Add assembly signing for Microsoft.Data.SqlClient.Extensions.Abstractions

build.proj

@@ -864,7 +864,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running manual tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- TestSqlClientUnit: Runs unit tests for SqlClient -->
@@ -893,7 +893,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running unit tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- ================================================================= -->
@@ -1086,22 +1086,28 @@
   <!-- TestAbstractions: Runs Microsoft.Data.SqlClient.Extensions.Abstractions.Tests -->
   <Target Name="TestAbstractions">
     <PropertyGroup>
-      <!--
-        Note: This test exclusively uses project references, so neither ReferenceType nor any
-        package version arguments are specified in this command.
-      -->
       <LogFilePrefix>AbstractionsTests-$(OS)</LogFilePrefix>
       <LogFilePrefix Condition="'$(TestFramework)' != ''">$(LogFilePrefix)-$(TestFramework)</LogFilePrefix>
 
       <DotnetCommand>
         "$(DotnetPath)dotnet" test "$(AbstractionsTestProjectPath)"
+
+        <!-- Build arguments -->
         -p:Configuration=$(Configuration)
+        $(SigningKeyPathArgument)
+        $(TestSigningKeyPathArgument)
+
+        <!-- Test arguments -->
         $(TestBlameArgument)
         $(TestCodeCoverageArgument)
         $(TestFiltersArgument)
         $(TestFrameworkArgument)
         --results-directory "$(TestResultsFolderPath)"
         --logger:"trx;LogFilePrefix=$(LogFilePrefix)"
+
+        <!-- Reference Type Arguments -->
+        $(ReferenceTypeArgument)
+        $(PackageVersionSqlClientArgument)
       </DotnetCommand>
       <!-- Convert more than one whitespace character into one space -->
       <DotnetCommand>$([System.Text.RegularExpressions.Regex]::Replace($(DotnetCommand), "\s+", " "))</DotnetCommand>

eng/pipelines/dotnet-sqlclient-ci-core.yml

@@ -229,6 +229,7 @@ stages:
       dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
       loggingArtifactsName: $(loggingArtifactsName)
       referenceType: ${{ parameters.referenceType }}
+      isInternalBuild: ${{ parameters.isInternalBuild }}
       # When building Abstractions via packages, we must depend on the Logging
       # package.
       ${{ if eq(parameters.referenceType, 'Package') }}:

eng/pipelines/jobs/pack-abstractions-package-ci-job.yml

@@ -15,7 +15,7 @@ parameters:
   # The name to apply to the published pipeline artifacts.
   - name: abstractionsArtifactsName
     type: string
-    default: Abstractions.Artifact
+    default: Abstractions.Artifacts
 
   # The version to apply to the Abstractions NuGet package and its assemblies.  Every package in the
   # SqlClient family shares this version.
@@ -57,16 +57,6 @@ parameters:
     type: string
     default: Logging.Artifacts
 
-  # The C# project reference type to use when building and packing the packages.
-  - name: referenceType
-    type: string
-    default: Project
-    values:
-      # Reference sibling packages as NuGet packages.
-      - Package
-      # Reference sibling packages as C# projects.
-      - Project
-
   # The name of the 1ES pool to run in.
   #
   # Supplied by the caller so that the pool name flows down from the pipeline
@@ -79,6 +69,19 @@ parameters:
   - name: poolImage
     type: string
 
+  # The C# project reference type to use when building and packing the packages.
+  - name: referenceType
+    type: string
+    values:
+      # Reference sibling packages as NuGet packages.
+      - Package
+      # Reference sibling packages as C# projects.
+      - Project
+
+  # True when building on the internal ADO.Net project.
+  - name: isInternalBuild
+    type: boolean
+
 jobs:
 
   - job: pack_abstractions_package_job
@@ -144,12 +147,25 @@ jobs:
         parameters:
           debug: ${{ parameters.debug }}
 
-      # Create the NuGet packages.
-      #
-      # When referenceType is Package, we must pass ReferenceType and the
-      # dependency version so that Directory.Packages.props applies version
-      # ranges to sibling package dependencies.
-      - ${{ if eq(parameters.referenceType, 'Package') }}:
+      # Create the NuGet packages.  Internal Package-mode builds strong-name sign the assemblies
+      # with the driver key.
+      - ${{ if and(eq(parameters.isInternalBuild, true), eq(parameters.referenceType, 'Package')) }}:
+        - template: /eng/pipelines/common/steps/download-driver-signing-key-step.yml@self
+
+        - task: DotNetCoreCLI@2
+          displayName: Create NuGet Package
+          inputs:
+            command: pack
+            packagesToPack: $(project)
+            configurationToPack: ${{ parameters.buildConfiguration }}
+            packDirectory: $(dotnetPackagesDir)
+            verbosityToPack: ${{ parameters.dotnetVerbosity }}
+            # BuildNumber supplies the revision component of FileVersion
+            # (Major.Minor.Patch.Revision).  Without it, FileVersionBuildNumber
+            # defaults to 0 and the assembly is stamped Major.Minor.Patch.0.
+            buildProperties: SqlClientPackageVersion=${{ parameters.packageVersion }};ReferenceType=Package;BuildNumber=$(Build.BuildNumber);SigningKeyPath="$(driverKeyFile.secureFilePath)"
+
+      - ${{ elseif eq(parameters.referenceType, 'Package') }}:
         - task: DotNetCoreCLI@2
           displayName: Create NuGet Package
           inputs:
@@ -158,8 +174,9 @@ jobs:
             configurationToPack: ${{ parameters.buildConfiguration }}
             packDirectory: $(dotnetPackagesDir)
             verbosityToPack: ${{ parameters.dotnetVerbosity }}
-            # BuildNumber supplies the revision component of FileVersion; without
-            # it the assembly is stamped Major.Minor.Patch.0 (see Project branch).
+            # BuildNumber supplies the revision component of FileVersion
+            # (Major.Minor.Patch.Revision).  Without it, FileVersionBuildNumber
+            # defaults to 0 and the assembly is stamped Major.Minor.Patch.0.
             buildProperties: SqlClientPackageVersion=${{ parameters.packageVersion }};ReferenceType=Package;BuildNumber=$(Build.BuildNumber)
 
       - ${{ else }}:
@@ -173,8 +190,7 @@ jobs:
             verbosityToPack: ${{ parameters.dotnetVerbosity }}
             # BuildNumber supplies the revision component of FileVersion
             # (Major.Minor.Patch.Revision).  Without it, FileVersionBuildNumber
-            # defaults to 0 and the assembly is stamped Major.Minor.Patch.0,
-            # inconsistent with the MDS/AKV packages that pass it.
+            # defaults to 0 and the assembly is stamped Major.Minor.Patch.0.
             buildProperties: SqlClientPackageVersion=${{ parameters.packageVersion }};BuildNumber=$(Build.BuildNumber)
 
       # Publish the NuGet packages as a named pipeline artifact.

eng/pipelines/jobs/test-abstractions-package-ci-job.yml

@@ -13,6 +13,18 @@
 
 parameters:
 
+  # The name of the Logging pipeline artifacts to download.
+  #
+  # This is used when the referenceType is 'Package'.
+  - name: loggingArtifactsName
+    type: string
+    default: Logging.Artifacts
+
+  # The version to apply to the SqlClient family packages.  This is used when
+  # referenceType is 'Package'.
+  - name: packageVersion
+    type: string
+
   # The type of build to test (Release or Debug)
   - name: buildConfiguration
     type: string
@@ -65,6 +77,20 @@ parameters:
   - name: poolName
     type: string
 
+  # True when building on the internal ADO.Net project.  When set, the Abstractions assembly is
+  # strong-name signed with the driver key and the test assembly with the test key.
+  - name: isInternalBuild
+    type: boolean
+
+  # The C# project reference type to use when building.
+  - name: referenceType
+    type: string
+    values:
+      # Reference sibling packages as NuGet packages.
+      - Package
+      # Reference sibling packages as C# projects.
+      - Project
+
   # The pool VM image to use.
   - name: poolImage
     type: string
@@ -92,12 +118,24 @@ jobs:
       - name: project
         value: src/Microsoft.Data.SqlClient.Extensions/Abstractions/test/Abstractions.Test.csproj
 
-      # dotnet CLI arguments for build/test/pack commands
-      - name: buildArguments
+      # dotnet CLI arguments for build/test commands.
+      - name: dotnetBuildOpts
         value: >-
           -p:Configuration=${{ parameters.buildConfiguration }}
+          -p:ReferenceType=${{ parameters.referenceType }}
+          -p:SqlClientPackageVersion=${{ parameters.packageVersion }}
           --verbosity ${{ parameters.dotnetVerbosity }}
 
+      # Strong-name signing arguments — only set for internal Package-mode builds.
+      - ${{ if and(eq(parameters.isInternalBuild, true), eq(parameters.referenceType, 'Package')) }}:
+        - name: signingArguments
+          value: >-
+            -p:SigningKeyPath="$(driverKeyFile.secureFilePath)"
+            -p:TestSigningKeyPath="$(testKeyFile.secureFilePath)"
+      - ${{ else }}:
+        - name: signingArguments
+          value: ''
+
       # Explicitly unset the $PLATFORM environment variable that is set by the
       # 'ADO Build properties' Library in the ADO SqlClientDrivers public project.
       # This is defined with a non-standard Platform of 'AnyCPU', and will fail
@@ -125,6 +163,19 @@ jobs:
         - pwsh: 'Get-ChildItem Env: | Sort-Object Name'
           displayName: '[Debug] Print Environment Variables'
 
+      # Download the driver and test strong-name signing keys for internal Package-mode builds.
+      - ${{ if and(eq(parameters.isInternalBuild, true), eq(parameters.referenceType, 'Package')) }}:
+        - template: /eng/pipelines/common/steps/download-driver-signing-key-step.yml@self
+        - template: /eng/pipelines/common/steps/download-test-signing-key-step.yml@self
+
+      # For Package reference builds, download the Logging dependency into packages/.
+      - ${{ if eq(parameters.referenceType, 'Package') }}:
+        - task: DownloadPipelineArtifact@2
+          displayName: Download Logging Package Artifacts
+          inputs:
+            artifactName: ${{ parameters.loggingArtifactsName }}
+            targetPath: $(Build.SourcesDirectory)/packages
+
       # Install the .NET SDK and Runtimes.
       - template: /eng/pipelines/common/steps/install-dotnet.yml@self
         parameters:
@@ -140,7 +191,7 @@ jobs:
         inputs:
           command: build
           projects: $(project)
-          arguments: $(buildArguments)
+          arguments: $(dotnetBuildOpts) $(signingArguments)
 
       # Run the tests for each .NET runtime.
       - ${{ each runtime in parameters.netRuntimes }}:
@@ -150,7 +201,7 @@ jobs:
             command: test
             projects: $(project)
             arguments: >-
-              $(buildArguments)
+              $(dotnetBuildOpts)
               --no-build
               -f ${{ runtime }}
               --filter "category != failing & category != flaky & category != interactive"
@@ -161,7 +212,7 @@ jobs:
             command: test
             projects: $(project)
             arguments: >-
-              $(buildArguments)
+              $(dotnetBuildOpts)
               --no-build
               -f ${{ runtime }}
               --filter "category = flaky"
@@ -174,7 +225,7 @@ jobs:
             command: test
             projects: $(project)
             arguments: >-
-              $(buildArguments)
+              $(dotnetBuildOpts)
               --no-build
               -f ${{ runtime }}
               --filter "category != failing & category != flaky & category != interactive"
@@ -185,7 +236,7 @@ jobs:
             command: test
             projects: $(project)
             arguments: >-
-              $(buildArguments)
+              $(dotnetBuildOpts)
               --no-build
               -f ${{ runtime }}
               --filter "category = flaky"

eng/pipelines/stages/build-abstractions-package-ci-stage.yml

@@ -82,13 +82,16 @@ parameters:
   # The C# project reference type to use when building and packing the packages.
   - name: referenceType
     type: string
-    default: Project
     values:
       # Reference sibling packages as NuGet packages.
       - Package
       # Reference sibling packages as C# projects.
       - Project
 
+  # True when building on the internal ADO.Net project.
+  - name: isInternalBuild
+    type: boolean
+
 stages:
 
   - stage: build_abstractions_package_stage
@@ -111,47 +114,59 @@ stages:
 
       - template: /eng/pipelines/jobs/test-abstractions-package-ci-job.yml@self
         parameters:
+          packageVersion: $(packageVersion)
           buildConfiguration: ${{ parameters.buildConfiguration }}
           debug: ${{ parameters.debug }}
           displayNamePrefix: Linux
           dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
+          isInternalBuild: ${{ parameters.isInternalBuild }}
           jobNameSuffix: linux
+          loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
           netFrameworkRuntimes: []
           netRuntimes: [net8.0, net9.0, net10.0]
           poolName: ${{ parameters.poolName }}
           poolImage: ADO-UB24
+          referenceType: ${{ parameters.referenceType }}
 
       # ------------------------------------------------------------------------
       # Build and test on Windows
 
       - template: /eng/pipelines/jobs/test-abstractions-package-ci-job.yml@self
         parameters:
+          packageVersion: $(packageVersion)
           buildConfiguration: ${{ parameters.buildConfiguration }}
           debug: ${{ parameters.debug }}
           displayNamePrefix: Win
           dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
+          isInternalBuild: ${{ parameters.isInternalBuild }}
           jobNameSuffix: windows
+          loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
           netFrameworkRuntimes: [net462]
           netRuntimes: [net8.0, net9.0, net10.0]
           poolName: ${{ parameters.poolName }}
           poolImage: ADO-Win25
+          referenceType: ${{ parameters.referenceType }}
 
       # ------------------------------------------------------------------------
       # Build and test on macOS.
 
       - template: /eng/pipelines/jobs/test-abstractions-package-ci-job.yml@self
         parameters:
+          packageVersion: $(packageVersion)
           buildConfiguration: ${{ parameters.buildConfiguration }}
           debug: ${{ parameters.debug }}
           displayNamePrefix: macOS
           dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
+          isInternalBuild: ${{ parameters.isInternalBuild }}
           jobNameSuffix: macos
+          loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
           netFrameworkRuntimes: []
           netRuntimes: [net8.0, net9.0, net10.0]
           # Our 1ES pools do not offer macOS images, so this job runs on the Microsoft-hosted
           # 'Azure Pipelines' pool.
           poolName: Azure Pipelines
           poolImage: macos-latest
+          referenceType: ${{ parameters.referenceType }}
 
       # ------------------------------------------------------------------------
       # Create and publish the NuGet package.
@@ -174,3 +189,4 @@ stages:
           dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
           loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
           referenceType: ${{ parameters.referenceType }}
+          isInternalBuild: ${{ parameters.isInternalBuild }}

src/Microsoft.Data.SqlClient.Extensions/Abstractions/src/Abstractions.csproj

@@ -33,10 +33,22 @@
 
   <!-- Strong name signing ============================================= -->
   <!-- This is done in Directory.Build.props -->
+
+  <!-- Unsigned: expose internals to the test assembly in any reference mode. -->
   <ItemGroup Condition="'$(SigningKeyPath)' == ''">
     <InternalsVisibleTo Include="$(AssemblyName).Test" />
   </ItemGroup>
 
+  <!--
+    Signed + Package mode: expose internals to the test assembly signed with the test key.
+    Signed + Project mode is intentionally omitted: production-signed assemblies should not
+    grant internal access to test assemblies during local development.  Tests that need internals
+    in Project mode run unsigned; only the CI package-validation pipeline uses signed packages.
+  -->
+  <ItemGroup Condition="'$(SigningKeyPath)' != '' AND '$(ReferenceType)' == 'Package'">
+    <InternalsVisibleTo Include="$(AssemblyName).Test, PublicKey=00240000048000001401000006020000002400005253413100080000010001003D19684676DA365F331D00CE7BD4B8EF03E74102F39A5681B40622703D68F0298ECACECC723D3FFC1EA9365AF4958578550EA1EBEEC084B0B3757F3762449F5365E872802A4B548056760764FAD062BFEE81ED26183109AD46810E7E6E965419D0A10473680144D20C1BFE1027A5F586CA987523C06F5C126C44EA7D4F51EB023867A9F294315F95775ACEFD2D678186919458DFCCB4DE2E9F53AEFC766C7CBCEC474ED21C1616E5A9414D366D91D121C39F5FE6641295ADC058EF3FB10593BCDE2E82D9F217C2634909EEF496CD53AE78ABBEA572B871D72EBFC5378205950ABA97C7CCC2B9635D96933D5F9C9624D71FF53EE2094CF3A6BD38534D66E414B7" />
+  </ItemGroup>
+
   <!-- Build Output ==================================================== -->
   <PropertyGroup>
     <ArtifactPath>$(RepoRoot)artifacts/</ArtifactPath>