Add assembly signing for Microsoft.SqlServer.Server by paulmedynski · Pull Request #4566 · dotnet/SqlClient

paulmedynski · 2026-08-21T14:38:21Z

What's This All About?

The first 5 PRs in this stack are all about adding assembly signing and public-key-protected InternalsVisibleTo support to the legacy CI pipeline. This is infrastructure work necessary to support the Native AOT fix in the final PR.

We have never been including assembly signing in our CI, which IMO was a blind spot. Now, when CI runs in our internal ADO.Net project, all assemblies will be signed, we will be running tests against signed assemblies, and fully testing our nascent inter-assembly IVT just as it would be in a real app. Public project CI and all of our PR pipelines will continue to use unsigned assemblies, and testing that requires inter-assembly IVT will only be done in Project mode (PR, legacy CI Project-mode pipeline) or via internal CI with signed assemblies.

The 6th and final PR in the stack addresses the Native AOT issue #4193 by eliminating inter-assembly reflection and using signed IVT with proper package dependencies.

Description

This PR sets up assembly signing in the legacy CI pipeline for the SqlServer project. Microsoft.SqlServer.Server was not receiving SigningKeyPath when it was packed by the internal, Package-reference CI flow. As a result, that package could be produced without the strong-name signing applied to the other internal package artifacts. Internal Package-mode builds need a consistent set of signed assemblies; public builds and Project-reference builds should continue to build without access to the internal signing key.

This PR:

adds a reusable pipeline step for downloading either the driver or test assembly-signing key from Azure DevOps secure files;
updates the existing internal package and OneBranch flows to use the shared step and a consistent driverKeyFile output name;
threads isInternalBuild and referenceType through the CI core, SqlServer stage, and SqlServer pack job;
downloads the driver key and passes SigningKeyPath when packing Microsoft.SqlServer.Server only for internal Package-reference builds; and
leaves public and Project-reference builds unsigned and unchanged.

Supplying SigningKeyPath activates the existing signing behavior in src/Directory.Build.props; this PR does not change product source, public APIs, package contents beyond assembly signing, or compatibility behavior.

Issues

Works towards addressing #4193.

Testing

This is a pipeline-only change, so no unit or integration tests were added.

The GitHub PR validation pipelines exercise the public Package-reference and Project-reference paths and are currently running. The internal signing branch requires the ADO.Net secure file and is exercised only by an internal Package-reference pipeline run.

CI pipeline runs

The GitHub PR pipelines never set isInternalBuild, so they always take the unsigned path. The CI runs below are what actually exercise this change, and together they cover all four quadrants of the signing matrix:

Project	Pipeline	Run	Reference mode	Signing expected
public	CI-SqlClient	23809	Project	No - public
public	CI-SqlClient-Package	23809	Package	No - public
ADO.Net	MDS Main CI	23806	Project	No - Project mode
ADO.Net	MDS Main CI-Package	23804	Package	Yes - internal + Package

Artifact verification

The SqlServer.Artifacts package produced by each run was downloaded and inspected with tools/PackageValidator, which reads signing state from CLI metadata. It requires both a public key and the CorFlags.StrongNameSigned bit, so it distinguishes a fully signed assembly from a delay-signed one.

Run	Project	Mode	net462	netstandard2.0	Public key token
CI-SqlClient 23809	public	Project	Unsigned	Unsigned	none
CI-SqlClient-Package 23809	public	Package	Unsigned	Unsigned	none
MDS Main CI 23806	ADO.Net	Project	Unsigned	Unsigned	none
MDS Main CI-Package 23804	ADO.Net	Package	Signed	Signed	`23ec7fc2d6eaa4a5`

Only the internal + Package quadrant is signed, both target frameworks report Signed rather than DelaySigned, and 23ec7fc2d6eaa4a5 is the SqlClient family public key token. PackageValidator's unsigned finding count across the four runs above is 2, 2, 2, and 0 respectively, dropping to zero only where signing is expected.

All four runs were re-queued after addressing review feedback: the public pair on 0fd3a4000, and the internal pair on the synced branch tip 3d0c96fc, which carries that commit in its ancestry. The verification above was re-run against these current artifacts. Each package embeds its source commit in the informational version (...-ci23809+0fd3a400 for the public pair, ...+3d0c96fc for the internal pair), confirming which commit produced each result.

Copilot

Pull request overview

Updates the Azure DevOps pipeline templates to enable strong-name (assembly) signing for Microsoft.SqlServer.Server in internal build scenarios, and centralizes secure-file key download logic into a reusable step template.

Changes:

Added a shared download-assembly-signing-key.yml step template to download signing keys from secure files.
Threaded isInternalBuild (and referenceType) through the CI core → SqlServer stage/job to conditionally apply SigningKeyPath during packing.
Updated OneBranch build steps and the internal package CI pipeline to use the shared download template and the new driverKeyFile reference.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
eng/pipelines/stages/build-sqlserver-package-ci-stage.yml	Adds `referenceType` / `isInternalBuild` parameters and forwards them to the SqlServer pack job.
eng/pipelines/onebranch/steps/build-buildproj-step.yml	Switches to the shared signing-key download template and uses `driverKeyFile.secureFilePath`.
eng/pipelines/onebranch/jobs/validate-signed-package-job.yml	Comment wording tweak around strong-name signing verification.
eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml	Conditionally downloads signing key + passes `SigningKeyPath` for internal Package-mode packing.
eng/pipelines/dotnet-sqlclient-ci-project-reference-pipeline.yml	Passes `isInternalBuild` into the core template based on `System.TeamProject`.
eng/pipelines/dotnet-sqlclient-ci-package-reference-pipeline.yml	Passes `isInternalBuild` into the core template based on `System.TeamProject`.
eng/pipelines/dotnet-sqlclient-ci-core.yml	Introduces `isInternalBuild` parameter and forwards it into the SqlServer build stage.
eng/pipelines/common/steps/download-assembly-signing-key.yml	New reusable step template to download driver/test SNK secure files.
eng/pipelines/ci/package/sqlclient-ci-package-pipeline.yml	Uses the shared signing-key download template in internal package CI pipeline.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

paulmedynski · 2026-08-21T14:55:48Z

-          inputs:
-            secureFile: netfxKeypair.snk
-          name: driverKeyFile
+        - template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self


This PR adds a shared helper template to download signing keys, so you will see changes to several pipeline like this.

paulmedynski · 2026-08-21T15:00:08Z

+      - Project
+
+  # True when building on the internal ADO.Net project.
+  - name: isInternalBuild


You will see this concept throughout the PR stack, used to determine when assembly signing is required.

The PR pipelines (legacy and modern) always use Project mode, and never sign any assemblies. They will not have this concept.

The modern CI pipeline always uses Package mode, and when running on ADO.Net, it will sign all assemblies (driver and test).

The legacy CI pipelines use both Project and Package mode. In Project mode, no signing occurs, so internal vs public doesn't matter. In Package mode and internal, we will be signing everything to satisfy InternalsVisibleTo safely.

Is this because the PR pipelines run on the public ADO project and don't have access to those secrets? If it's not, I'd argue maybe it's just easier to always strong name sign the assemblies.

The legacy CI pipelines run in both projects (public and internal). That's the pipeline these changes (and the next 4 PRs in the stack) are targeting. Each of these CI PRs is pretty small, and we need to keep them functioning while the new CI pipelines are brought online, hence what seems like a bunch of work on the legacy stuff.

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

Copilot

🟢 Approval recommended

The parameter threading and conditional secure-file/key usage is consistent across updated pipelines and appears to correctly constrain signing to internal Package-reference builds.

Review details

Files reviewed: 11/11 changed files
Comments generated: 0 new
Review effort level: Lite

- Split download-assembly-signing-key.yml into download-driver-signing-key-step.yml and download-test-signing-key-step.yml, each parameterless with its own output. - Restore "strong-name signing" terminology; always name the driver or test key. - Remove parameter defaults added in this branch; pass values explicitly, including isInternalBuild: false in both PR pipelines. - Fold the driver key download into the existing signing conditional in the pack job.

Pre-emptively align this PR with the review feedback already addressed lower in the stack, so the same comments aren't raised again. - Reference the split download-driver-signing-key-step.yml and download-test-signing-key-step.yml templates instead of the removed download-assembly-signing-key.yml. - Quote SigningKeyPath and TestSigningKeyPath to tolerate whitespace in the secure file paths. - Fold the driver key download into the existing signing conditional in the pack job, removing the duplicated conditional. - Use positive referenceType comparisons (eq 'Package'). - Drop the referenceType and isInternalBuild parameter defaults; both are already passed explicitly by every caller. - Move the BuildNumber/FileVersion note directly above buildProperties in every pack branch. - Restore "strong-name signing" terminology and name the driver or test key explicitly.

- Split download-assembly-signing-key.yml into download-driver-signing-key-step.yml and download-test-signing-key-step.yml, each parameterless with its own output. - Restore "strong-name signing" terminology; always name the driver or test key. - Remove parameter defaults added in this branch; pass values explicitly, including isInternalBuild: false in both PR pipelines. - Fold the driver key download into the existing signing conditional in the pack job.

Pre-emptively align this PR with the review feedback already addressed lower in the stack, so the same comments aren't raised again. - Reference the split download-driver-signing-key-step.yml and download-test-signing-key-step.yml templates instead of the removed download-assembly-signing-key.yml. - Use positive referenceType comparisons (eq 'Package'). - Drop the isInternalBuild parameter defaults; every caller already passes it explicitly. - Use "strong-name signing" terminology and name the driver or test key in the signingKeyPath/testSigningKeyPath parameter docs, correcting the stale note about test-filter categories.

- Split download-assembly-signing-key.yml into download-driver-signing-key-step.yml and download-test-signing-key-step.yml, each parameterless with its own output. - Restore "strong-name signing" terminology; always name the driver or test key. - Remove parameter defaults added in this branch; pass values explicitly, including isInternalBuild: false in both PR pipelines. - Fold the driver key download into the existing signing conditional in the pack job.

Pre-emptively align this PR with the review feedback already addressed lower in the stack, so the same comments aren't raised again. - Reference the split download-driver-signing-key-step.yml and download-test-signing-key-step.yml templates instead of the removed download-assembly-signing-key.yml. - Quote SigningKeyPath and TestSigningKeyPath to tolerate whitespace in the secure file paths. - Fold the driver key download into the existing signing conditional in the pack job, removing the duplicated conditional. - Use positive referenceType comparisons (eq 'Package'). - Drop the isInternalBuild parameter defaults; every caller already passes it explicitly. - Normalize the BuildNumber/FileVersion note across all pack branches. - Restore an accidentally dropped blank line in Azure.Test.csproj.

Introduce the shared signing-key download step and thread isInternalBuild through the CI core so the SqlServer package is strong-name signed on internal Package-mode builds. - Add eng/pipelines/common/steps/download-assembly-signing-key.yml, which exports driverKeyFile or testKeyFile from ADO secure files. - Adopt that step in the OneBranch build and nightly CI package pipelines, renaming keyFile to driverKeyFile. - Declare isInternalBuild in dotnet-sqlclient-ci-core.yml and set it from the CI package- and project-reference pipelines. - Sign the SqlServer package when isInternalBuild is true and referenceType is not Project.

- Quote SigningKeyPath in buildProperties so the secure-file path is robust to spaces, matching build-buildproj-step.yml and sqlclient-ci-package-pipeline.yml. - Move the BuildNumber/FileVersion note directly above buildProperties in both the signed and unsigned pack branches. No change to signing behaviour: signing stays gated on internal Package-reference builds.

- Split download-assembly-signing-key.yml into download-driver-signing-key-step.yml and download-test-signing-key-step.yml, each parameterless with its own output. - Restore "strong-name signing" terminology; always name the driver or test key. - Remove parameter defaults added in this branch; pass values explicitly, including isInternalBuild: false in both PR pipelines. - Fold the driver key download into the existing signing conditional in the pack job.

Pre-emptively align this PR with the review feedback already addressed lower in the stack, so the same comments aren't raised again. - Reference the split download-driver-signing-key-step.yml and download-test-signing-key-step.yml templates instead of the removed download-assembly-signing-key.yml. - Quote SigningKeyPath and TestSigningKeyPath to tolerate whitespace in the secure file paths. - Fold the driver key download into the existing signing conditional in the pack job, removing the duplicated conditional. - Use positive referenceType comparisons (eq 'Package'). - Drop the referenceType and isInternalBuild parameter defaults; both are already passed explicitly by every caller. - Move the BuildNumber/FileVersion note directly above buildProperties in every pack branch. - Restore "strong-name signing" terminology and name the driver or test key explicitly.

- Split download-assembly-signing-key.yml into download-driver-signing-key-step.yml and download-test-signing-key-step.yml, each parameterless with its own output. - Restore "strong-name signing" terminology; always name the driver or test key. - Remove parameter defaults added in this branch; pass values explicitly, including isInternalBuild: false in both PR pipelines. - Fold the driver key download into the existing signing conditional in the pack job.

Pre-emptively align this PR with the review feedback already addressed lower in the stack, so the same comments aren't raised again. - Reference the split download-driver-signing-key-step.yml and download-test-signing-key-step.yml templates instead of the removed download-assembly-signing-key.yml. - Use positive referenceType comparisons (eq 'Package'). - Drop the isInternalBuild parameter defaults; every caller already passes it explicitly. - Use "strong-name signing" terminology and name the driver or test key in the signingKeyPath/testSigningKeyPath parameter docs, correcting the stale note about test-filter categories.

- Split download-assembly-signing-key.yml into download-driver-signing-key-step.yml and download-test-signing-key-step.yml, each parameterless with its own output. - Restore "strong-name signing" terminology; always name the driver or test key. - Remove parameter defaults added in this branch; pass values explicitly, including isInternalBuild: false in both PR pipelines. - Fold the driver key download into the existing signing conditional in the pack job.

Pre-emptively align this PR with the review feedback already addressed lower in the stack, so the same comments aren't raised again. - Reference the split download-driver-signing-key-step.yml and download-test-signing-key-step.yml templates instead of the removed download-assembly-signing-key.yml. - Quote SigningKeyPath and TestSigningKeyPath to tolerate whitespace in the secure file paths. - Fold the driver key download into the existing signing conditional in the pack job, removing the duplicated conditional. - Use positive referenceType comparisons (eq 'Package'). - Drop the isInternalBuild parameter defaults; every caller already passes it explicitly. - Normalize the BuildNumber/FileVersion note across all pack branches. - Restore an accidentally dropped blank line in Azure.Test.csproj.

Copilot

🟢 Approval recommended

The change is limited to pipeline wiring for internal signing behavior and only surfaces a minor consistency/clarity nit in the conditional expression.

Review details

Files reviewed: 11/11 changed files
Comments generated: 1
Review effort level: Lite

-          buildProperties: SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }};BuildNumber=$(Build.BuildNumber)
+      # Create the NuGet packages.  Internal Package-mode builds strong-name sign the assemblies
+      # with the driver key.
+      - ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}:


Copilot AI lite review requested due to automatic review settings August 21, 2026 14:38

github-project-automation Bot added this to SqlClient Board Aug 21, 2026

github-project-automation Bot moved this to To triage in SqlClient Board Aug 21, 2026

Copilot started reviewing on behalf of paulmedynski August 21, 2026 14:38 View session

Copilot AI reviewed Aug 21, 2026

View reviewed changes

Comment thread eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml Outdated

paulmedynski commented Aug 21, 2026

View reviewed changes

paulmedynski force-pushed the dev/paul/assembly-signing-sqlserver branch from 1da18ed to 9bb6342 Compare August 21, 2026 15:33

paulmedynski added this to the 8.0.0-preview1 milestone Aug 21, 2026

paulmedynski added Area\Engineering Use this for issues that are targeted for changes in the 'eng' folder or build systems. Area\Azure Connectivity Use this to tag issues that are related to Azure connectivity. labels Aug 21, 2026

paulmedynski moved this from To triage to In progress in SqlClient Board Aug 21, 2026

Copilot AI review requested due to automatic review settings August 21, 2026 20:28

paulmedynski force-pushed the dev/paul/assembly-signing-sqlserver branch from 9bb6342 to a222a0c Compare August 21, 2026 20:28

Copilot started reviewing on behalf of paulmedynski August 21, 2026 20:29 View session

Copilot AI reviewed Aug 21, 2026

View reviewed changes

Comment thread eng/pipelines/jobs/pack-sqlserver-package-ci-job.yml Outdated

Copilot AI review requested due to automatic review settings August 21, 2026 20:56

Copilot started reviewing on behalf of paulmedynski August 21, 2026 20:57 View session

Copilot AI reviewed Aug 21, 2026

View reviewed changes

paulmedynski marked this pull request as ready for review August 24, 2026 13:14

paulmedynski requested a review from a team as a code owner August 24, 2026 13:14

paulmedynski moved this from In progress to In review in SqlClient Board Aug 24, 2026

github-actions Bot assigned benrr101 Aug 24, 2026

paulmedynski dismissed mdaigle’s stale review via 7af5b71 September 10, 2026 13:00

paulmedynski force-pushed the dev/paul/assembly-signing-sqlserver branch from f4e55a0 to 7af5b71 Compare September 10, 2026 13:00

Copilot started reviewing on behalf of paulmedynski September 10, 2026 13:01 View session

Copilot AI reviewed Sep 10, 2026

View reviewed changes

paulmedynski requested a review from mdaigle September 10, 2026 14:31

paulmedynski added 3 commits September 10, 2026 13:27

paulmedynski force-pushed the dev/paul/assembly-signing-sqlserver branch from 7af5b71 to bddc940 Compare September 10, 2026 16:27

Copilot AI review requested due to automatic review settings September 10, 2026 16:27

Copilot started reviewing on behalf of paulmedynski September 10, 2026 16:28 View session

Copilot AI reviewed Sep 10, 2026

View reviewed changes

cheenamalhotra modified the milestones: 7.1.0, 8.0.0-preview1 Sep 10, 2026

paulmedynski marked this pull request as draft September 30, 2026 14:08

paulmedynski closed this Oct 1, 2026

Navigation Menu

Repository navigation

Add assembly signing for Microsoft.SqlServer.Server - #4566

Add assembly signing for Microsoft.SqlServer.Server#4566
paulmedynski wants to merge 3 commits into
mainfrom
dev/paul/assembly-signing-sqlserver

paulmedynski commented Aug 21, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

paulmedynski Aug 21, 2026

Uh oh!

paulmedynski Aug 21, 2026

Uh oh!

benrr101 Aug 25, 2026

Uh oh!

paulmedynski Aug 25, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

paulmedynski commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What's This All About?

Description

Issues

Testing

CI pipeline runs

Artifact verification

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

paulmedynski Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

paulmedynski Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

benrr101 Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

paulmedynski Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

paulmedynski commented Aug 21, 2026 •

edited

Loading