Add Windows Authenticode code signing support for Smart App Control compatibility #240
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… Control Co-authored-by: TheCodeTraveler <[email protected]>
…ompatibility Co-authored-by: TheCodeTraveler <[email protected]>
Co-authored-by: TheCodeTraveler <[email protected]>
Copilot
AI
changed the title
Copilot finished work on behalf of
TheCodeTraveler
July 15, 2025 18:27
|
/azp run |
|
Azure Pipelines failed to run 1 pipeline(s). |
There was a problem hiding this comment.
Pull Request Overview
This PR adds Windows Authenticode code signing support to AsyncAwaitBestPractices libraries to ensure compatibility with Windows 11 Smart App Control. The implementation includes conditional signing that only occurs during Release builds on Windows when certificates are available.
- Adds MSBuild targets for Windows Authenticode signing with conditional execution
- Configures Azure DevOps pipeline to automatically sign assemblies when certificates are present
- Provides comprehensive documentation for setup and troubleshooting
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| src/AsyncAwaitBestPractices/AsyncAwaitBestPractices.csproj | Adds code signing configuration properties and MSBuild target for signing assemblies |
| src/AsyncAwaitBestPractices.MVVM/AsyncAwaitBestPractices.MVVM.csproj | Adds identical code signing configuration properties and MSBuild target |
| azure-pipelines.yml | Adds secure file download for certificates and environment variables for signing |
| README.md | Adds security and code signing section with overview and reference to documentation |
| CODE_SIGNING.md | Comprehensive documentation covering setup, configuration, and troubleshooting |
src/AsyncAwaitBestPractices.MVVM/AsyncAwaitBestPractices.MVVM.csproj
Outdated
Show resolved
Hide resolved
| - Certificate must be valid for code signing | ||
| - Certificate should have timestamping enabled for long-term validity | ||
|
|
||
| ### Recommended Certificate Authorities |
There was a problem hiding this comment.
[nitpick] The recommended Certificate Authorities section should include more context about why these specific CAs are recommended for Windows code signing and Smart App Control compatibility.
Suggested change
| ### Recommended Certificate Authorities | |
| ### Recommended Certificate Authorities | |
| The following Certificate Authorities are recommended because they are widely trusted for Windows code signing and are known to meet the requirements for Smart App Control compatibility. These CAs provide robust support for timestamping, ensuring long-term validity of signed code, and have a strong reputation for reliability: |
Copilot uses AI. Check for mistakes.
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
…csproj Co-authored-by: Copilot <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds Windows Authenticode code signing support to AsyncAwaitBestPractices libraries to ensure compatibility with Windows 11 Smart App Control.
Problem
Windows 11 Smart App Control requires applications and their dependencies to be signed with trusted certificates. Without proper code signing, applications using AsyncAwaitBestPractices libraries are blocked when Smart App Control is enabled:
AsyncAwaitBestPractices (unsigned):
Microsoft DLL (signed):
Solution
Added comprehensive Windows Authenticode code signing support with the following features:
🔒 Security & Production-Ready
🛠️ Developer-Friendly
CODE_SIGNING.md🚀 CI/CD Integrated
Changes Made
Project Files Enhanced
.csprojfilesWINDOWS_CODESIGN_CERTIFICATEandWINDOWS_CODESIGN_PASSWORDAzure DevOps Pipeline Updated
Documentation Added
CODE_SIGNING.mdwith setup instructionsTesting
Next Steps for Maintainers
WINDOWS_CODESIGN_CERTIFICATE_NAMEandWINDOWS_CODESIGN_PASSWORDThis minimal, surgical implementation addresses the core compatibility issue while maintaining full backward compatibility and following security best practices.
Fixes #164.
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.