ci(publish): build, sign, pack, sbom generation and publish jobs

.config/dotnet-tools.json

@@ -7,6 +7,20 @@
       "commands": [
         "sign"
       ]
+    },
+    "microsoft.sbom.dotnettool": {
+      "version": "4.1.5",
+      "commands": [
+        "sbom-tool"
+      ],
+      "rollForward": true
+    },
+    "cyclonedx": {
+      "version": "6.2.0",
+      "commands": [
+        "dotnet-CycloneDX"
+      ],
+      "rollForward": true
     }
   }
 }

.github/scripts/Assert-AssemblyStrongName.ps1

@@ -0,0 +1,137 @@
+<#
+.SYNOPSIS
+    Verifies that assemblies are strong-name signed with the approved Infragistics key.
+
+.DESCRIPTION
+    'sn.exe -vf' proves only that an assembly's strong name is internally consistent, so any valid
+    private key passes it. This script additionally compares each assembly's public key against a
+    value pinned in the repository and established out of band from the signing key.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)]
+    [string[]]$Path,
+
+    [Parameter(Mandatory)]
+    [string]$ExpectedPublicKeyPath,
+
+    [string]$SnPath
+)
+
+$ErrorActionPreference = 'Stop'
+# Failures are aggregated per assembly, so sn.exe exit codes must not throw on their own.
+$PSNativeCommandUseErrorActionPreference = $false
+
+function ConvertTo-HexString([byte[]]$Bytes) {
+    return (-join ($Bytes | ForEach-Object { $_.ToString('x2') }))
+}
+
+if (-not (Test-Path -LiteralPath $ExpectedPublicKeyPath)) {
+    throw "Pinned public key file not found: $ExpectedPublicKeyPath"
+}
+
+$hexLines = @(
+    Get-Content -LiteralPath $ExpectedPublicKeyPath |
+        ForEach-Object { $_.Trim() } |
+        Where-Object { $_ -and -not $_.StartsWith('#') }
+)
+
+# A blank or malformed pin must fail loudly; otherwise the whole check silently becomes a no-op.
+if ($hexLines.Count -ne 1) {
+    throw "$ExpectedPublicKeyPath must contain exactly one non-comment line, but contains $($hexLines.Count)."
+}
+
+$expectedPublicKeyHex = $hexLines[0].ToLowerInvariant()
+if ($expectedPublicKeyHex -notmatch '^[0-9a-f]{320,}$' -or $expectedPublicKeyHex.Length % 2 -ne 0) {
+    throw "$ExpectedPublicKeyPath does not hold a public key blob (expected an even number of at least 320 hex characters)."
+}
+
+$expectedPublicKey = [byte[]]::new($expectedPublicKeyHex.Length / 2)
+for ($index = 0; $index -lt $expectedPublicKey.Length; $index++) {
+    $expectedPublicKey[$index] = [Convert]::ToByte($expectedPublicKeyHex.Substring($index * 2, 2), 16)
+}
+
+# SHA-1 is not a security choice here; it is the algorithm that defines a strong-name token.
+$digest = [System.Security.Cryptography.SHA1]::Create().ComputeHash($expectedPublicKey)
+$tokenBytes = $digest[-8..-1]
+[array]::Reverse($tokenBytes)
+$expectedToken = ConvertTo-HexString $tokenBytes
+
+if ($SnPath) {
+    if (-not (Test-Path -LiteralPath $SnPath -PathType Leaf)) {
+        throw "The specified sn.exe path does not exist: $SnPath"
+    }
+
+    $strongNameTool = Get-Item -LiteralPath $SnPath
+}
+else {
+    $strongNameCommand = Get-Command sn.exe -CommandType Application -ErrorAction SilentlyContinue |
+        Select-Object -First 1
+
+    if ($null -ne $strongNameCommand) {
+        $strongNameTool = Get-Item -LiteralPath $strongNameCommand.Path
+    }
+    else {
+        $windowsSdkRoot = Join-Path ${env:ProgramFiles(x86)} 'Microsoft SDKs\Windows'
+        $strongNameTool = Get-ChildItem -Path $windowsSdkRoot -Filter 'sn.exe' -Recurse -ErrorAction SilentlyContinue |
+            Sort-Object -Property @{
+                Expression = {
+                    $match = [regex]::Match($_.FullName, '\\v(?<version>\d+(?:\.\d+)*)A?\\', 'IgnoreCase')
+                    if ($match.Success) { [version]$match.Groups['version'].Value } else { [version]'0.0' }
+                }
+                Descending = $true
+            }, @{
+                Expression = { $_.FullName }
+                Descending = $true
+            } |
+            Select-Object -First 1
+    }
+}
+
+if ($null -eq $strongNameTool) {
+    throw 'Could not find sn.exe on PATH or under the Windows SDK directory. Pass -SnPath explicitly.'
+}
+
+Write-Verbose "Using sn.exe from '$($strongNameTool.FullName)'."
+
+$assemblies = @(Get-ChildItem -Path $Path -Filter '*.dll' -Recurse -File)
+if ($assemblies.Count -eq 0) {
+    throw "No assemblies were found under '$($Path -join ', ')'. Refusing to report success."
+}
+
+$problems = @()
+foreach ($assembly in $assemblies) {
+    $output = & $strongNameTool.FullName -vf $assembly.FullName
+    if ($LASTEXITCODE -ne 0) {
+        $problems += "$($assembly.FullName): strong-name verification failed. $(($output | Where-Object { $_ }) -join ' ')"
+        continue
+    }
+
+    $assemblyName = [System.Reflection.AssemblyName]::GetAssemblyName($assembly.FullName)
+    $token = $assemblyName.GetPublicKeyToken()
+    if ($null -eq $token -or $token.Length -eq 0) {
+        $problems += "$($assembly.FullName): not strong named."
+        continue
+    }
+
+    $actualToken = ConvertTo-HexString $token
+    if ($actualToken -ne $expectedToken) {
+        $problems += "$($assembly.FullName): public key token is $actualToken, expected $expectedToken."
+        continue
+    }
+
+    # Best effort: the token is a truncated hash, so compare the whole key when it is available.
+    $publicKey = $assemblyName.GetPublicKey()
+    if ($null -ne $publicKey -and $publicKey.Length -gt 0) {
+        $actualPublicKey = ConvertTo-HexString $publicKey
+        if ($actualPublicKey -ne $expectedPublicKeyHex) {
+            $problems += "$($assembly.FullName): public key does not match $ExpectedPublicKeyPath despite a matching token."
+        }
+    }
+}
+
+if ($problems.Count -gt 0) {
+    throw "Strong-name validation failed:`n$($problems -join "`n")"
+}
+
+Write-Host "Verified $($assemblies.Count) assemblies against public key token $expectedToken."

.github/scripts/Assert-AuthenticodeSignature.ps1

@@ -0,0 +1,77 @@
+<#
+.SYNOPSIS
+    Verifies that every assembly under the given path is Authenticode signed by an approved certificate.
+
+.DESCRIPTION
+    A valid Authenticode signature only proves that *someone* signed the file. This script additionally
+    requires the signer certificate's SHA-256 fingerprint to appear in a list pinned in the repository,
+    so a signature produced with any other certificate is rejected rather than trusted.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)]
+    [string[]]$Path,
+
+    [Parameter(Mandatory)]
+    [string]$ExpectedCertificateSha256Path,
+
+    [string]$SummaryPath = $env:GITHUB_STEP_SUMMARY
+)
+
+$ErrorActionPreference = 'Stop'
+
+if (-not (Test-Path -LiteralPath $ExpectedCertificateSha256Path -PathType Leaf)) {
+    throw "Pinned certificate fingerprint file not found: $ExpectedCertificateSha256Path"
+}
+
+$allowedFingerprints = @(
+    Get-Content -LiteralPath $ExpectedCertificateSha256Path |
+        ForEach-Object { $_.Trim().ToUpperInvariant() } |
+        Where-Object { $_ -and -not $_.StartsWith('#') }
+)
+
+# A blank or malformed pin must fail loudly; otherwise the whole check silently becomes a no-op.
+if ($allowedFingerprints.Count -eq 0 -or @($allowedFingerprints | Where-Object { $_ -notmatch '^[0-9A-F]{64}$' }).Count -gt 0) {
+    throw "$ExpectedCertificateSha256Path must contain at least one valid SHA-256 certificate fingerprint."
+}
+
+$assemblies = @(Get-ChildItem -Path $Path -Filter '*.dll' -Recurse -File)
+if ($assemblies.Count -eq 0) {
+    throw "No DLLs were found under '$($Path -join ', ')'. Refusing to report success."
+}
+
+$problems = @()
+$fingerprints = @{}
+$signerNames = @{}
+foreach ($assembly in $assemblies) {
+    $signature = Get-AuthenticodeSignature -LiteralPath $assembly.FullName
+    if ($signature.Status -ne 'Valid') {
+        $problems += "$($assembly.FullName): signature status $($signature.Status)."
+        continue
+    }
+
+    $fingerprint = [Convert]::ToHexString(
+        [System.Security.Cryptography.SHA256]::HashData($signature.SignerCertificate.RawData)
+    )
+    if ($fingerprint -notin $allowedFingerprints) {
+        $problems += "$($assembly.FullName): certificate SHA-256 fingerprint $fingerprint is not approved by '$ExpectedCertificateSha256Path'."
+        continue
+    }
+
+    $fingerprints[$fingerprint] = $true
+    $signerNames[$signature.SignerCertificate.GetNameInfo('SimpleName', $false)] = $true
+}
+
+if ($problems.Count -gt 0) {
+    throw "Authenticode validation failed:`n$($problems -join "`n")"
+}
+
+Write-Host "All $($assemblies.Count) DLLs signed by an approved certificate."
+
+if ($SummaryPath) {
+    @(
+        '### Authenticode signer',
+        "- Subject CN: $($signerNames.Keys -join ', ')",
+        "- SHA-256 fingerprint: $($fingerprints.Keys -join ', ')"
+    ) | Add-Content -LiteralPath $SummaryPath
+}

.github/scripts/Assert-CycloneDxSbom.ps1

@@ -0,0 +1,66 @@
+<#
+.SYNOPSIS
+    Verifies the merged CycloneDX document describes both the .NET and npm halves of the shipped package.
+
+.DESCRIPTION
+    Checks the structural fields actions/attest requires, and specifically that at least one nuget- and
+    one npm-ecosystem component are present. That is the concrete regression this guards against: a merge
+    failure that still produces a valid-looking, structurally sound, but incomplete document. License and
+    author coverage are reported as warnings only, same as the SPDX side - NOASSERTION/missing is a valid
+    value, not something this tool can require otherwise.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)]
+    [string]$BomPath,
+
+    [ValidateRange(0, 1)]
+    [double]$MinimumLicenseCoverage = 0.9
+)
+
+$ErrorActionPreference = 'Stop'
+
+if (-not (Test-Path -LiteralPath $BomPath -PathType Leaf)) {
+    throw "CycloneDX document not found: $BomPath"
+}
+
+$bom = Get-Content -LiteralPath $BomPath -Raw | ConvertFrom-Json
+
+# actions/attest only recognises a CycloneDX document that carries all three of these.
+foreach ($required in 'bomFormat', 'specVersion', 'serialNumber') {
+    if (-not $bom.$required) {
+        throw "CycloneDX document is missing '$required', so it cannot be consumed as an SBOM predicate."
+    }
+}
+
+$components = @($bom.components)
+if ($components.Count -eq 0) {
+    throw 'CycloneDX document contains no components.'
+}
+
+$nugetComponents = @($components | Where-Object { $_.purl -like 'pkg:nuget/*' })
+$npmComponents = @($components | Where-Object { $_.purl -like 'pkg:npm/*' })
+
+if ($nugetComponents.Count -eq 0) {
+    throw 'Merged CycloneDX document contains no pkg:nuget components; the .NET BOM appears to be missing from the merge.'
+}
+if ($npmComponents.Count -eq 0) {
+    throw 'Merged CycloneDX document contains no pkg:npm components; the npm BOM appears to be missing from the merge.'
+}
+
+$licensed = @($components | Where-Object { $_.licenses })
+# CycloneDX models 'authors' (people) and 'supplier' (an organisation) separately; cyclonedx-dotnet only
+# ever populates the former, so this is reported as author coverage.
+$authored = @($components | Where-Object { $_.authors })
+$coverage = $licensed.Count / $components.Count
+
+Write-Host "CycloneDX $($bom.specVersion): $($components.Count) components ($($nugetComponents.Count) NuGet, $($npmComponents.Count) npm), $($licensed.Count) licensed, $($authored.Count) with an author."
+
+if ($coverage -lt $MinimumLicenseCoverage) {
+    $unlicensed = @($components | Where-Object { -not $_.licenses } | ForEach-Object { "$($_.name)@$($_.version)" })
+    Write-Warning "Only $([math]::Round($coverage * 100))% of components carry a licence (threshold $([math]::Round($MinimumLicenseCoverage * 100))%). Unresolved: $($unlicensed -join ', ')"
+}
+
+$checksum = (Get-FileHash -LiteralPath $BomPath -Algorithm SHA256).Hash.ToLowerInvariant()
+Set-Content -LiteralPath "$BomPath.sha256" -Value $checksum -NoNewline
+Write-Host "Wrote checksum sidecar $BomPath.sha256."

.github/scripts/Assert-NuGetSignature.ps1

@@ -0,0 +1,46 @@
+<#
+.SYNOPSIS
+    Verifies that a NuGet package is signed by an approved certificate.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)]
+    [string]$PackagePath,
+
+    [Parameter(Mandatory)]
+    [string]$ExpectedCertificateSha256Path
+)
+
+$ErrorActionPreference = 'Stop'
+$PSNativeCommandUseErrorActionPreference = $false
+
+if (-not (Test-Path -LiteralPath $PackagePath -PathType Leaf)) {
+    throw "NuGet package not found: $PackagePath"
+}
+
+if (-not (Test-Path -LiteralPath $ExpectedCertificateSha256Path -PathType Leaf)) {
+    throw "Pinned certificate fingerprint file not found: $ExpectedCertificateSha256Path"
+}
+
+$allowedFingerprints = @(
+    Get-Content -LiteralPath $ExpectedCertificateSha256Path |
+        ForEach-Object { $_.Trim().ToUpperInvariant() } |
+        Where-Object { $_ -and -not $_.StartsWith('#') }
+)
+
+if ($allowedFingerprints.Count -eq 0 -or @($allowedFingerprints | Where-Object { $_ -notmatch '^[0-9A-F]{64}$' }).Count -gt 0) {
+    throw "$ExpectedCertificateSha256Path must contain at least one valid SHA-256 certificate fingerprint."
+}
+
+$verifyArguments = @('nuget', 'verify', $PackagePath, '--all')
+foreach ($fingerprint in $allowedFingerprints) {
+    $verifyArguments += @('--certificate-fingerprint', $fingerprint)
+}
+$verifyArguments += @('--verbosity', 'quiet')
+
+& dotnet @verifyArguments
+if ($LASTEXITCODE -ne 0) {
+    throw "NuGet signature validation failed or the signer is not approved by '$ExpectedCertificateSha256Path'."
+}
+
+Write-Host "NuGet package signature matches an approved certificate."

.github/scripts/Assert-PackageSignatures.ps1

@@ -0,0 +1,46 @@
+<#
+.SYNOPSIS
+    Verifies the strong-name and Authenticode signatures of the assemblies inside a packed NuGet package.
+
+.DESCRIPTION
+    Packing does not sign or rebuild; -no-build just re-zips whatever bin/ output is on disk. The prior
+    jobs validate that loose output directly, but that is not proof the packed nupkg contains those exact
+    bytes. This extracts the package that will actually ship and re-runs both checks against those bytes
+    in a single extraction, so a pack step that picked up a stale or substituted DLL is caught either way,
+    not just on the weaker (SHA-1 strong-name) signal.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)]
+    [string]$PackagePath,
+
+    [Parameter(Mandatory)]
+    [string]$ExpectedPublicKeyPath,
+
+    [Parameter(Mandatory)]
+    [string]$ExpectedCertificateSha256Path,
+
+    [string]$WorkingDirectory = (Join-Path ([System.IO.Path]::GetTempPath()) 'package-signature-validation')
+)
+
+$ErrorActionPreference = 'Stop'
+
+if (-not (Test-Path -LiteralPath $PackagePath -PathType Leaf)) {
+    throw "NuGet package not found: $PackagePath"
+}
+
+$extractPath = Join-Path $WorkingDirectory 'package'
+# Expand-Archive only accepts .zip, so the package is copied under a name it will open.
+$archivePath = Join-Path $WorkingDirectory 'package.zip'
+
+try {
+    New-Item -ItemType Directory -Path $WorkingDirectory -Force | Out-Null
+    Copy-Item -LiteralPath $PackagePath -Destination $archivePath -Force
+    Expand-Archive -LiteralPath $archivePath -DestinationPath $extractPath -Force
+
+    & (Join-Path $PSScriptRoot 'Assert-AssemblyStrongName.ps1') -Path $extractPath -ExpectedPublicKeyPath $ExpectedPublicKeyPath
+    & (Join-Path $PSScriptRoot 'Assert-AuthenticodeSignature.ps1') -Path $extractPath -ExpectedCertificateSha256Path $ExpectedCertificateSha256Path
+}
+finally {
+    Remove-Item -LiteralPath $WorkingDirectory -Recurse -Force -ErrorAction SilentlyContinue
+}