Sign CI Package pipeline assemblies and tests; verify SqlClient in Abstractions by paulmedynski · Pull Request #4382 · dotnet/SqlClient

paulmedynski · 2026-06-19T16:27:59Z

Summary

Core of the assembly-signing work. Enables the CI Package pipeline to sign the driver assemblies and run tests against the signed assemblies, and adds the Abstractions-side verification of the Microsoft.Data.SqlClient assembly's public key token.

This reuses the existing STRONG_NAME_SIGNING constant already defined on main (no rename here — that is done in the follow-up PR).

What's included

New eng/pipelines/common/steps/download-assembly-signing-key.yml step.
build.proj + CI pipeline wiring to thread signingKeyPath / testSigningKeyPath, isInternalBuild, and referenceType through the SqlClient and Abstractions package build/test stages.
Abstractions assembly-identity verification (#if STRONG_NAME_SIGNING) of the SqlClient public key token in SqlAuthenticationProvider.Internal.cs, plus signed InternalsVisibleTo for the Abstractions test assembly in Package mode.
Abstractions pack/test/verify CI stages so the signing check is self-tested.

🔗 PR Stack

Part of a 5-PR stack — current PR marked 👉. Indentation shows the branch base.

👉 #4382 — Sign CI Package pipeline assemblies & tests · base: main
- 🏷️ #4383 — Rename STRONG_NAME_SIGNING → ASSEMBLY_SIGNING
  - 🪵 #4384 — Add Logging test package & CI
  - ☁️ #4385 — Sign Azure extension assembly & tests
  - 🧩 #4386 — Sign Microsoft.SqlServer.Server assembly & CI

flowchart TD
    main([main])
    PR1["🏗️ #4382<br/>signing-core"]
    PR2["🏷️ #4383<br/>rename"]
    PR3["🪵 #4384<br/>logging-tests"]
    PR4["☁️ #4385<br/>azure-signing"]
    PR5["🧩 #4386<br/>sqlserver.server"]
    main --> PR1 --> PR2
    PR2 --> PR3
    PR2 --> PR4
    PR2 --> PR5
    click PR1 "https://github.com/dotnet/SqlClient/pull/4382" _blank
    click PR2 "https://github.com/dotnet/SqlClient/pull/4383" _blank
    click PR3 "https://github.com/dotnet/SqlClient/pull/4384" _blank
    click PR4 "https://github.com/dotnet/SqlClient/pull/4385" _blank
    click PR5 "https://github.com/dotnet/SqlClient/pull/4386" _blank
    classDef current fill:#1f6feb,stroke:#1f6feb,color:#fff;
    class PR1 current;

Checklist

Tests added or updated (Abstractions: 29/29)
Public API changes documented (none)
Verified signed + unsigned compile paths
No breaking changes

…stractions Bare-minimum changes to produce and test signed assemblies in the CI Package pipeline, plus the Abstractions strong-name verification of the SqlClient assembly. - Add the download-assembly-signing-key pipeline step and thread SigningKeyPath / TestSigningKeyPath through the CI Package build, pack, and test jobs so the SqlClient package and its tests are produced and run signed. - Thread isInternalBuild through the SqlClient and Abstractions package stages. - In SqlAuthenticationProvider (Abstractions), verify the loaded Microsoft.Data.SqlClient assembly's public key token when STRONG_NAME_SIGNING is defined, with defense-in-depth post-load verification on .NET Core. - Add conditional signed InternalsVisibleTo and test-assembly signing for the Abstractions project and its tests.

Copilot

Pull request overview

Enables internal Package CI builds to strong-name sign driver assemblies and run tests against the signed outputs, and adds Abstractions-side verification that the loaded Microsoft.Data.SqlClient assembly matches the expected public key token when signing is enabled.

Changes:

Adds a reusable pipeline step to download signing keys from secure files and threads isInternalBuild, SigningKeyPath, and TestSigningKeyPath through build/test templates.
Updates build.proj and CI templates so signed vs. unsigned test filtering and test-assembly signing can be exercised in CI.
Adds Abstractions runtime protection (#if STRONG_NAME_SIGNING) to avoid invoking reflection-based APIs from imposter Microsoft.Data.SqlClient assemblies, and updates Abstractions test/IVT behavior for signed Package-mode runs.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/Microsoft.Data.SqlClient.Extensions/Abstractions/test/Abstractions.Test.csproj	Makes net462 testing Windows-only and signs the test assembly when `TestSigningKeyPath` is provided.
src/Microsoft.Data.SqlClient.Extensions/Abstractions/src/SqlAuthenticationProvider.Internal.cs	Verifies SqlClient public key token under `STRONG_NAME_SIGNING` before using reflection-based APIs.
src/Microsoft.Data.SqlClient.Extensions/Abstractions/src/Abstractions.csproj	Adds signed IVT for Package-mode tests and includes `System.Memory` dependency.
eng/pipelines/stages/build-sqlclient-package-ci-stage.yml	Threads `isInternalBuild` into SqlClient package CI stage.
eng/pipelines/stages/build-abstractions-package-ci-stage.yml	Threads `isInternalBuild`/`referenceType` through Abstractions build/test/pack stage.
eng/pipelines/onebranch/steps/build-buildproj-step.yml	Replaces inline secure-file download with shared signing-key download step.
eng/pipelines/onebranch/jobs/validate-signed-package-job.yml	Minor wording update to “strong-name signing”.
eng/pipelines/jobs/test-abstractions-package-ci-job.yml	Adds internal-build signing key download + signing args; renames CLI opts variable to avoid env var injection pitfalls.
eng/pipelines/jobs/pack-abstractions-package-ci-job.yml	Adds internal-build signing key handling and consolidates pack buildProperties composition.
eng/pipelines/dotnet-sqlclient-ci-project-reference-pipeline.yml	Computes/passes `isInternalBuild` to core template.
eng/pipelines/dotnet-sqlclient-ci-package-reference-pipeline.yml	Computes/passes `isInternalBuild` to core template.
eng/pipelines/dotnet-sqlclient-ci-core.yml	Adds `isInternalBuild` parameter and threads it into dependent stages/jobs.
eng/pipelines/common/templates/steps/run-all-tests-step.yml	Adds `signingKeyPath`/`testSigningKeyPath` plumbing into build.proj test invocations.
eng/pipelines/common/templates/steps/ci-project-build-step.yml	Adds `SigningKeyPath` plumbing into build.proj build invocations.
eng/pipelines/common/templates/stages/ci-run-tests-stage.yml	Threads `isInternalBuild` into test job template.
eng/pipelines/common/templates/jobs/ci-run-tests-job.yml	Downloads signing keys for internal Package-mode runs and passes key paths into test steps.
eng/pipelines/common/templates/jobs/ci-build-nugets-job.yml	Downloads signing key for internal Package-mode builds and passes it into build steps.
eng/pipelines/common/steps/download-assembly-signing-key.yml	New shared secure-file download step for driver/test signing keys.
eng/pipelines/ci/package/sqlclient-package.yml	Uses the shared signing-key download step and updated output variable name.
build.proj	Threads signing/test-signing properties through relevant build/test commands; improves command sectioning comments.

paulmedynski · 2026-06-19T16:46:50Z


+  <!-- Polyfills ======================================================= -->
+  <ItemGroup>
+    <PackageReference Include="System.Memory" />


For Span.SequenceEqual() in Internal.cs

paulmedynski · 2026-06-19T16:47:41Z

    default: SqlServer.Artifacts

+  # True when building on the internal ADO.Net project.
+  - name: isInternalBuild


There is a bunch of template plumbing to get isInternalBuild down to the steps that need to decide whether or not to sign assemblies.

paulmedynski · 2026-06-19T16:48:29Z

-                // Try to load the MDS assembly.
+                // Try to load the SqlClient assembly.
+
+                #if STRONG_NAME_SIGNING


The impetus for this work - to validate the SqlClient assembly the same way we're validating the Azure assembly.

paulmedynski · 2026-06-19T16:50:16Z

      <DotnetCommand>
        "$(DotnetPath)dotnet" build "$(SqlClientNotSupportedProjectPath)"
+
+        <!-- Build arguments -->


Some minor unrelated cleanup for consistent sections and ordering in these repeated blocks.

paulmedynski · 2026-06-19T16:50:49Z

+
+        <!-- Build arguments -->
        -p:Configuration=$(Configuration)
+        $(SigningKeyPathArgument)


We're adding the signing key build properties in a few new places now.

Copilot AI review requested due to automatic review settings June 19, 2026 16:28

github-project-automation Bot added this to SqlClient Board Jun 19, 2026

github-project-automation Bot moved this to To triage in SqlClient Board Jun 19, 2026

paulmedynski mentioned this pull request Jun 19, 2026

Rename STRONG_NAME_SIGNING to ASSEMBLY_SIGNING #4383

Draft

4 tasks

Copilot started reviewing on behalf of paulmedynski June 19, 2026 16:28 View session

Copilot AI reviewed Jun 19, 2026

View reviewed changes

Comment thread src/Microsoft.Data.SqlClient.Extensions/Abstractions/src/SqlAuthenticationProvider.Internal.cs

paulmedynski added this to the 7.1.0-preview3 milestone Jun 19, 2026

paulmedynski moved this from To triage to In progress in SqlClient Board Jun 19, 2026

paulmedynski added the Area\Engineering Use this for issues that are targeted for changes in the 'eng' folder or build systems. label Jun 19, 2026

paulmedynski commented Jun 19, 2026

View reviewed changes

This was referenced Jun 19, 2026

Add Logging test package and CI coverage #4384

Draft

Sign the Azure extension assembly and tests #4385

Draft

Sign the Microsoft.SqlServer.Server assembly and wire its package CI #4386

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sign CI Package pipeline assemblies and tests; verify SqlClient in Abstractions#4382

Sign CI Package pipeline assemblies and tests; verify SqlClient in Abstractions#4382
paulmedynski wants to merge 1 commit into
mainfrom
dev/paul/assembly-signing-core

paulmedynski commented Jun 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

paulmedynski Jun 19, 2026

Uh oh!

paulmedynski Jun 19, 2026

Uh oh!

paulmedynski Jun 19, 2026

Uh oh!

paulmedynski Jun 19, 2026

Uh oh!

paulmedynski Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

paulmedynski commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What's included

🔗 PR Stack

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

paulmedynski Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

paulmedynski Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

paulmedynski Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

paulmedynski Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

paulmedynski Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

paulmedynski commented Jun 19, 2026 •

edited

Loading