Skip to content

Commit 10a7fec

Browse files
elantiguamsftCopilot
elantiguamsft
and
Copilot
committed
Add AllowUntrustedSigning option for nuget sign and dotnet nuget sign
Add AllowUntrustedRoot property to SignArgs, CertificateSourceOptions, and SignPackageRequest. Add a new public overload of GetCertificateChain that accepts allowUntrustedRoot parameter, making UntrustedRoot chain status a warning instead of an error during certificate discovery and signing chain validation. Wire up the option through both classic nuget.exe SignCommand (--AllowUntrustedSigning) and dotnet nuget sign (--allow-untrusted-signing). Works on net472 without requiring CustomRootTrust. Co-authored-by: Copilot <[email protected]>
1 parent a553524 commit 10a7fec

42 files changed

Lines changed: 219 additions & 9 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎src/NuGet.Clients/NuGet.CommandLine/Commands/SignCommand.cs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ public SignCommand() : base()
6060
[Option(typeof(NuGetCommand), "SignCommandOverwriteDescription")]
6161
public bool Overwrite { get; set; }
6262

63+
[Option(typeof(NuGetCommand), "SignCommandAllowUntrustedSigningDescription")]
64+
public bool AllowUntrustedSigning { get; set; }
65+
6366
public override async Task ExecuteCommandAsync()
6467
{
6568
var signArgs = GetSignArgs();
@@ -102,6 +105,7 @@ public SignArgs GetSignArgs()
102105
SignatureHashAlgorithm = hashAlgorithm,
103106
Logger = Console,
104107
Overwrite = Overwrite,
108+
AllowUntrustedRoot = AllowUntrustedSigning,
105109
NonInteractive = NonInteractive,
106110
Timestamper = Timestamper,
107111
TimestampHashAlgorithm = timestampHashAlgorithm,

‎src/NuGet.Clients/NuGet.CommandLine/NuGetCommand.Designer.cs‎

Lines changed: 9 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/NuGet.Clients/NuGet.CommandLine/NuGetCommand.resx‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -698,6 +698,9 @@ nuget sign MyPackage.nupkg -CertificateFingerprint certificate_fingerprint -Outp
698698
<data name="SignCommandOverwriteDescription" xml:space="preserve">
699699
<value>Switch to indicate if the current signature should be overwritten. By default the command will fail if the package already has a signature.</value>
700700
</data>
701+
<data name="SignCommandAllowUntrustedSigningDescription" xml:space="preserve">
702+
<value>Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</value>
703+
</data>
701704
<data name="SignCommandHashAlgorithmDescription" xml:space="preserve">
702705
<value>Hash algorithm to be used to sign the package. Defaults to SHA256.</value>
703706
</data>

‎src/NuGet.Clients/NuGet.CommandLine/xlf/NuGetCommand.cs.xlf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -909,6 +909,11 @@ nuget setapikey 4003d786-cc37-4004-bfdf-c4f3e8ef9b3a -Source http://example.com/
909909
<target state="translated">&lt;API key&gt; [možnosti]</target>
910910
<note />
911911
</trans-unit>
912+
<trans-unit id="SignCommandAllowUntrustedSigningDescription">
913+
<source>Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</source>
914+
<target state="new">Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</target>
915+
<note />
916+
</trans-unit>
912917
<trans-unit id="SignCommandCertificateFingerprintDescription">
913918
<source>SHA-256, SHA-384 or SHA-512 fingerprint of the certificate used to search a local certificate store for the certificate.
914919
The certificate store can be specified by -CertificateStoreName and -CertificateStoreLocation options.</source>

‎src/NuGet.Clients/NuGet.CommandLine/xlf/NuGetCommand.de.xlf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -909,6 +909,11 @@ nuget setapikey 4003d786-cc37-4004-bfdf-c4f3e8ef9b3a -Source http://example.com/
909909
<target state="translated">&lt;API key&gt; [options]</target>
910910
<note />
911911
</trans-unit>
912+
<trans-unit id="SignCommandAllowUntrustedSigningDescription">
913+
<source>Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</source>
914+
<target state="new">Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</target>
915+
<note />
916+
</trans-unit>
912917
<trans-unit id="SignCommandCertificateFingerprintDescription">
913918
<source>SHA-256, SHA-384 or SHA-512 fingerprint of the certificate used to search a local certificate store for the certificate.
914919
The certificate store can be specified by -CertificateStoreName and -CertificateStoreLocation options.</source>

‎src/NuGet.Clients/NuGet.CommandLine/xlf/NuGetCommand.es.xlf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -909,6 +909,11 @@ nuget setapikey 4003d786-cc37-4004-bfdf-c4f3e8ef9b3a -Source http://example.com/
909909
<target state="translated">&lt;API key&gt; [options]</target>
910910
<note />
911911
</trans-unit>
912+
<trans-unit id="SignCommandAllowUntrustedSigningDescription">
913+
<source>Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</source>
914+
<target state="new">Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</target>
915+
<note />
916+
</trans-unit>
912917
<trans-unit id="SignCommandCertificateFingerprintDescription">
913918
<source>SHA-256, SHA-384 or SHA-512 fingerprint of the certificate used to search a local certificate store for the certificate.
914919
The certificate store can be specified by -CertificateStoreName and -CertificateStoreLocation options.</source>

‎src/NuGet.Clients/NuGet.CommandLine/xlf/NuGetCommand.fr.xlf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -909,6 +909,11 @@ nuget setapikey 4003d786-cc37-4004-bfdf-c4f3e8ef9b3a -Source http://example.com/
909909
<target state="translated">&lt;API key&gt; [options]</target>
910910
<note />
911911
</trans-unit>
912+
<trans-unit id="SignCommandAllowUntrustedSigningDescription">
913+
<source>Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</source>
914+
<target state="new">Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</target>
915+
<note />
916+
</trans-unit>
912917
<trans-unit id="SignCommandCertificateFingerprintDescription">
913918
<source>SHA-256, SHA-384 or SHA-512 fingerprint of the certificate used to search a local certificate store for the certificate.
914919
The certificate store can be specified by -CertificateStoreName and -CertificateStoreLocation options.</source>

‎src/NuGet.Clients/NuGet.CommandLine/xlf/NuGetCommand.it.xlf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -909,6 +909,11 @@ nuget setapikey 4003d786-cc37-4004-bfdf-c4f3e8ef9b3a -Source http://example.com/
909909
<target state="translated">&lt;API key&gt; [opzioni]</target>
910910
<note />
911911
</trans-unit>
912+
<trans-unit id="SignCommandAllowUntrustedSigningDescription">
913+
<source>Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</source>
914+
<target state="new">Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</target>
915+
<note />
916+
</trans-unit>
912917
<trans-unit id="SignCommandCertificateFingerprintDescription">
913918
<source>SHA-256, SHA-384 or SHA-512 fingerprint of the certificate used to search a local certificate store for the certificate.
914919
The certificate store can be specified by -CertificateStoreName and -CertificateStoreLocation options.</source>

‎src/NuGet.Clients/NuGet.CommandLine/xlf/NuGetCommand.ja.xlf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -909,6 +909,11 @@ nuget setapikey 4003d786-cc37-4004-bfdf-c4f3e8ef9b3a -Source http://example.com/
909909
<target state="translated">&lt;API key&gt; [オプション]</target>
910910
<note />
911911
</trans-unit>
912+
<trans-unit id="SignCommandAllowUntrustedSigningDescription">
913+
<source>Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</source>
914+
<target state="new">Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</target>
915+
<note />
916+
</trans-unit>
912917
<trans-unit id="SignCommandCertificateFingerprintDescription">
913918
<source>SHA-256, SHA-384 or SHA-512 fingerprint of the certificate used to search a local certificate store for the certificate.
914919
The certificate store can be specified by -CertificateStoreName and -CertificateStoreLocation options.</source>

‎src/NuGet.Clients/NuGet.CommandLine/xlf/NuGetCommand.ko.xlf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -909,6 +909,11 @@ nuget setapikey 4003d786-cc37-4004-bfdf-c4f3e8ef9feedb3a -Source http://example.
909909
<target state="translated">&lt;API 키&gt; [옵션]</target>
910910
<note />
911911
</trans-unit>
912+
<trans-unit id="SignCommandAllowUntrustedSigningDescription">
913+
<source>Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</source>
914+
<target state="new">Allow signing with certificates whose root certificate is not in a trusted root store. The certificate chain is still built and validated for structure, but UntrustedRoot status is treated as a warning.</target>
915+
<note />
916+
</trans-unit>
912917
<trans-unit id="SignCommandCertificateFingerprintDescription">
913918
<source>SHA-256, SHA-384 or SHA-512 fingerprint of the certificate used to search a local certificate store for the certificate.
914919
The certificate store can be specified by -CertificateStoreName and -CertificateStoreLocation options.</source>

0 commit comments

Comments
 (0)