAGE-$CI_COMMIT_REF_NAME" 
      paths:
        - '.\bin\Release
etcoreapp3.1\publish\win-x64'

user_3851967 · Answer

Why not use standard tools - Directory.Build.props?

However, now you can add a new property to every project in one step by defining it in a single file called Directory.Build.props in the root folder that contains your source. When MSBuild runs, Microsoft.Common.props searches your directory structure for the Directory.Build.props file (and Microsoft.Common.targets looks for Directory.Build.targets). If it finds one, it imports the property. Directory.Build.props is a user-defined file that provides customizations to projects under a directory

Indicates that the assembly should be signed:

true

The key is specified using the following property:

key.pfx

That is, as a result, these properties will be imported into the projects and you will achieve the desired result.

Automatically signing ALL compiled output files

1 Answers