search

microsoft / axe-windows

Automated accessibility testing engine for Windows applications
MIT License
132 stars 61 forks source link

[BUG] Axe.Windows files are signed with the 3rd party certificate #995

Closed DaveTryon closed 4 months ago

DaveTryon commented 6 months ago

Please check whether the bug has already been filed.

We've been signing the Axe.Windows files files the Microsoft 3rd party certiicate. This certificate is intended for external (non-Microsoft) files that we trust and redistribute with Microsoft products. We should probably be signing the Axe.Windows*.dll files with the same certificate that we use to sign Accessibility Insights (and that other teams use to sign the ApplicationInsights or ADO packages that Microsoft builds)

To Reproduce Steps to reproduce the behavior:

  1. Go to https://www.nuget.org/packages/Axe.Windows
  2. Pick a version of the NuGet package
  3. Use the "Download package" link to download a copy
  4. Change the .nupkg extension to .zip
  5. Extract the contents of the .zip file
  6. Examine the properties of any of the DLL's under the lib\netstandard20 folder
  7. Check the details of the digital signature

Expected behavior

The signer name should (I think) be "Microsoft Corporation".

Actual behavior

The signer name is "Microsoft 3rd Party Application Component"

Additional context

I checked versions back to 2020. This is not a new problem and has nothing to do with any pipeline template work.

Priority requested -

DaveTryon commented 4 months ago

This has been released in https://github.com/microsoft/axe-windows/releases/tag/v2.3.1. Closing.