Add assembly signing for Microsoft.Data.SqlClient.Internal.Logging

[paulmedynski]

What's This All About?

This is PR 2 of 6 in the assembly signing stack that builds on #4566.

The first 5 PRs in this stack are all about adding assembly signing and public-key-protected InternalsVisibleTo support to the legacy CI pipeline. This is infrastructure work necessary to support the Native AOT fix in the final PR.

We have never been including assembly signing in our CI, which IMO was a blind spot. Now, when CI runs in our internal ADO.Net project, all assemblies will be signed, we will be running tests against signed assemblies, and fully testing our nascent inter-assembly IVT just as it would be in a real app. Public project CI and all of our PR pipelines will continue to use unsigned assemblies, and testing that requires inter-assembly IVT will only be done in Project mode (PR, legacy CI Project-mode pipeline) or via internal CI with signed assemblies.

The 6th and final PR in the stack addresses the Native AOT issue #4193 by eliminating inter-assembly reflection and using signed IVT with proper package dependencies.

Description

This PR sets up assembly signing in the legacy CI pipeline for the Logging project. Microsoft.Data.SqlClient.Internal.Logging was not receiving SigningKeyPath when it was packed by the internal, Package-reference CI flow. As a result, that package could be produced without the strong-name signing applied to the other internal package artifacts. Internal Package-mode builds need a consistent set of signed assemblies; public builds and Project-reference builds should continue to build without access to the internal signing key.

This PR:

• threads isInternalBuild and referenceType through the CI core, Logging stage, and Logging pack job;
• reuses the download-assembly-signing-key.yml step introduced in Add assembly signing for Microsoft.SqlServer.Server #4566 to fetch the driver key for internal Package-reference builds only;
• passes SigningKeyPath when packing Microsoft.Data.SqlClient.Internal.Logging only for internal Package-reference builds; and
• leaves public and Project-reference builds unsigned and unchanged.

Supplying SigningKeyPath activates the existing signing behavior in src/Directory.Build.props; this PR does not change product source, public APIs, package contents beyond assembly signing, or compatibility behavior.

Issues

Works towards addressing #4193.

Testing

This is a pipeline-only change, so no unit or integration tests were added.

The GitHub PR validation pipelines exercise the public Package-reference and Project-reference paths. The internal signing branch requires the ADO.Net secure file and is exercised only by an internal Package-reference pipeline run.

CI pipeline runs

The GitHub PR pipelines never set isInternalBuild, so they always take the unsigned path. The CI runs below are what actually exercise this change, and together they cover all four quadrants of the signing matrix:

Project	Pipeline	Run	Reference mode	Signing expected
public	CI-SqlClient	23613	Project	No - public
public	CI-SqlClient-Package	23612	Package	No - public
ADO.Net	MDS Main CI	23605	Project	No - Project mode
ADO.Net	MDS Main CI-Package	23605	Package	Yes - internal + Package

The Build Logging Package stage succeeded in all four runs. The Download Driver Signing Key step is present in exactly one of them - MDS Main CI-Package - which is the only quadrant that is supposed to sign.

Artifact verification

The Logging.Artifacts package produced by each run was downloaded and inspected with tools/PackageValidator, which reads signing state from CLI metadata. It requires both a public key and the CorFlags.StrongNameSigned bit, so it distinguishes a fully signed assembly from a delay-signed one. Microsoft.Data.SqlClient.Internal.Logging ships a single netstandard2.0 target.

Run	Project	Mode	netstandard2.0	Public key token
CI-SqlClient 23613	public	Project	Unsigned	none
CI-SqlClient-Package 23612	public	Package	Unsigned	none
MDS Main CI 23605	ADO.Net	Project	Unsigned	none
MDS Main CI-Package 23605	ADO.Net	Package	Signed	23ec7fc2d6eaa4a5

Only the internal + Package quadrant is signed, it reports Signed rather than DelaySigned, and 23ec7fc2d6eaa4a5 is the SqlClient family public key token. PackageValidator's unsigned finding count across the four runs above is 1, 1, 1, and 0 respectively, dropping to zero only where signing is expected. All four runs also report one package-unsigned finding, which refers to NuGet package signing rather than assembly signing and is expected for CI-produced packages in every quadrant.

CI failures

The runs above report failures, but none are related to this change. All of them reproduce on main - CI-SqlClient-Package has failed on refs/heads/main in each of its last five runs with the same signature:

• test set 3 jobs hitting the 90 minute testJobTimeout across Win11, Win22, Ubuntu22, and Win11_ARM64;
• the macOS Configure SQL Server [macOS] step failing because the sql1 container dies during startup (sqlservr core dump), which in turn fails Publish Test Artifacts with a missing TestResults directory; and
• a handful of flaky manual tests, dominated by TransactionPoolTest.TransactionCleanupTest and DistributedTransactionTestWindows.Test_EnlistedTransactionPreservedWhilePooled (56 failures against 377,807 passes).

None of these touch strong naming, IVT, or packaging. The failed jobs have been retried.

[Copilot]

Pull request overview

Updates CI pipelines to strong-name sign the Microsoft.Data.SqlClient.Internal.Logging assembly during internal package builds.

Changes:

• Threads signing and internal-build parameters through pipeline templates.
• Downloads the secure signing key for internal package builds.
• Passes SigningKeyPath during package creation.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
eng/pipelines/stages/build-logging-package-ci-stage.yml	Forwards signing-related parameters.
eng/pipelines/jobs/pack-logging-package-ci-job.yml	Downloads the key and signs internal packages.
eng/pipelines/dotnet-sqlclient-ci-core.yml	Connects core pipeline parameters to the logging stage.

Suppressed comments (1)

eng/pipelines/jobs/pack-logging-package-ci-job.yml:132

• The linked PR metadata is not aligned with this change: issue #123 is about SQL Graph SqlBulkCopy column mappings and PR #456 is about large UDT buffers, neither of which concerns signing Microsoft.Data.SqlClient.Internal.Logging. Please replace these stale references with the relevant signing issue or remove them so the change remains traceable to the correct requirements.

            buildProperties: SqlClientPackageVersion=${{ parameters.packageVersion }};BuildNumber=$(Build.BuildNumber);SigningKeyPath=$(driverKeyFile.secureFilePath)

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.