Skip to content

Commit 9e20ec4

Browse files
authored
Restore MSIX signing and ensure expired certificates are not selected (GH-30649)
Reverts the change in d6c6e6b and applies a better fix.
1 parent 596cf51 commit 9e20ec4

File tree

2 files changed

+6
-4
lines changed

2 files changed

+6
-4
lines changed

.azure-pipelines/windows-release/stage-pack-msix.yml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -96,9 +96,7 @@ jobs:
9696
displayName: Sign side-loadable MSIX bundles
9797
dependsOn:
9898
- Pack_MSIX
99-
# Our current certificate does not support MSIX signing, so we unconditionally skip this step
100-
#condition: and(succeeded(), variables['SigningCertificate'])
101-
condition: false
99+
condition: and(succeeded(), variables['SigningCertificate'])
102100

103101
pool:
104102
name: 'Windows Release'
@@ -123,6 +121,10 @@ jobs:
123121
downloadPath: $(Build.BinariesDirectory)
124122

125123
# MSIX must be signed and timestamped simultaneously
124+
#
125+
# Getting "Error: SignerSign() failed." (-2147024885/0x8007000b)"?
126+
# It may be that the certificate info collected in stage-sign.yml is wrong. Check that
127+
# you do not have multiple matches for the certificate name you have specified.
126128
- powershell: |
127129
$failed = $true
128130
foreach ($retry in 1..3) {

.azure-pipelines/windows-release/stage-sign.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ jobs:
9191
- powershell: |
9292
$m = 'CN=$(SigningCertificate)'
9393
$c = ((gci Cert:\CurrentUser\My), (gci Cert:\LocalMachine\My)) | %{ $_ } | `
94-
?{ $_.Subject -match $m } | `
94+
?{ $_.Subject -match $m -and $_.NotBefore -lt (Get-Date) -and $_.NotAfter -gt (Get-Date) } | `
9595
select -First 1
9696
if (-not $c) {
9797
Write-Host "Failed to find certificate for $(SigningCertificate)"

0 commit comments

Comments
 (0)