Fix obsolete X509Certificate2 Errors (#14919)

dotnet · Jul 10, 2024 · 04cb1e3 · 04cb1e3
1 parent f20056d
commit 04cb1e3
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/src/Microsoft.DotNet.SignTool/src/VerifySignatures.cs b/src/Microsoft.DotNet.SignTool/src/VerifySignatures.cs
@@ -8,6 +8,7 @@
 using System.IO;
 using System.IO.Compression;
 using System.Linq;
+using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
 using System.Threading;
 
@@ -101,8 +102,18 @@ internal static bool IsDigitallySigned(string fullPath)
             X509Certificate2 certificate;
             try
             {
+                // We later suppress SYSLIB0057 because X509CertificateLoader does not handle authenticode inputs
+                // so we should verify that the certificate is authenticode before using X509Certificate2.CreateFromSignedFile
+                var certContentType = X509Certificate2.GetCertContentType(fullPath);
+                if (certContentType != X509ContentType.Authenticode)
+                {
+                    return false;
+                }
+
+                #pragma warning disable SYSLIB0057 // Suppress obsoletion warning for CreateFromSignedFile
                 X509Certificate signer = X509Certificate2.CreateFromSignedFile(fullPath);
                 certificate = new X509Certificate2(signer);
+                #pragma warning restore SYSLIB0057
             }
             catch (Exception)
             {