Add assembly signing for Microsoft.Data.SqlClient and the AKV Provider

build.proj

@@ -637,7 +637,12 @@
 
       <DotnetCommand>
         "$(DotnetPath)dotnet" test "$(SqlClientFunctionalTestProjectPath)"
+
+        <!-- Build arguments -->
         -p:Configuration=$(Configuration)
+        $(SigningKeyPathArgument)
+
+        <!-- Test arguments -->
         $(TestBlameArgument)
         $(TestCodeCoverageArgument)
         $(TestFiltersArgument)
@@ -681,7 +686,12 @@
 
       <DotnetCommand>
         "$(DotnetPath)dotnet" test "$(SqlClientManualTestProjectPath)"
+
+        <!-- Build arguments -->
         -p:Configuration=$(Configuration)
+        $(SigningKeyPathArgument)
+
+        <!-- Test arguments -->
         $(TestBlameArgument)
         $(TestCodeCoverageArgument)
         $(ManualTestFiltersArgument)
@@ -699,7 +709,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running manual tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- TestSqlClientUnit: Runs unit tests for SqlClient -->
@@ -710,17 +720,24 @@
 
       <DotnetCommand>
         "$(DotnetPath)dotnet" test "$(SqlClientUnitTestProjectPath)"
+
+        <!-- Build arguments -->
         -p:Configuration=$(Configuration)
+        $(SigningKeyPathArgument)
+        $(TestSigningKeyPathArgument)
+
+        <!-- Test arguments -->
         $(TestBlameArgument)
         $(TestCodeCoverageArgument)
         $(TestFiltersArgument)
         $(TestFrameworkArgument)
+        --results-directory "$(TestResultsFolderPath)"
+        --logger:"trx;LogFilePrefix=$(LogFilePrefix)"
+
+        <!-- Reference Type Arguments -->
         $(ReferenceTypeArgument)
-        $(TestSigningKeyPathArgument)
         $(PackageVersionSqlClientArgument)
         $(PackageVersionSqlServerArgument)
-        --results-directory "$(TestResultsFolderPath)"
-        --logger:"trx;LogFilePrefix=$(LogFilePrefix)"
       </DotnetCommand>
 
       <!-- Convert more than one whitespace character into one space -->
@@ -728,7 +745,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running unit tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- ================================================================= -->

eng/pipelines/common/templates/jobs/ci-build-nugets-job.yml

@@ -76,6 +76,11 @@ parameters:
     type: string
     default: SqlServer.Artifacts
 
+  # True when building on the internal ADO.Net project.
+  - name: isInternalBuild
+    type: boolean
+    default: false
+
 jobs:
 - job: build_mds_akv_packages_job
   displayName: Build MDS & AKV Packages
@@ -126,6 +131,10 @@ jobs:
   # Restore dotnet CLI tools (e.g. pwsh, apicompat) before building.
   - template: /eng/pipelines/common/steps/restore-dotnet-tools.yml@self
 
+  # Download the assembly signing key for internal Package-mode builds.
+  - ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}:
+    - template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self
+
   # When we're performing a Debug build, we still want to try _compiling_ the
   # code in Release mode to ensure downstream pipelines don't encounter
   # compilation errors.  We won't use the Release artifacts for anything else
@@ -147,6 +156,8 @@ jobs:
       build: MDS
       packageVersion: ${{ parameters.packageVersion }}
       sqlServerPackageVersion: ${{ parameters.sqlServerPackageVersion }}
+      ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}:
+        signingKeyPath: $(driverKeyFile.secureFilePath)
 
   - task: DotNetCoreCLI@2
     displayName: 'Create MDS NuGet Package'
@@ -189,6 +200,8 @@ jobs:
       build: AkvProvider
       packageVersion: ${{ parameters.packageVersion }}
       sqlServerPackageVersion: ${{ parameters.sqlServerPackageVersion }}
+      ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}:
+        signingKeyPath: $(driverKeyFile.secureFilePath)
 
   - task: DotNetCoreCLI@2
     displayName: 'Create AKV Provider NuGet Package'

eng/pipelines/common/templates/jobs/ci-run-tests-job.yml

@@ -148,6 +148,11 @@ parameters:
   - name: saPassword
     type: string
 
+  # True when building on the internal ADO.Net project.
+  - name: isInternalBuild
+    type: boolean
+    default: false
+
 jobs:
 - job: ${{ format('{0}', coalesce(parameters.jobDisplayName, parameters.image, 'unknown_image')) }}
 
@@ -205,6 +210,13 @@ jobs:
   # Restore dotnet CLI tools (e.g. pwsh, apicompat) before building.
   - template: /eng/pipelines/common/steps/restore-dotnet-tools.yml@self
 
+  # Download the assembly signing keys for internal Package-mode builds.
+  - ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}:
+    - template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self
+    - template: /eng/pipelines/common/steps/download-assembly-signing-key.yml@self
+      parameters:
+        isTest: true
+
   - ${{ if ne(parameters.prebuildSteps, '') }}:
     - ${{ parameters.prebuildSteps }} # extra steps to run before the build like downloading sni and the required configuration
 
@@ -358,6 +370,9 @@ jobs:
         operatingSystem: ${{ parameters.operatingSystem }}
         packageVersion: ${{ parameters.packageVersion }}
         sqlServerPackageVersion: ${{ parameters.sqlServerPackageVersion }}
+        ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}:
+          signingKeyPath: $(driverKeyFile.secureFilePath)
+          testSigningKeyPath: $(testKeyFile.secureFilePath)
 
   - ${{ if and(eq(parameters.enableX86Test, true), eq(parameters.operatingSystem, 'Windows')) }}:
     - template: /eng/pipelines/common/templates/steps/run-all-tests-step.yml@self
@@ -372,6 +387,9 @@ jobs:
         operatingSystem: ${{ parameters.operatingSystem }}
         packageVersion: ${{ parameters.packageVersion }}
         sqlServerPackageVersion: ${{ parameters.sqlServerPackageVersion }}
+        ${{ if and(eq(parameters.isInternalBuild, true), ne(parameters.referenceType, 'Project')) }}:
+          signingKeyPath: $(driverKeyFile.secureFilePath)
+          testSigningKeyPath: $(testKeyFile.secureFilePath)
 
   - template: /eng/pipelines/common/templates/steps/publish-test-results-step.yml@self
     parameters:

eng/pipelines/common/templates/stages/ci-run-tests-stage.yml

@@ -71,6 +71,11 @@ parameters:
   - name: testJobTimeout
     type: number
 
+  # True when building on the internal ADO.Net project.
+  - name: isInternalBuild
+    type: boolean
+    default: false
+
 stages:
 - ${{ each config in parameters.testConfigurations }}:
   - ${{ each image in config.value.images }}:
@@ -114,6 +119,7 @@ stages:
                   packageVersion: $(packageVersion)
                   loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
                   mdsArtifactsName: ${{ parameters.mdsArtifactsName }}
+                  isInternalBuild: ${{ parameters.isInternalBuild }}
                   sqlServerArtifactsName: ${{ parameters.sqlServerArtifactsName }}
                   sqlServerPackageVersion: $(sqlServerPackageVersion)
                   prebuildSteps: ${{ parameters.prebuildSteps }}
@@ -149,6 +155,7 @@ stages:
                     packageVersion: $(packageVersion)
                     loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
                     mdsArtifactsName: ${{ parameters.mdsArtifactsName }}
+                    isInternalBuild: ${{ parameters.isInternalBuild }}
                     sqlServerArtifactsName: ${{ parameters.sqlServerArtifactsName }}
                     sqlServerPackageVersion: $(sqlServerPackageVersion)
                     prebuildSteps: ${{ parameters.prebuildSteps }}

eng/pipelines/common/templates/steps/ci-project-build-step.yml

@@ -58,6 +58,12 @@ parameters:
     type: string
     default: $(sqlServerPackageVersion)
 
+  # Path to the assembly signing key file.  When non-empty, passed as -p:SigningKeyPath="" to the
+  # build.  The calling job is responsible for providing the key.
+  - name: signingKeyPath
+    type: string
+    default: ''
+
 steps:
   # Build MDS
   - ${{ if or(eq(parameters.build, 'MDS'), eq(parameters.build, 'all'), eq(parameters.build, 'allNoDocs')) }}:
@@ -74,6 +80,7 @@ steps:
           -p:BuildNumber=${{ parameters.buildNumber }}
           -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
 
   # Build AKV Provider
   - ${{ if or(eq(parameters.build, 'AkvProvider'), eq(parameters.build, 'all'), eq(parameters.build, 'allNoDocs')) }}:
@@ -90,3 +97,4 @@ steps:
           -p:BuildNumber=${{ parameters.buildNumber }}
           -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"

eng/pipelines/common/templates/steps/run-all-tests-step.yml

@@ -68,6 +68,18 @@ parameters:
     type: number
     default: 2
 
+  # Path to the assembly signing key file.  When non-empty, passed to build.proj so that the
+  # test-filter logic can include category=signed tests.
+  - name: signingKeyPath
+    type: string
+    default: ''
+
+  # Path to the test assembly signing key file.  When non-empty, passed to build.proj so that test
+  # assemblies are signed and can satisfy InternalsVisibleTo grants from signed source assemblies.
+  - name: testSigningKeyPath
+    type: string
+    default: ''
+
 steps:
 - ${{ if parameters.debug }}:
   - powershell: 'dotnet sdk check'
@@ -90,6 +102,8 @@ steps:
           -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
           -p:TestResultsFolderPath=TestResults
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
       ${{ else }}: # x86
         arguments: >-
           -t:TestSqlClientUnit
@@ -100,6 +114,8 @@ steps:
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
           -p:DotnetPath=${{ parameters.dotnetx86RootPath }}
           -p:TestResultsFolderPath=TestResults
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
 
   - task: DotNetCoreCLI@2
     displayName: 'Run Flaky Unit Tests ${{parameters.msbuildArchitecture }}'
@@ -118,6 +134,8 @@ steps:
           -p:TestFilters="category=flaky"
           -p:TestResultsFolderPath=TestResults
           -p:TestCodeCoverage=false
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
       ${{ else }}: # x86
         arguments: >-
           -t:TestSqlClientUnit
@@ -130,6 +148,8 @@ steps:
           -p:TestFilters="category=flaky"
           -p:TestResultsFolderPath=TestResults
           -p:TestCodeCoverage=false
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     continueOnError: true
 
   - task: DotNetCoreCLI@2
@@ -147,6 +167,8 @@ steps:
           -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
           -p:TestResultsFolderPath=TestResults
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
       ${{ else }}: # x86
         arguments: >-
           -t:TestSqlClientFunctional
@@ -157,6 +179,8 @@ steps:
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
           -p:DotnetPath=${{ parameters.dotnetx86RootPath }}
           -p:TestResultsFolderPath=TestResults
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
 
   - task: DotNetCoreCLI@2
     displayName: 'Run Flaky Functional Tests ${{parameters.msbuildArchitecture }}'
@@ -175,6 +199,8 @@ steps:
           -p:TestFilters="category=flaky"
           -p:TestResultsFolderPath=TestResults
           -p:TestCodeCoverage=false
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
       ${{ else }}: # x86
         arguments: >-
           -t:TestSqlClientFunctional
@@ -187,6 +213,8 @@ steps:
           -p:TestFilters="category=flaky"
           -p:TestResultsFolderPath=TestResults
           -p:TestCodeCoverage=false
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     continueOnError: true
 
   - task: DotNetCoreCLI@2
@@ -205,6 +233,8 @@ steps:
           -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
           -p:TestResultsFolderPath=TestResults
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
       ${{ else }}: # x86
         arguments: >-
           -t:TestSqlClientManual
@@ -216,6 +246,8 @@ steps:
           -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
           -p:DotnetPath=${{ parameters.dotnetx86RootPath }}
           -p:TestResultsFolderPath=TestResults
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     retryCountOnTaskFailure: ${{parameters.retryCountOnManualTests }}
 
   - task: DotNetCoreCLI@2
@@ -236,6 +268,8 @@ steps:
           -p:TestFilters="category=flaky"
           -p:TestResultsFolderPath=TestResults
           -p:TestCodeCoverage=false
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
       ${{ else }}: # x86
         arguments: >-
           -t:TestSqlClientManual
@@ -249,6 +283,8 @@ steps:
           -p:TestFilters="category=flaky"
           -p:TestResultsFolderPath=TestResults
           -p:TestCodeCoverage=false
+          -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+          -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     continueOnError: true
 
 - ${{ else }}: # Linux or macOS
@@ -266,6 +302,8 @@ steps:
         -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
         -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
         -p:TestResultsFolderPath=TestResults
+        -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+        -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
 
   - task: DotNetCoreCLI@2
     displayName: 'Run Flaky Unit Tests'
@@ -283,6 +321,8 @@ steps:
         -p:TestFilters="category=flaky"
         -p:TestResultsFolderPath=TestResults
         -p:TestCodeCoverage=false
+        -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+        -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     continueOnError: true
 
   - task: DotNetCoreCLI@2
@@ -299,6 +339,8 @@ steps:
         -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
         -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
         -p:TestResultsFolderPath=TestResults
+        -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+        -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
 
   - task: DotNetCoreCLI@2
     displayName: 'Run Flaky Functional Tests'
@@ -316,6 +358,8 @@ steps:
         -p:TestFilters="category=flaky"
         -p:TestResultsFolderPath=TestResults
         -p:TestCodeCoverage=false
+        -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+        -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     continueOnError: true
   - task: DotNetCoreCLI@2
     displayName: 'Run Manual Tests'
@@ -332,6 +376,8 @@ steps:
         -p:PackageVersionSqlClient=${{ parameters.packageVersion }}
         -p:PackageVersionSqlServer=${{ parameters.sqlServerPackageVersion }}
         -p:TestResultsFolderPath=TestResults
+        -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+        -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     retryCountOnTaskFailure: ${{parameters.retryCountOnManualTests }}
 
   - task: DotNetCoreCLI@2
@@ -351,4 +397,6 @@ steps:
         -p:TestFilters="category=flaky"
         -p:TestResultsFolderPath=TestResults
         -p:TestCodeCoverage=false
+        -p:SigningKeyPath="${{ parameters.signingKeyPath }}"
+        -p:TestSigningKeyPath="${{ parameters.testSigningKeyPath }}"
     continueOnError: true

eng/pipelines/dotnet-sqlclient-ci-core.yml

@@ -201,6 +201,7 @@ stages:
       loggingArtifactsName: $(loggingArtifactsName)
       mdsArtifactsName: $(mdsArtifactsName)
       referenceType: ${{ parameters.referenceType }}
+      isInternalBuild: ${{ parameters.isInternalBuild }}
       sqlServerArtifactsName: $(sqlServerArtifactsName)
       SNIVersion: ${{ parameters.SNIVersion }}
       SNIValidationFeed: ${{ parameters.SNIValidationFeed }}
@@ -254,6 +255,7 @@ stages:
       abstractionsArtifactsName: $(abstractionsArtifactsName)
       loggingArtifactsName: $(loggingArtifactsName)
       mdsArtifactsName: $(mdsArtifactsName)
+      isInternalBuild: ${{ parameters.isInternalBuild }}
       sqlServerArtifactsName: $(sqlServerArtifactsName)
       testJobTimeout: ${{ parameters.testJobTimeout }}