Describe the bug
Currently, the Overrides in the [Content_Types].xml file in the package are not being honored during signing.
For example, if the package contains two .txt files, 'file1.txt' and 'file2.txt', and the [Content_Types].xml defines the default ContentType for .txt as 'text/plain' but has an Override for 'file2.txt' to be 'text/xml', it will still use 'text/plain' when signing for 'file2.txt' instead of 'text/xml'.
Repro steps
This is an example vsix that will not honor the overrides properly: https://github.com/kennethr127/sign/blob/db8f4bc9336b04d1c851ac43a36a4344989e1d2e/test/Sign.Core.Test/TestAssets/VSIXSamples/OpenVsixSignToolTest-Overrides.vsix
- Sign the package (Ex:
dotnet sign.dll code azure-key-vault "C:\Users\kereuter\Downloads\OpenVsixSignToolTest-Overrides.vsix" -kvu <KeyVaultURL> -kvc <CertName> -o "C:\Users\kereuter\Downloads\OpenVsixSignToolTest-Overrides-Signed.vsix" -act azure-cli)
- Use PackageDigitalSignatureManager.VerifySignatures to check the signature (script example seen below)
$packagePath = "C:\Users\kereuter\Downloads\OpenVsixSignToolTest-Overrides-Signed.vsix"
[Reflection.Assembly]::LoadWithPartialName('WindowsBase') | Out-Null
$packageToSign = [System.IO.Packaging.Package]::Open($packagePath)
$signatureManager = New-Object System.IO.Packaging.PackageDigitalSignatureManager($packageToSign)
$signatureManager.VerifySignatures($true)
$packageToSign.Close()
Expected behavior
The call to $signatureManager.VerifySignatures($true) returns "Success"
Actual behavior
The call to $signatureManager.VerifySignatures($true) returns "InvalidSignature"
Describe the bug
Currently, the Overrides in the [Content_Types].xml file in the package are not being honored during signing.
For example, if the package contains two .txt files, 'file1.txt' and 'file2.txt', and the [Content_Types].xml defines the default ContentType for .txt as 'text/plain' but has an Override for 'file2.txt' to be 'text/xml', it will still use 'text/plain' when signing for 'file2.txt' instead of 'text/xml'.
Repro steps
This is an example vsix that will not honor the overrides properly: https://github.com/kennethr127/sign/blob/db8f4bc9336b04d1c851ac43a36a4344989e1d2e/test/Sign.Core.Test/TestAssets/VSIXSamples/OpenVsixSignToolTest-Overrides.vsix
dotnet sign.dll code azure-key-vault "C:\Users\kereuter\Downloads\OpenVsixSignToolTest-Overrides.vsix" -kvu <KeyVaultURL> -kvc <CertName> -o "C:\Users\kereuter\Downloads\OpenVsixSignToolTest-Overrides-Signed.vsix" -act azure-cli)Expected behavior
The call to
$signatureManager.VerifySignatures($true)returns "Success"Actual behavior
The call to
$signatureManager.VerifySignatures($true)returns "InvalidSignature"