Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Re-enable code-signing NuGet packages for stable builds #14030

Closed
jonthysell opened this issue Oct 24, 2024 · 1 comment
Closed

Re-enable code-signing NuGet packages for stable builds #14030

jonthysell opened this issue Oct 24, 2024 · 1 comment
Assignees
@jonthysell
Labels
Area: Compliance bug Workstream: ES Compliance SFI Provide regular ES infrastructure and ensure RNW meets internal security and compliance requirements
Milestone
0.78

Comments

@jonthysell
Copy link
Contributor

jonthysell commented Oct 24, 2024 •
edited
Loading

Due to some internal policy changes and misconfigurations, we needed to temporarily stop signing our NuGet packages for stable builds in order to keep releasing them. This issue is to track re-enabling the code-signing.

In the meantime, this means we will be unable to publish the various Microsoft.ReactNative.* packages to NuGet.org (which requires them to be signed).

We will be still publishing unsigned packages to our public ADO feed. If you are using these NuGet packages (default for Fabric and experimental for Paper via --experimentalNuGetDependency) you will need to make sure your NuGet.config file in the root of your repo has our react-native-public feed in addition to NuGet.org.

For example:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="react-native" value="https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/nuget/v3/index.json" />
    <add key="NuGet.org" value="https://api.nuget.org/v3/index.json" />
  </packageSources>
  <disabledPackageSources>
    <clear />
  </disabledPackageSources>  
</configuration>

Note this may mean that there will be specific missing versions of the Microsoft.ReactNative.* packages on NuGet.org. When we get code-signing working again, we will publish at least one new stable release of each pacakage NuGet.org so customers can avoid this workaround.

Customers building from source should not be affected in any way.
@jonthysell jonthysell added Area: Compliance Workstream: ES Compliance SFI Provide regular ES infrastructure and ensure RNW meets internal security and compliance requirements labels Oct 24, 2024
@microsoft-github-policy-service microsoft-github-policy-service bot added the Needs: Triage 🔍 New issue that needs to be reviewed by the issue management team (label applied by bot) label Oct 24, 2024
@jonthysell jonthysell mentioned this issue Oct 24, 2024
Merged
@chrisglein chrisglein added this to the Next milestone Oct 24, 2024
@chrisglein chrisglein removed the Needs: Triage 🔍 New issue that needs to be reviewed by the issue management team (label applied by bot) label Oct 24, 2024
jonthysell added a commit that referenced this issue Oct 24, 2024
@jonthysell
[0.74] Temporarily disable code-signing of NuGet packages (#14031)
d524e2a 
## Description

This PR temporarily disables NuGet code-signing during publish and also forces all new projects to include our public ADO feed which will contain unsigned packages.

### Type of Change
- Bug fix (non-breaking change which fixes an issue)

### Why
See #14030 for why this is necessary.

### What
See above.

## Screenshots
N/A

## Testing
N/A

## Changelog
Should this change be included in the release notes: _yes_

[0.74] Temporarily disable code-signing of NuGet packages
jonthysell added a commit to jonthysell/react-native-windows that referenced this issue Oct 24, 2024
@jonthysell
[0.75] Temporarily disable code-signing of NuGet packages (microsoft#…
68ea387 
…14031)

## Description

This PR temporarily disables NuGet code-signing during publish and also forces all new projects to include our public ADO feed which will contain unsigned packages.

### Type of Change
- Bug fix (non-breaking change which fixes an issue)

### Why
See microsoft#14030 for why this is necessary.

### What
See above.

## Screenshots
N/A

## Testing
N/A

## Changelog
Should this change be included in the release notes: _yes_

[0.75] Temporarily disable code-signing of NuGet packages
@jonthysell jonthysell mentioned this issue Oct 24, 2024
Merged
jonthysell added a commit to jonthysell/react-native-windows that referenced this issue Oct 24, 2024
@jonthysell
[0.76] Temporarily disable code-signing of NuGet packages (microsoft#…
d1dbfc3 
…14031)

## Description

This PR temporarily disables NuGet code-signing during publish and also forces all new projects to include our public ADO feed which will contain unsigned packages.

### Type of Change
- Bug fix (non-breaking change which fixes an issue)

### Why
See microsoft#14030 for why this is necessary.

### What
See above.

## Screenshots
N/A

## Testing
N/A

## Changelog
Should this change be included in the release notes: _yes_

[0.76] Temporarily disable code-signing of NuGet packages
@jonthysell jonthysell mentioned this issue Oct 24, 2024
Merged
@microsoft-github-policy-service microsoft-github-policy-service bot added the Invalid Triage https://github.com/microsoft/react-native-windows/wiki/Triage-Process (label applied by bot) label Oct 25, 2024
jonthysell added a commit that referenced this issue Oct 25, 2024
@jonthysell
[0.75] Temporarily disable code-signing of NuGet packages (#14031) (#…
b4bb6c6 
…14032)

## Description

This PR temporarily disables NuGet code-signing during publish and also forces all new projects to include our public ADO feed which will contain unsigned packages.

### Type of Change
- Bug fix (non-breaking change which fixes an issue)

### Why
See #14030 for why this is necessary.

### What
See above.

## Screenshots
N/A

## Testing
N/A

## Changelog
Should this change be included in the release notes: _yes_

[0.75] Temporarily disable code-signing of NuGet packages
@jonthysell jonthysell added bug and removed Invalid Triage https://github.com/microsoft/react-native-windows/wiki/Triage-Process (label applied by bot) labels Oct 25, 2024
jonthysell added a commit that referenced this issue Oct 25, 2024
@jonthysell
[0.76] Temporarily disable code-signing of NuGet packages (#14031) (#…
5b950cf 
…14033)

## Description

This PR temporarily disables NuGet code-signing during publish and also forces all new projects to include our public ADO feed which will contain unsigned packages.

### Type of Change
- Bug fix (non-breaking change which fixes an issue)

### Why
See #14030 for why this is necessary.

### What
See above.

## Screenshots
N/A

## Testing
N/A

## Changelog
Should this change be included in the release notes: _yes_

[0.76] Temporarily disable code-signing of NuGet packages
jonthysell added a commit to jonthysell/react-native-windows that referenced this issue Oct 25, 2024
@jonthysell
Temporarily disable code-signing of NuGet packages
afa9d47 
## Description

This PR temporarily disables NuGet code-signing during publish and also forces all new projects to include our public ADO feed which will contain unsigned packages.

### Type of Change
- Bug fix (non-breaking change which fixes an issue)

### Why
See microsoft#14030 for why this is necessary.

### What
See above.

## Screenshots
N/A

## Testing
N/A

## Changelog
Should this change be included in the release notes: _yes_

Temporarily disable code-signing of NuGet packages
@jonthysell jonthysell mentioned this issue Oct 25, 2024
Merged
jonthysell added a commit that referenced this issue Oct 25, 2024
@jonthysell
Temporarily disable code-signing of NuGet packages (#14034)
2557b61 
## Description

This PR temporarily disables NuGet code-signing during publish and also forces all new projects to include our public ADO feed which will contain unsigned packages.

### Type of Change
- Bug fix (non-breaking change which fixes an issue)

### Why
See #14030 for why this is necessary.

### What
See above.

## Screenshots
N/A

## Testing
N/A

## Changelog
Should this change be included in the release notes: _yes_

Temporarily disable code-signing of NuGet packages
@chrisglein chrisglein modified the milestones: Next, 0.77 Dec 18, 2024
@jonthysell jonthysell modified the milestones: 0.77, Next Jan 7, 2025
@jonthysell jonthysell changed the title Temporarily disabling code-signing NuGet packages for stable builds Re-enable code-signing NuGet packages for stable builds Jan 7, 2025
@jonthysell jonthysell modified the milestones: Next, 0.78 Jan 30, 2025
@jonthysell
Copy link
Contributor Author

This has now been resolved for main and stable branches >= 0.74.

Image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jonthysell jonthysell

Labels
Area: Compliance bug Workstream: ES Compliance SFI Provide regular ES infrastructure and ensure RNW meets internal security and compliance requirements
Projects
RNW New Architecture
Status: No status
Milestone
0.78
Development

No branches or pull requests
2 participants
@jonthysell @chrisglein