From 04cb1e3add386e77631c17e19bcccb9f4943e8b3 Mon Sep 17 00:00:00 2001
From: Ella Hathaway <67609881+ellahathaway@users.noreply.github.com>
Date: Wed, 10 Jul 2024 02:35:55 -0700
Subject: [PATCH] Fix obsolete X509Certificate2 Errors (#14919)

---
 src/Microsoft.DotNet.SignTool/src/VerifySignatures.cs | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/Microsoft.DotNet.SignTool/src/VerifySignatures.cs b/src/Microsoft.DotNet.SignTool/src/VerifySignatures.cs
index eaac742daea..c7bc3220eaf 100644
--- a/src/Microsoft.DotNet.SignTool/src/VerifySignatures.cs
+++ b/src/Microsoft.DotNet.SignTool/src/VerifySignatures.cs
@@ -8,6 +8,7 @@
 using System.IO;
 using System.IO.Compression;
 using System.Linq;
+using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
 using System.Threading;
 
@@ -101,8 +102,18 @@ internal static bool IsDigitallySigned(string fullPath)
             X509Certificate2 certificate;
             try
             {
+                // We later suppress SYSLIB0057 because X509CertificateLoader does not handle authenticode inputs
+                // so we should verify that the certificate is authenticode before using X509Certificate2.CreateFromSignedFile
+                var certContentType = X509Certificate2.GetCertContentType(fullPath);
+                if (certContentType != X509ContentType.Authenticode)
+                {
+                    return false;
+                }
+
+                #pragma warning disable SYSLIB0057 // Suppress obsoletion warning for CreateFromSignedFile
                 X509Certificate signer = X509Certificate2.CreateFromSignedFile(fullPath);
                 certificate = new X509Certificate2(signer);
+                #pragma warning restore SYSLIB0057
             }
             catch (Exception)
             {