Signing 3rd party library with Microsoft cert in UB build

[ellahathaway]

Public unified build builds are failing to sign an aspnetcore artifact with the following error:

##[error]artifacts/source-built-sdks/Microsoft.DotNet.Arcade.Sdk/tools/Sign.proj(76,5): error SIGN004: Signing 3rd party library '/__w/1/s/src/aspnetcore/artifacts/tmp/Release/ContainerSigning/1157/./shared/Microsoft.AspNetCore.App/10.0.0-ci/Microsoft.AspNetCore.App.Runtime.Composite.r2r.dll' with Microsoft certificate 'MicrosoftDotNet500'. The library is considered 3rd party library due to its copyright: ''.

Link to failure

[mmitche]

So this is normally a warning, it fires sometimes in sdk (where lots of crossgen happens).

[wtgodbe]

Why do the r2r images get considered 3rd party in the 1st place? Does SDK have a workaround for this already?

[mmitche]

They aren't managed images, but they sometimes kinda look like them. They don't have the copyright info.

I don't know if SDK has a workaround..or if it's just lucky, or if it's a warning that doesn't get converted to an error, etc. etc.

[mmitche]

dotnet/arcade#15852

[ellahathaway]

@mmitche - is there an updated status on this issue?

[mmitche]

Still unsolved. I have a PR open in arcade that can detect composite r2r binaries, but it uses a library that does not work in desktop msbuild.

[akoeplinger]

dotnet/arcade#15852 added a way to suppress the check.