Add assembly signing for Microsoft.Data.SqlClient and the AKV Provider

build.proj

@@ -802,7 +802,12 @@
 
       <DotnetCommand>
         "$(DotnetPath)dotnet" test "$(SqlClientFunctionalTestProjectPath)"
+
+        <!-- Build arguments -->
         -p:Configuration=$(Configuration)
+        $(SigningKeyPathArgument)
+
+        <!-- Test arguments -->
         $(TestBlameArgument)
         $(TestCodeCoverageArgument)
         $(TestFiltersArgument)
@@ -846,7 +851,12 @@
 
       <DotnetCommand>
         "$(DotnetPath)dotnet" test "$(SqlClientManualTestProjectPath)"
+
+        <!-- Build arguments -->
         -p:Configuration=$(Configuration)
+        $(SigningKeyPathArgument)
+
+        <!-- Test arguments -->
         $(TestBlameArgument)
         $(TestCodeCoverageArgument)
         $(ManualTestFiltersArgument)
@@ -864,7 +874,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running manual tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- TestSqlClientUnit: Runs unit tests for SqlClient -->
@@ -875,17 +885,24 @@
 
       <DotnetCommand>
         "$(DotnetPath)dotnet" test "$(SqlClientUnitTestProjectPath)"
+
+        <!-- Build arguments -->
         -p:Configuration=$(Configuration)
+        $(SigningKeyPathArgument)
+        $(TestSigningKeyPathArgument)
+
+        <!-- Test arguments -->
         $(TestBlameArgument)
         $(TestCodeCoverageArgument)
         $(TestFiltersArgument)
         $(TestFrameworkArgument)
+        --results-directory "$(TestResultsFolderPath)"
+        --logger:"trx;LogFilePrefix=$(LogFilePrefix)"
+
+        <!-- Reference Type Arguments -->
         $(ReferenceTypeArgument)
-        $(TestSigningKeyPathArgument)
         $(PackageVersionSqlClientArgument)
         $(PackageVersionSqlServerArgument)
-        --results-directory "$(TestResultsFolderPath)"
-        --logger:"trx;LogFilePrefix=$(LogFilePrefix)"
       </DotnetCommand>
 
       <!-- Convert more than one whitespace character into one space -->
@@ -893,7 +910,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running unit tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- ================================================================= -->

eng/pipelines/common/templates/jobs/ci-build-nugets-job.yml

@@ -78,6 +78,10 @@ parameters:
     type: string
     default: SqlServer.Artifacts
 
+  # True when building on the internal ADO.Net project.
+  - name: isInternalBuild
+    type: boolean
+
 jobs:
 - job: build_mds_akv_packages_job
   displayName: Build MDS & AKV Packages
@@ -125,6 +129,10 @@ jobs:
   # Restore dotnet CLI tools (e.g. pwsh, apicompat) before building.
   - template: /eng/pipelines/common/steps/restore-dotnet-tools.yml@self
 
+  # Download the driver strong-name signing key for internal Package-mode builds.
+  - ${{ if and(eq(parameters.isInternalBuild, true), eq(parameters.referenceType, 'Package')) }}:
+    - template: /eng/pipelines/common/steps/download-driver-signing-key-step.yml@self
+
   # When we're performing a Debug build, we still want to try _compiling_ the
   # code in Release mode to ensure downstream pipelines don't encounter
   # compilation errors.  We won't use the Release artifacts for anything else
@@ -146,6 +154,8 @@ jobs:
       build: MDS
       packageVersion: ${{ parameters.packageVersion }}
       sqlServerPackageVersion: ${{ parameters.sqlServerPackageVersion }}
+      ${{ if and(eq(parameters.isInternalBuild, true), eq(parameters.referenceType, 'Package')) }}:
+        signingKeyPath: $(driverKeyFile.secureFilePath)
 
   - task: DotNetCoreCLI@2
     displayName: 'Create MDS NuGet Package'
@@ -188,6 +198,8 @@ jobs:
       build: AkvProvider
       packageVersion: ${{ parameters.packageVersion }}
       sqlServerPackageVersion: ${{ parameters.sqlServerPackageVersion }}
+      ${{ if and(eq(parameters.isInternalBuild, true), eq(parameters.referenceType, 'Package')) }}:
+        signingKeyPath: $(driverKeyFile.secureFilePath)
 
   - task: DotNetCoreCLI@2
     displayName: 'Create AKV Provider NuGet Package'

eng/pipelines/common/templates/jobs/ci-run-tests-job.yml

@@ -146,6 +146,10 @@ parameters:
   - name: saPassword
     type: string
 
+  # True when building on the internal ADO.Net project.
+  - name: isInternalBuild
+    type: boolean
+
 jobs:
 - job: ${{ format('{0}', coalesce(parameters.jobDisplayName, parameters.poolImage, 'unknown_image')) }}
 
@@ -206,6 +210,11 @@ jobs:
   # Restore dotnet CLI tools (e.g. pwsh, apicompat) before building.
   - template: /eng/pipelines/common/steps/restore-dotnet-tools.yml@self
 
+  # Download the driver and test strong-name signing keys for internal Package-mode builds.
+  - ${{ if and(eq(parameters.isInternalBuild, true), eq(parameters.referenceType, 'Package')) }}:
+    - template: /eng/pipelines/common/steps/download-driver-signing-key-step.yml@self
+    - template: /eng/pipelines/common/steps/download-test-signing-key-step.yml@self
+
   - ${{ if ne(parameters.prebuildSteps, '') }}:
     - ${{ parameters.prebuildSteps }} # extra steps to run before the build like downloading sni and the required configuration
 
@@ -359,6 +368,9 @@ jobs:
         operatingSystem: ${{ parameters.operatingSystem }}
         packageVersion: ${{ parameters.packageVersion }}
         sqlServerPackageVersion: ${{ parameters.sqlServerPackageVersion }}
+        ${{ if and(eq(parameters.isInternalBuild, true), eq(parameters.referenceType, 'Package')) }}:
+          signingKeyPath: $(driverKeyFile.secureFilePath)
+          testSigningKeyPath: $(testKeyFile.secureFilePath)
 
   - ${{ if and(eq(parameters.enableX86Test, true), eq(parameters.operatingSystem, 'Windows')) }}:
     - template: /eng/pipelines/common/templates/steps/run-all-tests-step.yml@self
@@ -373,6 +385,9 @@ jobs:
         operatingSystem: ${{ parameters.operatingSystem }}
         packageVersion: ${{ parameters.packageVersion }}
         sqlServerPackageVersion: ${{ parameters.sqlServerPackageVersion }}
+        ${{ if and(eq(parameters.isInternalBuild, true), eq(parameters.referenceType, 'Package')) }}:
+          signingKeyPath: $(driverKeyFile.secureFilePath)
+          testSigningKeyPath: $(testKeyFile.secureFilePath)
 
   - template: /eng/pipelines/common/templates/steps/publish-test-results-step.yml@self
     parameters:

eng/pipelines/common/templates/stages/ci-run-tests-stage.yml

@@ -71,6 +71,10 @@ parameters:
   - name: testJobTimeout
     type: number
 
+  # True when building on the internal ADO.Net project.
+  - name: isInternalBuild
+    type: boolean
+
 stages:
 - ${{ each config in parameters.testConfigurations }}:
   - ${{ each image in config.value.images }}:
@@ -113,6 +117,7 @@ stages:
                   packageVersion: $(packageVersion)
                   loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
                   mdsArtifactsName: ${{ parameters.mdsArtifactsName }}
+                  isInternalBuild: ${{ parameters.isInternalBuild }}
                   sqlServerArtifactsName: ${{ parameters.sqlServerArtifactsName }}
                   sqlServerPackageVersion: $(sqlServerPackageVersion)
                   prebuildSteps: ${{ parameters.prebuildSteps }}
@@ -147,6 +152,7 @@ stages:
                     packageVersion: $(packageVersion)
                     loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
                     mdsArtifactsName: ${{ parameters.mdsArtifactsName }}
+                    isInternalBuild: ${{ parameters.isInternalBuild }}
                     sqlServerArtifactsName: ${{ parameters.sqlServerArtifactsName }}
                     sqlServerPackageVersion: $(sqlServerPackageVersion)
                     prebuildSteps: ${{ parameters.prebuildSteps }}

eng/pipelines/common/templates/steps/ci-project-build-step.yml

@@ -58,6 +58,12 @@ parameters:
     type: string
     default: $(sqlServerPackageVersion)
 
+  # Path to the driver strong-name signing key file.  When non-empty, passed as SigningKeyPath to
+  # the build.  The calling job is responsible for downloading the key.
+  - name: signingKeyPath
+    type: string
+    default: ''
+
 steps:
   # Build MDS
   - ${{ if or(eq(parameters.build, 'MDS'), eq(parameters.build, 'all'), eq(parameters.build, 'allNoDocs')) }}:
@@ -74,6 +80,7 @@ steps:
           -p:BuildNumber=${{ parameters.buildNumber }}
           -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
 
   # Build AKV Provider
   - ${{ if or(eq(parameters.build, 'AkvProvider'), eq(parameters.build, 'all'), eq(parameters.build, 'allNoDocs')) }}:
@@ -90,3 +97,4 @@ steps:
           -p:BuildNumber=${{ parameters.buildNumber }}
           -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"

eng/pipelines/common/templates/steps/run-all-tests-step.yml

@@ -68,6 +68,20 @@ parameters:
     type: number
     default: 2
 
+  # Path to the driver strong-name signing key file.  When non-empty, passed to build.proj so that
+  # the driver assemblies built for the test run are strong named.  The calling job is responsible
+  # for downloading the key.
+  - name: signingKeyPath
+    type: string
+    default: ''
+
+  # Path to the test strong-name signing key file.  When non-empty, passed to build.proj so that
+  # test assemblies are strong named and can satisfy InternalsVisibleTo grants from signed driver
+  # assemblies.  The calling job is responsible for downloading the key.
+  - name: testSigningKeyPath
+    type: string
+    default: ''
+
 steps:
 - ${{ if parameters.debug }}:
   - powershell: 'dotnet sdk check'
@@ -90,6 +104,8 @@ steps:
           -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
           -p:TestResultsFolderPath=TestResults
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
       ${{ else }}: # x86
         arguments: >-
           -t:TestSqlClientUnit
@@ -100,6 +116,8 @@ steps:
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
           -p:DotnetPath=${{ parameters.dotnetx86RootPath }}
           -p:TestResultsFolderPath=TestResults
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
 
   - task: DotNetCoreCLI@2
     displayName: 'Run Flaky Unit Tests ${{parameters.msbuildArchitecture }}'
@@ -118,6 +136,8 @@ steps:
           -p:TestFilters="category=flaky"
           -p:TestResultsFolderPath=TestResults
           -p:TestCodeCoverage=false
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
       ${{ else }}: # x86
         arguments: >-
           -t:TestSqlClientUnit
@@ -130,6 +150,8 @@ steps:
           -p:TestFilters="category=flaky"
           -p:TestResultsFolderPath=TestResults
           -p:TestCodeCoverage=false
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     continueOnError: true
 
   - task: DotNetCoreCLI@2
@@ -147,6 +169,8 @@ steps:
           -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
           -p:TestResultsFolderPath=TestResults
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
       ${{ else }}: # x86
         arguments: >-
           -t:TestSqlClientFunctional
@@ -157,6 +181,8 @@ steps:
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
           -p:DotnetPath=${{ parameters.dotnetx86RootPath }}
           -p:TestResultsFolderPath=TestResults
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
 
   - task: DotNetCoreCLI@2
     displayName: 'Run Flaky Functional Tests ${{parameters.msbuildArchitecture }}'
@@ -175,6 +201,8 @@ steps:
           -p:TestFilters="category=flaky"
           -p:TestResultsFolderPath=TestResults
           -p:TestCodeCoverage=false
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
       ${{ else }}: # x86
         arguments: >-
           -t:TestSqlClientFunctional
@@ -187,6 +215,8 @@ steps:
           -p:TestFilters="category=flaky"
           -p:TestResultsFolderPath=TestResults
           -p:TestCodeCoverage=false
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     continueOnError: true
 
   - task: DotNetCoreCLI@2
@@ -205,6 +235,8 @@ steps:
           -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
           -p:TestResultsFolderPath=TestResults
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
       ${{ else }}: # x86
         arguments: >-
           -t:TestSqlClientManual
@@ -216,6 +248,8 @@ steps:
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
           -p:DotnetPath=${{ parameters.dotnetx86RootPath }}
           -p:TestResultsFolderPath=TestResults
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     retryCountOnTaskFailure: ${{parameters.retryCountOnManualTests }}
 
   - task: DotNetCoreCLI@2
@@ -236,6 +270,8 @@ steps:
           -p:TestFilters="category=flaky"
           -p:TestResultsFolderPath=TestResults
           -p:TestCodeCoverage=false
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
       ${{ else }}: # x86
         arguments: >-
           -t:TestSqlClientManual
@@ -249,6 +285,8 @@ steps:
           -p:TestFilters="category=flaky"
           -p:TestResultsFolderPath=TestResults
           -p:TestCodeCoverage=false
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     continueOnError: true
 
 - ${{ else }}: # Linux or macOS
@@ -266,6 +304,8 @@ steps:
         -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
         -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
         -p:TestResultsFolderPath=TestResults
+        -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+        -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
 
   - task: DotNetCoreCLI@2
     displayName: 'Run Flaky Unit Tests'
@@ -283,6 +323,8 @@ steps:
         -p:TestFilters="category=flaky"
         -p:TestResultsFolderPath=TestResults
         -p:TestCodeCoverage=false
+        -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+        -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     continueOnError: true
 
   - task: DotNetCoreCLI@2
@@ -299,6 +341,8 @@ steps:
         -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
         -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
         -p:TestResultsFolderPath=TestResults
+        -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+        -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
 
   - task: DotNetCoreCLI@2
     displayName: 'Run Flaky Functional Tests'
@@ -316,6 +360,8 @@ steps:
         -p:TestFilters="category=flaky"
         -p:TestResultsFolderPath=TestResults
         -p:TestCodeCoverage=false
+        -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+        -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     continueOnError: true
   - task: DotNetCoreCLI@2
     displayName: 'Run Manual Tests'
@@ -332,6 +378,8 @@ steps:
         -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
         -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
         -p:TestResultsFolderPath=TestResults
+        -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+        -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     retryCountOnTaskFailure: ${{parameters.retryCountOnManualTests }}
 
   - task: DotNetCoreCLI@2
@@ -351,4 +399,6 @@ steps:
         -p:TestFilters="category=flaky"
         -p:TestResultsFolderPath=TestResults
         -p:TestCodeCoverage=false
+        -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+        -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     continueOnError: true

eng/pipelines/dotnet-sqlclient-ci-core.yml

@@ -248,6 +248,7 @@ stages:
       loggingArtifactsName: $(loggingArtifactsName)
       mdsArtifactsName: $(mdsArtifactsName)
       referenceType: ${{ parameters.referenceType }}
+      isInternalBuild: ${{ parameters.isInternalBuild }}
       sqlServerArtifactsName: $(sqlServerArtifactsName)
       SNIVersion: ${{ parameters.SNIVersion }}
       SNIValidationFeed: ${{ parameters.SNIValidationFeed }}
@@ -304,6 +305,7 @@ stages:
       abstractionsArtifactsName: $(abstractionsArtifactsName)
       loggingArtifactsName: $(loggingArtifactsName)
       mdsArtifactsName: $(mdsArtifactsName)
+      isInternalBuild: ${{ parameters.isInternalBuild }}
       sqlServerArtifactsName: $(sqlServerArtifactsName)
       testJobTimeout: ${{ parameters.testJobTimeout }}