ClickOnce EV code sign with USB HSM add support for EDCSA keys

Description

I am manually signing application manifest via mage.exe or mageui.exe. I have an EVCS from a CA issued on a USB HSM (Yubikey). signtool.exe has signed the executable correctly using the HSM. mage.exe is reporting “This certificate does not contain a private key” mageui.exe is asking for a Certificate file which I don’t have.

To Reproduce

Try and sign a manifest file using a USB HSM.

.\mage.exe -Sign "C:\my_app.exe.manifest" -csp "Microsoft Smart Card Key Storage Provider" -kc "9b5…" -CertHash "c15…"

Exceptions (if any)

“This certificate does not contain a private key”

Configuration

C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8.1 Tools>

Other information

I have a ticket open with Visual Studio here: https://developercommunity.visualstudio.com/t/ClickOnce-EV-Signing-with-HSM/10278648

I can use signtool to successfully use the HSM for EVCS. This works and I just need mage to do the same. I run the following in PowerShell which prompts for PIN and works perfectly:

cd "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64"
.\signtool.exe sign /fd sha256 /tr http://ts.ssl.com /td sha256 /n "UniqueStringInMyCertificate" "C:\My.exe"

Some others have reverse engineered mage to get this working: https://stackoverflow.com/questions/54752638/mage-exe-manifest-signing-with-certificate-stored-in-aws-cloudhsm

I am happy to help give more feedback/troubleshooting to help resolve this issue. It is affecting many of our clients (today has been awful) as its been sitting triaged for 3 weeks in the other forum and this looks like the appropriate repo for mage. Thanks

[Tanya-Solyanik]

I see multiple potential issues here:

1. https://github.com/Microsoft/dotnet/issues/986#issuecomment-534970170 - add a code path that attempts to create an Exchange key if a Signature key wasn’t found.
2. Certificate is potentially using SHA384, which is not supported by the build task because SHA2 is hardcoded, even though providers might be available.

[Tanya-Solyanik]

@RhomGit thank you for the details. So your actual request is for mage and ClickOnce to support EDCSA. I’ll modify the bug title accordingly.