From 8dc6145e935347014c5c400bc2bdd6fc8a0528ab Mon Sep 17 00:00:00 2001 From: Luiz Henrique Cassettari Date: Wed, 4 Dec 2024 19:36:01 -0300 Subject: [PATCH] Add `NuGetKeyVaultSignTool` (#1485) --- .../NuGetKeyVaultSignTool.Generated.cs | 254 ++++++++++++++++++ .../NuGetKeyVaultSignTool.json | 113 ++++++++ 2 files changed, 367 insertions(+) create mode 100644 source/Nuke.Common/Tools/NuGetKeyVaultSignTool/NuGetKeyVaultSignTool.Generated.cs create mode 100644 source/Nuke.Common/Tools/NuGetKeyVaultSignTool/NuGetKeyVaultSignTool.json diff --git a/source/Nuke.Common/Tools/NuGetKeyVaultSignTool/NuGetKeyVaultSignTool.Generated.cs b/source/Nuke.Common/Tools/NuGetKeyVaultSignTool/NuGetKeyVaultSignTool.Generated.cs new file mode 100644 index 000000000..d855bad5f --- /dev/null +++ b/source/Nuke.Common/Tools/NuGetKeyVaultSignTool/NuGetKeyVaultSignTool.Generated.cs @@ -0,0 +1,254 @@ + +using JetBrains.Annotations; +using Newtonsoft.Json; +using Nuke.Common; +using Nuke.Common.Tooling; +using Nuke.Common.Tools; +using Nuke.Common.Utilities.Collections; +using System; +using System.Collections.Generic; +using System.Collections.ObjectModel; +using System.ComponentModel; +using System.Diagnostics.CodeAnalysis; +using System.IO; +using System.Linq; +using System.Text; + +namespace Nuke.Common.Tools.NuGetKeyVaultSignTool; + +///

NuGet Key Vault Sign Tool is similar to nuget sign, with the major difference being that it uses Azure Key Vault for performing the signing process. Similar usage configuration like AzureSignTool, except is used to sign nuget package.

For more details, visit the official website.

 +[PublicAPI] +[ExcludeFromCodeCoverage] +[NuGetTool(Id = PackageId, Executable = PackageExecutable)] +public partial class NuGetKeyVaultSignToolTasks : ToolTasks, IRequireNuGetPackage +{ + public static string NuGetKeyVaultSignToolPath => new NuGetKeyVaultSignToolTasks().GetToolPath(); + public const string PackageId = "NuGetKeyVaultSignTool"; + public const string PackageExecutable = "NuGetKeyVaultSignTool.dll"; + ///

NuGet Key Vault Sign Tool is similar to nuget sign, with the major difference being that it uses Azure Key Vault for performing the signing process. Similar usage configuration like AzureSignTool, except is used to sign nuget package.

For more details, visit the official website.

 + public static IReadOnlyCollection NuGetKeyVaultSignTool(ArgumentStringHandler arguments, string workingDirectory = null, IReadOnlyDictionary environmentVariables = null, int? timeout = null, bool? logOutput = null, bool? logInvocation = null, Action logger = null, Func exitHandler = null) => new NuGetKeyVaultSignToolTasks().Run(arguments, workingDirectory, environmentVariables, timeout, logOutput, logInvocation, logger, exitHandler); + ///

NuGet Key Vault Sign Tool is similar to nuget sign, with the major difference being that it uses Azure Key Vault for performing the signing process. Similar usage configuration like AzureSignTool, except is used to sign nuget package.

For more details, visit the official website.

 + ///

This is a CLI wrapper with fluent API that allows to modify the following arguments:

  • <file> via
  • --azure-key-vault-accesstoken via
  • --azure-key-vault-certificate via
  • --azure-key-vault-client-id via
  • --azure-key-vault-client-secret via
  • --azure-key-vault-managed-identity via
  • --azure-key-vault-tenant-id via
  • --azure-key-vault-url via
  • --file-digest via
  • --force via
  • --output via
  • --timestamp-digest via
  • --timestamp-rfc3161 via
+ public static IReadOnlyCollection NuGetKeyVaultSignTool(NuGetKeyVaultSignToolSettings options = null) => new NuGetKeyVaultSignToolTasks().Run(options); + ///

NuGet Key Vault Sign Tool is similar to nuget sign, with the major difference being that it uses Azure Key Vault for performing the signing process. Similar usage configuration like AzureSignTool, except is used to sign nuget package.

For more details, visit the official website.

 + ///

This is a CLI wrapper with fluent API that allows to modify the following arguments:

  • <file> via
  • --azure-key-vault-accesstoken via
  • --azure-key-vault-certificate via
  • --azure-key-vault-client-id via
  • --azure-key-vault-client-secret via
  • --azure-key-vault-managed-identity via
  • --azure-key-vault-tenant-id via
  • --azure-key-vault-url via
  • --file-digest via
  • --force via
  • --output via
  • --timestamp-digest via
  • --timestamp-rfc3161 via
+ public static IReadOnlyCollection NuGetKeyVaultSignTool(Configure configurator) => new NuGetKeyVaultSignToolTasks().Run(configurator.Invoke(new NuGetKeyVaultSignToolSettings())); + ///

NuGet Key Vault Sign Tool is similar to nuget sign, with the major difference being that it uses Azure Key Vault for performing the signing process. Similar usage configuration like AzureSignTool, except is used to sign nuget package.

For more details, visit the official website.

 + ///

This is a CLI wrapper with fluent API that allows to modify the following arguments:

  • <file> via
  • --azure-key-vault-accesstoken via
  • --azure-key-vault-certificate via
  • --azure-key-vault-client-id via
  • --azure-key-vault-client-secret via
  • --azure-key-vault-managed-identity via
  • --azure-key-vault-tenant-id via
  • --azure-key-vault-url via
  • --file-digest via
  • --force via
  • --output via
  • --timestamp-digest via
  • --timestamp-rfc3161 via
+ public static IEnumerable<(NuGetKeyVaultSignToolSettings Settings, IReadOnlyCollection Output)> NuGetKeyVaultSignTool(CombinatorialConfigure configurator, int degreeOfParallelism = 1, bool completeOnFailure = false) => configurator.Invoke(NuGetKeyVaultSignTool, degreeOfParallelism, completeOnFailure); +} +#region NuGetKeyVaultSignToolSettings +/// Used within . +[PublicAPI] +[ExcludeFromCodeCoverage] +[Command(Type = typeof(NuGetKeyVaultSignToolTasks), Command = nameof(NuGetKeyVaultSignToolTasks.NuGetKeyVaultSignTool), Arguments = "sign")] +public partial class NuGetKeyVaultSignToolSettings : ToolOptions +{ + /// Package to sign. + [Argument(Format = "{value}")] public string File => Get(() => File); + /// A fully qualified URL of the key vault with the certificate that will be used for signing. An example value might be https://my-vault.vault.azure.net. + [Argument(Format = "--azure-key-vault-url {value}", Secret = false)] public string KeyVaultUrl => Get(() => KeyVaultUrl); + /// This is the client ID used to authenticate to Azure, which will be used to generate an access token. This parameter is not required if an access token is supplied directly with the --azure-key-vault-accesstoken option. If this parameter is supplied, --azure-key-vault-client-secret and --azure-key-vault-tenant-id must be supplied as well. + [Argument(Format = "--azure-key-vault-client-id {value}", Secret = false)] public string KeyVaultClientId => Get(() => KeyVaultClientId); + /// This is the client secret used to authenticate to Azure, which will be used to generate an access token. This parameter is not required if an access token is supplied directly with the --azure-key-vault-accesstoken option or when using managed identities with --azure-key-vault-managed-identity. If this parameter is supplied, --azure-key-vault-client-id and --azure-key-vault-tenant-id must be supplied as well. + [Argument(Format = "--azure-key-vault-client-secret {value}", Secret = true)] public string KeyVaultClientSecret => Get(() => KeyVaultClientSecret); + /// This is the tenant id used to authenticate to Azure, which will be used to generate an access token. This parameter is not required if an access token is supplied directly with the --azure-key-vault-accesstoken option or when using managed identities with --azure-key-vault-managed-identity. If this parameter is supplied, --azure-key-vault-client-id and --azure-key-vault-client-secret must be supplied as well. + [Argument(Format = "--azure-key-vault-tenant-id {value}", Secret = false)] public string KeyVaultTenantId => Get(() => KeyVaultTenantId); + /// The name of the certificate used to perform the signing operation. + [Argument(Format = "--azure-key-vault-certificate {value}", Secret = false)] public string KeyVaultCertificateName => Get(() => KeyVaultCertificateName); + /// An access token used to authenticate to Azure. This can be used instead of the --azure-key-vault-managed-identity, --azure-key-vault-client-id and --azure-key-vault-client-secret options. This is useful if NuGetKeyVaultSignTool is being used as part of another program that is already authenticated and has an access token to Azure. + [Argument(Format = "--azure-key-vault-accesstoken {value}", Secret = true)] public string KeyVaultAccessToken => Get(() => KeyVaultAccessToken); + /// Use the ambient Managed Identity to authenticate to Azure. This can be used instead of the --azure-key-vault-accesstoken, --azure-key-vault-client-id and --azure-key-vault-client-secret options. This is useful if NuGetKeyVaultSignTool is being used on a VM/service/CLI that is configured for managed identities to Azure. + [Argument(Format = "--azure-key-vault-managed-identity", Secret = false)] public bool? KeyVaultManagedIdentity => Get(() => KeyVaultManagedIdentity); + /// A URL to an RFC3161 compliant timestamping service. This parameter serves the same purpose as the /tr option in the Windows SDK signtool. This parameter should be used in favor of the --timestamp option. Using this parameter will allow using modern, RFC3161 timestamps which also support timestamp digest algorithms other than SHA1. + [Argument(Format = "--timestamp-rfc3161 {value}")] public string TimestampRfc3161Url => Get(() => TimestampRfc3161Url); + /// The name of the digest algorithm used for timestamping. This parameter is ignored unless the --timestamp-rfc3161 parameter is also supplied. The default value is sha256. + [Argument(Format = "--timestamp-digest {value}")] public NuGetKeyVaultSignToolDigestAlgorithm TimestampDigest => Get(() => TimestampDigest); + /// The name of the digest algorithm used for hashing the file being signed. The default value is sha256. + [Argument(Format = "--file-digest {value}")] public NuGetKeyVaultSignToolDigestAlgorithm FileDigest => Get(() => FileDigest); + /// Overwrites a signature if it exists. + [Argument(Format = "--force")] public bool? Force => Get(() => Force); + /// The output file. If omitted, overwrites input. + [Argument(Format = "--output {value}")] public string Output => Get(() => Output); +} +#endregion +#region NuGetKeyVaultSignToolSettingsExtensions +/// Used within . +[PublicAPI] +[ExcludeFromCodeCoverage] +public static partial class NuGetKeyVaultSignToolSettingsExtensions +{ + #region File + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.File))] + public static T SetFile(this T o, string v) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.File, v)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.File))] + public static T ResetFile(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Remove(() => o.File)); + #endregion + #region KeyVaultUrl + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultUrl))] + public static T SetKeyVaultUrl(this T o, string v) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.KeyVaultUrl, v)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultUrl))] + public static T ResetKeyVaultUrl(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Remove(() => o.KeyVaultUrl)); + #endregion + #region KeyVaultClientId + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultClientId))] + public static T SetKeyVaultClientId(this T o, string v) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.KeyVaultClientId, v)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultClientId))] + public static T ResetKeyVaultClientId(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Remove(() => o.KeyVaultClientId)); + #endregion + #region KeyVaultClientSecret + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultClientSecret))] + public static T SetKeyVaultClientSecret(this T o, [Secret] string v) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.KeyVaultClientSecret, v)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultClientSecret))] + public static T ResetKeyVaultClientSecret(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Remove(() => o.KeyVaultClientSecret)); + #endregion + #region KeyVaultTenantId + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultTenantId))] + public static T SetKeyVaultTenantId(this T o, string v) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.KeyVaultTenantId, v)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultTenantId))] + public static T ResetKeyVaultTenantId(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Remove(() => o.KeyVaultTenantId)); + #endregion + #region KeyVaultCertificateName + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultCertificateName))] + public static T SetKeyVaultCertificateName(this T o, string v) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.KeyVaultCertificateName, v)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultCertificateName))] + public static T ResetKeyVaultCertificateName(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Remove(() => o.KeyVaultCertificateName)); + #endregion + #region KeyVaultAccessToken + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultAccessToken))] + public static T SetKeyVaultAccessToken(this T o, [Secret] string v) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.KeyVaultAccessToken, v)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultAccessToken))] + public static T ResetKeyVaultAccessToken(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Remove(() => o.KeyVaultAccessToken)); + #endregion + #region KeyVaultManagedIdentity + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultManagedIdentity))] + public static T SetKeyVaultManagedIdentity(this T o, bool? v) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.KeyVaultManagedIdentity, v)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultManagedIdentity))] + public static T ResetKeyVaultManagedIdentity(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Remove(() => o.KeyVaultManagedIdentity)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultManagedIdentity))] + public static T EnableKeyVaultManagedIdentity(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.KeyVaultManagedIdentity, true)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultManagedIdentity))] + public static T DisableKeyVaultManagedIdentity(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.KeyVaultManagedIdentity, false)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.KeyVaultManagedIdentity))] + public static T ToggleKeyVaultManagedIdentity(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.KeyVaultManagedIdentity, !o.KeyVaultManagedIdentity)); + #endregion + #region TimestampRfc3161Url + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.TimestampRfc3161Url))] + public static T SetTimestampRfc3161Url(this T o, string v) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.TimestampRfc3161Url, v)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.TimestampRfc3161Url))] + public static T ResetTimestampRfc3161Url(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Remove(() => o.TimestampRfc3161Url)); + #endregion + #region TimestampDigest + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.TimestampDigest))] + public static T SetTimestampDigest(this T o, NuGetKeyVaultSignToolDigestAlgorithm v) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.TimestampDigest, v)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.TimestampDigest))] + public static T ResetTimestampDigest(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Remove(() => o.TimestampDigest)); + #endregion + #region FileDigest + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.FileDigest))] + public static T SetFileDigest(this T o, NuGetKeyVaultSignToolDigestAlgorithm v) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.FileDigest, v)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.FileDigest))] + public static T ResetFileDigest(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Remove(() => o.FileDigest)); + #endregion + #region Force + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.Force))] + public static T SetForce(this T o, bool? v) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.Force, v)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.Force))] + public static T ResetForce(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Remove(() => o.Force)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.Force))] + public static T EnableForce(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.Force, true)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.Force))] + public static T DisableForce(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.Force, false)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.Force))] + public static T ToggleForce(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.Force, !o.Force)); + #endregion + #region Output + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.Output))] + public static T SetOutput(this T o, string v) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Set(() => o.Output, v)); + /// + [Pure] + [Builder(Type = typeof(NuGetKeyVaultSignToolSettings), Property = nameof(NuGetKeyVaultSignToolSettings.Output))] + public static T ResetOutput(this T o) where T : NuGetKeyVaultSignToolSettings => o.Modify(b => b.Remove(() => o.Output)); + #endregion +} +#endregion +#region NuGetKeyVaultSignToolDigestAlgorithm +/// Used within . +[PublicAPI] +[Serializable] +[ExcludeFromCodeCoverage] +[TypeConverter(typeof(TypeConverter))] +public partial class NuGetKeyVaultSignToolDigestAlgorithm : Enumeration +{ + public static NuGetKeyVaultSignToolDigestAlgorithm sha1 = (NuGetKeyVaultSignToolDigestAlgorithm)"sha1"; + public static NuGetKeyVaultSignToolDigestAlgorithm sha256 = (NuGetKeyVaultSignToolDigestAlgorithm)"sha256"; + public static NuGetKeyVaultSignToolDigestAlgorithm sha384 = (NuGetKeyVaultSignToolDigestAlgorithm)"sha384"; + public static NuGetKeyVaultSignToolDigestAlgorithm sha512 = (NuGetKeyVaultSignToolDigestAlgorithm)"sha512"; + public static implicit operator NuGetKeyVaultSignToolDigestAlgorithm(string value) + { + return new NuGetKeyVaultSignToolDigestAlgorithm { Value = value }; + } +} +#endregion diff --git a/source/Nuke.Common/Tools/NuGetKeyVaultSignTool/NuGetKeyVaultSignTool.json b/source/Nuke.Common/Tools/NuGetKeyVaultSignTool/NuGetKeyVaultSignTool.json new file mode 100644 index 000000000..7ad5acd60 --- /dev/null +++ b/source/Nuke.Common/Tools/NuGetKeyVaultSignTool/NuGetKeyVaultSignTool.json @@ -0,0 +1,113 @@ +{ + "$schema": "https://raw.githubusercontent.com/nuke-build/nuke/master/source/Nuke.Tooling.Generator/schema.json", + "name": "NuGetKeyVaultSignTool", + "officialUrl": "https://github.com/novotnyllc/NuGetKeyVaultSignTool", + "help": "NuGet Key Vault Sign Tool is similar to nuget sign, with the major difference being that it uses Azure Key Vault for performing the signing process. Similar usage configuration like AzureSignTool, except is used to sign nuget package.", + "nugetPackageId": "NuGetKeyVaultSignTool", + "packageExecutable": "NuGetKeyVaultSignTool.dll", + "tasks": [ + { + "definiteArgument": "sign", + "settingsClass": { + "properties": [ + { + "name": "File", + "type": "string", + "format": "{value}", + "help": "Package to sign." + }, + { + "name": "KeyVaultUrl", + "type": "string", + "format": "--azure-key-vault-url {value}", + "secret": false, + "help": "A fully qualified URL of the key vault with the certificate that will be used for signing. An example value might be https://my-vault.vault.azure.net." + }, + { + "name": "KeyVaultClientId", + "type": "string", + "format": "--azure-key-vault-client-id {value}", + "secret": false, + "help": "This is the client ID used to authenticate to Azure, which will be used to generate an access token. This parameter is not required if an access token is supplied directly with the --azure-key-vault-accesstoken option. If this parameter is supplied, --azure-key-vault-client-secret and --azure-key-vault-tenant-id must be supplied as well." + }, + { + "name": "KeyVaultClientSecret", + "type": "string", + "format": "--azure-key-vault-client-secret {value}", + "secret": true, + "help": "This is the client secret used to authenticate to Azure, which will be used to generate an access token. This parameter is not required if an access token is supplied directly with the --azure-key-vault-accesstoken option or when using managed identities with --azure-key-vault-managed-identity. If this parameter is supplied, --azure-key-vault-client-id and --azure-key-vault-tenant-id must be supplied as well." + }, + { + "name": "KeyVaultTenantId", + "type": "string", + "format": "--azure-key-vault-tenant-id {value}", + "secret": false, + "help": "This is the tenant id used to authenticate to Azure, which will be used to generate an access token. This parameter is not required if an access token is supplied directly with the --azure-key-vault-accesstoken option or when using managed identities with --azure-key-vault-managed-identity. If this parameter is supplied, --azure-key-vault-client-id and --azure-key-vault-client-secret must be supplied as well." + }, + { + "name": "KeyVaultCertificateName", + "type": "string", + "format": "--azure-key-vault-certificate {value}", + "secret": false, + "help": "The name of the certificate used to perform the signing operation." + }, + { + "name": "KeyVaultAccessToken", + "type": "string", + "format": "--azure-key-vault-accesstoken {value}", + "secret": true, + "help": "An access token used to authenticate to Azure. This can be used instead of the --azure-key-vault-managed-identity, --azure-key-vault-client-id and --azure-key-vault-client-secret options. This is useful if NuGetKeyVaultSignTool is being used as part of another program that is already authenticated and has an access token to Azure." + }, + { + "name": "KeyVaultManagedIdentity", + "type": "bool", + "format": "--azure-key-vault-managed-identity", + "secret": false, + "help": "Use the ambient Managed Identity to authenticate to Azure. This can be used instead of the --azure-key-vault-accesstoken, --azure-key-vault-client-id and --azure-key-vault-client-secret options. This is useful if NuGetKeyVaultSignTool is being used on a VM/service/CLI that is configured for managed identities to Azure." + }, + { + "name": "TimestampRfc3161Url", + "type": "string", + "format": "--timestamp-rfc3161 {value}", + "help": "A URL to an RFC3161 compliant timestamping service. This parameter serves the same purpose as the /tr option in the Windows SDK signtool. This parameter should be used in favor of the --timestamp option. Using this parameter will allow using modern, RFC3161 timestamps which also support timestamp digest algorithms other than SHA1." + }, + { + "name": "TimestampDigest", + "type": "NuGetKeyVaultSignToolDigestAlgorithm", + "format": "--timestamp-digest {value}", + "help": "The name of the digest algorithm used for timestamping. This parameter is ignored unless the --timestamp-rfc3161 parameter is also supplied. The default value is sha256." + }, + { + "name": "FileDigest", + "type": "NuGetKeyVaultSignToolDigestAlgorithm", + "format": "--file-digest {value}", + "help": "The name of the digest algorithm used for hashing the file being signed. The default value is sha256." + }, + { + "name": "Force", + "type": "bool", + "format": "--force", + "help": "Overwrites a signature if it exists." + }, + { + "name": "Output", + "type": "string", + "format": "--output {value}", + "help": "The output file. If omitted, overwrites input." + } + ] + } + } + ], + "enumerations": [ + { + "name": "NuGetKeyVaultSignToolDigestAlgorithm", + "values": [ + "sha1", + "sha256", + "sha384", + "sha512" + ] + } + ] +}