Remove test .pfx file from repo. Generate temp cert as part of the build. #6898
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ghost
added
the
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
ojhad
added
area-DevInternal
llongley
approved these changes
Mar 29, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It is not best practice to include a checked in .pfx in the git repo.
We need a .pfx file to test sign the test app appx files that we create. An appx must be signed with something for it to be able to be installed. We want to maintain the ability for someone to just clone the repo and build the .sln without having to do any special steps to configure their environment. So, we now generate a new self-signed .pfx file as part of the build to use for signing with GenerateTestPfx.ps1.
As part of this change, I have also updated the published identity for the test apps from 'Microsoft' to 'WinUITest' which is more appropriate.
For the Microsoft.UI.Xaml Framework package, we need to keep the publisher identity as 'Microsoft', so we generate a separate temp self-signed pfx for that.
None of this has any bearing on what we ship in official release builds. For these we sign everything using an internal signing system and not the temp self-signed pfx files that we use for testing.