dotnet / sign

Code Signing CLI tool supporting Authenticode, NuGet, VSIX, and ClickOnce
MIT License
477 stars 91 forks source link

Faulty resource reuse in CertificateStoreService.cs #771

Open MeikTranel opened 15 hours ago

MeikTranel commented 15 hours ago

Describe the bug

When using the local (windows) certificate store to find a cert the CertificateStoreService prints that its searchin in Azure Key Vault, because the log message was likely copied from the azure key vault provider. See: https://github.com/dotnet/sign/blob/ac9e8b416cd6e8692f1eea1ac6678d7e5c464216/src/Sign.SignatureProviders.CertificateStore/CertificateStoreService.cs#L118

Uses the same resource key as: https://github.com/dotnet/sign/blob/ac9e8b416cd6e8692f1eea1ac6678d7e5c464216/src/Sign.SignatureProviders.KeyVault/KeyVaultService.cs#L79

which is: https://github.com/dotnet/sign/blob/ac9e8b416cd6e8692f1eea1ac6678d7e5c464216/src/Sign.Core/Resources.resx#L190-L192

Not sure of the semantics of TrustedSigningService but that service is also reusing that resource key: https://github.com/dotnet/sign/blob/ac9e8b416cd6e8692f1eea1ac6678d7e5c464216/src/Sign.SignatureProviders.TrustedSigning/TrustedSigningService.cs#L70

Image

Expected behavior Verbose logs should print that it was searching in the windows cert store. Bonus points if that log also provides where exactly it searched and what it found "Issue To" or the SHA1 Hash or something would be helpful.

Actual behavior A clear and concise description of what actually happened.

Additional context

 λ dotnet sign --version                                                                                                                                                       
0.9.1-beta.24469.1+5516908609085978174904945d54144c117041dc
 λ dotnet --info
.NET SDK:
 Version:           9.0.100-rc.1.24452.12
 Commit:            81a714c6d3
 Workload version:  9.0.100-manifests.67cd1eb6
 MSBuild version:   17.12.0-preview-24422-09+d17ec720d

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.22631
 OS Platform: Windows
 RID:         win-x64
 Base Path:   C:\Program Files\dotnet\sdk\9.0.100-rc.1.24452.12\

.NET workloads installed:
Configured to use loose manifests when installing new manifests.
 [aspire]
   Installation Source: VS 17.11.35327.3, VS 17.12.35323.107
   Manifest Version:    8.2.0/8.0.100
   Manifest Path:       C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.aspire\8.2.0\WorkloadManifest.json
   Install Type:        FileBased

Host:
  Version:      9.0.0-rc.1.24431.7
  Architecture: x64
  Commit:       static

.NET SDKs installed:
  8.0.403 [C:\Program Files\dotnet\sdk]
  9.0.100-rc.1.24452.12 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 8.0.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 8.0.10 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 9.0.0-rc.1.24452.1 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 6.0.31 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 8.0.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 8.0.10 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 9.0.0-rc.1.24431.7 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 6.0.31 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 8.0.8 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 8.0.10 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 9.0.0-rc.1.24452.1 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
  x86   [C:\Program Files (x86)\dotnet]
    registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables:
  Not set

global.json file:
  Not found

Learn more:
  https://aka.ms/dotnet/info

Download .NET:
  https://aka.ms/dotnet/download
dlemstra commented 8 hours ago

Thanks for reporting this issue. I have created a PR that fixes this issue.