dotnet · paulmedynski · Aug 21, 2026 · Sep 8, 2026
@@ -791,7 +791,7 @@
    </PropertyGroup>
    <Message Importance="High" Text=">>> Running manual tests for SqlClient"/>
    <Message Text="    Command: $(DotnetCommand)"/>
    <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
  </Target>

  <!-- TestSqlClientUnit: Runs unit tests for SqlClient -->
@@ -827,7 +827,7 @@
    </PropertyGroup>
    <Message Importance="High" Text=">>> Running unit tests for SqlClient"/>
    <Message Text="    Command: $(DotnetCommand)"/>
    <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
  </Target>

  <!-- ================================================================= -->
@@ -1132,15 +1132,21 @@
 
       <DotnetCommand>
         "$(DotnetPath)dotnet" test "$(AzureTestProjectPath)"
+
+        <!-- Build arguments -->
         -p:Configuration=$(Configuration)
+        $(SigningKeyPathArgument)
+        $(TestSigningKeyPathArgument)
+
+        <!-- Test arguments -->
         $(TestBlameArgument)
         $(TestCodeCoverageArgument)
         $(TestFiltersArgument)
         $(TestFrameworkArgument)
         --results-directory "$(TestResultsFolderPath)"
         --logger:"trx;LogFilePrefix=$(LogFilePrefix)"
 
-        <!-- Reference type arguments -->
+        <!-- Reference Type Arguments -->
         $(ReferenceTypeArgument)
         $(PackageVersionSqlClientArgument)
         $(PackageVersionSqlServerArgument)

@@ -240,6 +240,7 @@ stages:
       azureArtifactsName: $(azureArtifactsName)
       buildConfiguration: ${{ parameters.buildConfiguration }}
       debug: ${{ parameters.debug }}
+      isInternalBuild: ${{ parameters.isInternalBuild }}
       # When building via packages, we must depend on the Abstractions, Logging,
       # SqlServer, and MDS packages.
       ${{ if eq(parameters.referenceType, 'Package') }}:

@@ -73,6 +73,10 @@ parameters:
       # Reference sibling packages as C# projects.
       - Project
 
+  # True when building on the internal ADO.Net project.
+  - name: isInternalBuild
+    type: boolean
+
 jobs:
 
   - job: pack_azure_package_job
@@ -141,12 +145,15 @@ jobs:
         parameters:
           debug: ${{ parameters.debug }}
 
-      # Create the NuGet packages.
+      # Create the NuGet packages.  Internal Package-mode builds strong-name sign the assemblies
+      # with the driver key.
       #
       # When referenceType is Package, we must pass ReferenceType and the
       # dependency versions so that Directory.Packages.props applies version
       # ranges to sibling package dependencies.
-      - ${{ if eq(parameters.referenceType, 'Package') }}:
+      - ${{ if and(eq(parameters.isInternalBuild, true), eq(parameters.referenceType, 'Package')) }}:
+        - template: /eng/pipelines/common/steps/download-driver-signing-key-step.yml@self
+
         - task: DotNetCoreCLI@2
           displayName: Create NuGet Package
           inputs:
@@ -155,8 +162,23 @@ jobs:
             configurationToPack: ${{ parameters.buildConfiguration }}
             packDirectory: $(dotnetPackagesDir)
             verbosityToPack: ${{ parameters.dotnetVerbosity }}
-            # BuildNumber supplies the revision component of FileVersion; without
-            # it the assembly is stamped Major.Minor.Patch.0 (see Project branch).
+            # BuildNumber supplies the revision component of FileVersion
+            # (Major.Minor.Patch.Revision).  Without it, FileVersionBuildNumber
+            # defaults to 0 and the assembly is stamped Major.Minor.Patch.0.
+            buildProperties: SqlClientPackageVersion=${{ parameters.packageVersion }};ReferenceType=Package;BuildNumber=$(Build.BuildNumber);SigningKeyPath="$(driverKeyFile.secureFilePath)"
+
+      - ${{ elseif eq(parameters.referenceType, 'Package') }}:
+        - task: DotNetCoreCLI@2
+          displayName: Create NuGet Package
+          inputs:
+            command: pack
+            packagesToPack: $(project)
+            configurationToPack: ${{ parameters.buildConfiguration }}
+            packDirectory: $(dotnetPackagesDir)
+            verbosityToPack: ${{ parameters.dotnetVerbosity }}
+            # BuildNumber supplies the revision component of FileVersion
+            # (Major.Minor.Patch.Revision).  Without it, FileVersionBuildNumber
+            # defaults to 0 and the assembly is stamped Major.Minor.Patch.0.
             buildProperties: SqlClientPackageVersion=${{ parameters.packageVersion }};ReferenceType=Package;BuildNumber=$(Build.BuildNumber)
 
       - ${{ else }}:
@@ -170,8 +192,7 @@ jobs:
             verbosityToPack: ${{ parameters.dotnetVerbosity }}
             # BuildNumber supplies the revision component of FileVersion
             # (Major.Minor.Patch.Revision).  Without it, FileVersionBuildNumber
-            # defaults to 0 and the assembly is stamped Major.Minor.Patch.0,
-            # inconsistent with the MDS/AKV packages that pass it.
+            # defaults to 0 and the assembly is stamped Major.Minor.Patch.0.
             buildProperties: SqlClientPackageVersion=${{ parameters.packageVersion }};BuildNumber=$(Build.BuildNumber)
 
       # Publish the NuGet packages as a named pipeline artifact.

@@ -127,6 +127,11 @@ parameters:
     type: boolean
     default: false
 
+  # True when building on the internal ADO.Net project.  When set, the Azure assembly is
+  # strong-name signed with the driver key and the test assembly with the test key.
+  - name: isInternalBuild
+    type: boolean
+
   # The pool VM image to use.
   - name: vmImage
     type: string
@@ -154,15 +159,27 @@ jobs:
       - name: project
         value: src/Microsoft.Data.SqlClient.Extensions/Azure/test/Azure.Test.csproj
 
-      # dotnet CLI arguments for build/test/pack commands.
-      - name: buildArguments
+      # dotnet CLI arguments for build/test commands.
+      #
+      # Not named 'buildArguments': dotnet injects $BUILDARGUMENTS into 'dotnet build'.
+      - name: dotnetBuildOpts
         value: >-
           -p:Configuration=${{ parameters.buildConfiguration }}
           --verbosity ${{ parameters.dotnetVerbosity }}
           -p:ReferenceType=${{ parameters.referenceType }}
           -p:SqlClientPackageVersion=${{ parameters.packageVersion }}
           -p:SqlServerPackageVersion=${{ parameters.sqlServerPackageVersion }}
 
+      # Strong-name signing arguments - only set for internal Package-mode builds.
+      - ${{ if and(eq(parameters.isInternalBuild, true), eq(parameters.referenceType, 'Package')) }}:
+        - name: signingArguments
+          value: >-
+            -p:SigningKeyPath="$(driverKeyFile.secureFilePath)"
+            -p:TestSigningKeyPath="$(testKeyFile.secureFilePath)"
+      - ${{ else }}:
+        - name: signingArguments
+          value: ''
+
       # Explicitly unset the $PLATFORM environment variable that is set by the
       # 'ADO Build properties' Library in the ADO SqlClientDrivers public
       # project.  This is defined with a non-standard Platform of 'AnyCPU', and
@@ -232,6 +249,11 @@ jobs:
           debug: ${{ parameters.debug }}
           runtimes: [8.x, 9.x]
 
+      # Download the driver and test strong-name signing keys for internal Package-mode builds.
+      - ${{ if and(eq(parameters.isInternalBuild, true), eq(parameters.referenceType, 'Package')) }}:
+        - template: /eng/pipelines/common/steps/download-driver-signing-key-step.yml@self
+        - template: /eng/pipelines/common/steps/download-test-signing-key-step.yml@self
+
       # The Windows agent images include a suitable .NET Framework runtime, so
       # we don't have to install one explicitly.
 
@@ -273,7 +295,7 @@ jobs:
         inputs:
           command: build
           projects: $(project)
-          arguments: $(buildArguments)
+          arguments: $(dotnetBuildOpts) $(signingArguments)
 
       # List the DLLs in the output directory for debugging purposes.
       - ${{ if eq(parameters.debug, true) }}:
@@ -308,7 +330,7 @@ jobs:
             command: test
             projects: $(project)
             arguments: >-
-              $(buildArguments)
+              $(dotnetBuildOpts)
               --no-build
               -f ${{ runtime }}
               --filter "category != failing & category != flaky & category != interactive"
@@ -326,7 +348,7 @@ jobs:
             command: test
             projects: $(project)
             arguments: >-
-              $(buildArguments)
+              $(dotnetBuildOpts)
               --no-build
               -f ${{ runtime }}
               --filter "category = flaky"
@@ -346,7 +368,7 @@ jobs:
             command: test
             projects: $(project)
             arguments: >-
-              $(buildArguments)
+              $(dotnetBuildOpts)
               --no-build
               -f ${{ runtime }}
               --filter "category != failing & category != flaky & category != interactive"
@@ -364,7 +386,7 @@ jobs:
             command: test
             projects: $(project)
             arguments: >-
-              $(buildArguments)
+              $(dotnetBuildOpts)
               --no-build
               -f ${{ runtime }}
               --filter "category = flaky"
@@ -118,6 +118,10 @@ parameters:
       # Reference sibling packages as C# projects.
       - Project
 
+  # True when building on the internal ADO.Net project.
+  - name: isInternalBuild
+    type: boolean
+
 stages:
 
   - stage: build_azure_package_stage
@@ -153,6 +157,7 @@ stages:
           displayNamePrefix: Linux
           dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
           jobNameSuffix: linux
+          isInternalBuild: ${{ parameters.isInternalBuild }}
           loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
           mdsArtifactsName: ${{ parameters.mdsArtifactsName }}
           sqlServerArtifactsName: ${{ parameters.sqlServerArtifactsName }}
@@ -173,6 +178,7 @@ stages:
           displayNamePrefix: Linux Integration
           dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
           jobNameSuffix: linux_integration
+          isInternalBuild: ${{ parameters.isInternalBuild }}
           loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
           mdsArtifactsName: ${{ parameters.mdsArtifactsName }}
           sqlServerArtifactsName: ${{ parameters.sqlServerArtifactsName }}
@@ -202,6 +208,7 @@ stages:
           displayNamePrefix: Win
           dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
           jobNameSuffix: windows
+          isInternalBuild: ${{ parameters.isInternalBuild }}
           loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
           mdsArtifactsName: ${{ parameters.mdsArtifactsName }}
           sqlServerArtifactsName: ${{ parameters.sqlServerArtifactsName }}
@@ -222,6 +229,7 @@ stages:
           displayNamePrefix: Win Integration
           dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
           jobNameSuffix: windows_integration
+          isInternalBuild: ${{ parameters.isInternalBuild }}
           loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
           mdsArtifactsName: ${{ parameters.mdsArtifactsName }}
           sqlServerArtifactsName: ${{ parameters.sqlServerArtifactsName }}
@@ -260,6 +268,7 @@ stages:
           displayNamePrefix: macOS
           dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
           jobNameSuffix: macos
+          isInternalBuild: ${{ parameters.isInternalBuild }}
           loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
           mdsArtifactsName: ${{ parameters.mdsArtifactsName }}
           sqlServerArtifactsName: ${{ parameters.sqlServerArtifactsName }}
@@ -293,3 +302,4 @@ stages:
           dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
           loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
           referenceType: ${{ parameters.referenceType }}
+          isInternalBuild: ${{ parameters.isInternalBuild }}
@@ -33,10 +33,22 @@
 
   <!-- Strong name signing ============================================= -->
   <!-- This is done in Directory.Build.props -->
+
+  <!-- Unsigned: expose internals to the test assembly in any reference mode. -->
   <ItemGroup Condition="'$(SigningKeyPath)' == ''">
     <InternalsVisibleTo Include="$(AssemblyName).Test" />
   </ItemGroup>
 
+  <!--
+    Signed + Package mode: expose internals to the test assembly signed with the test key.
+    Signed + Project mode is intentionally omitted: production-signed assemblies should not
+    grant internal access to test assemblies during local development.  Tests that need internals
+    in Project mode run unsigned; only the CI package-validation pipeline uses signed packages.
+  -->
+  <ItemGroup Condition="'$(SigningKeyPath)' != '' AND '$(ReferenceType)' == 'Package'">
+    <InternalsVisibleTo Include="$(AssemblyName).Test, PublicKey=00240000048000001401000006020000002400005253413100080000010001003D19684676DA365F331D00CE7BD4B8EF03E74102F39A5681B40622703D68F0298ECACECC723D3FFC1EA9365AF4958578550EA1EBEEC084B0B3757F3762449F5365E872802A4B548056760764FAD062BFEE81ED26183109AD46810E7E6E965419D0A10473680144D20C1BFE1027A5F586CA987523C06F5C126C44EA7D4F51EB023867A9F294315F95775ACEFD2D678186919458DFCCB4DE2E9F53AEFC766C7CBCEC474ED21C1616E5A9414D366D91D121C39F5FE6641295ADC058EF3FB10593BCDE2E82D9F217C2634909EEF496CD53AE78ABBEA572B871D72EBFC5378205950ABA97C7CCC2B9635D96933D5F9C9624D71FF53EE2094CF3A6BD38534D66E414B7" />
+  </ItemGroup>
+
   <!-- Build Output ==================================================== -->
   <PropertyGroup>
     <ArtifactPath>$(RepoRoot)artifacts/</ArtifactPath>

@@ -13,6 +13,13 @@
     <TargetFrameworks>net462;net8.0;net9.0;net10.0</TargetFrameworks>
   </PropertyGroup>
 
+  <!-- Strong name signing ============================================= -->
+  <!-- When a test signing key is provided, sign the test assembly so IVT from signed source works. -->
+  <PropertyGroup Condition="'$(TestSigningKeyPath)' != ''">
+    <SignAssembly>true</SignAssembly>
+    <AssemblyOriginatorKeyFile>$(TestSigningKeyPath)</AssemblyOriginatorKeyFile>
+  </PropertyGroup>
+
   <!-- Compiler Options ================================================ -->
   <PropertyGroup>
     <ImplicitUsings>enable</ImplicitUsings>