Skip to content

Content type overrides in [Content_Types].xml are not honored #1015

Description

@kennethr127

Describe the bug
Currently, the Overrides in the [Content_Types].xml file in the package are not being honored during signing.

For example, if the package contains two .txt files, 'file1.txt' and 'file2.txt', and the [Content_Types].xml defines the default ContentType for .txt as 'text/plain' but has an Override for 'file2.txt' to be 'text/xml', it will still use 'text/plain' when signing for 'file2.txt' instead of 'text/xml'.

Repro steps
This is an example vsix that will not honor the overrides properly: https://github.com/kennethr127/sign/blob/db8f4bc9336b04d1c851ac43a36a4344989e1d2e/test/Sign.Core.Test/TestAssets/VSIXSamples/OpenVsixSignToolTest-Overrides.vsix

  1. Sign the package (Ex: dotnet sign.dll code azure-key-vault "C:\Users\kereuter\Downloads\OpenVsixSignToolTest-Overrides.vsix" -kvu <KeyVaultURL> -kvc <CertName> -o "C:\Users\kereuter\Downloads\OpenVsixSignToolTest-Overrides-Signed.vsix" -act azure-cli)
  2. Use PackageDigitalSignatureManager.VerifySignatures to check the signature (script example seen below)
$packagePath = "C:\Users\kereuter\Downloads\OpenVsixSignToolTest-Overrides-Signed.vsix"
[Reflection.Assembly]::LoadWithPartialName('WindowsBase') | Out-Null
$packageToSign = [System.IO.Packaging.Package]::Open($packagePath)
$signatureManager = New-Object System.IO.Packaging.PackageDigitalSignatureManager($packageToSign)
$signatureManager.VerifySignatures($true)
$packageToSign.Close()

Expected behavior
The call to $signatureManager.VerifySignatures($true) returns "Success"

Actual behavior
The call to $signatureManager.VerifySignatures($true) returns "InvalidSignature"

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions