Azure.Developer.ArtifactSigning.CryptoProvider 0.1.69

Azure Artifact Signing CryptoProvider

The Azure Artifact Signing CryptoProvider is a .NET library that provides cryptographic signing capabilities using Azure Artifact Signing. It implements an RSA cryptographic provider that delegates signing operations to Azure, enabling secure code signing without exposing private keys locally.

Installation

dotnet add package Azure.Developer.ArtifactSigning.CryptoProvider

Or via the NuGet Package Manager:

Install-Package Azure.Developer.ArtifactSigning.CryptoProvider

Prerequisites

• An Azure subscription
• An Azure Artifact Signing account with a configured certificate profile
• Azure credentials (e.g., DefaultAzureCredential, ClientSecretCredential, etc.)

Quick Start

Basic Usage

using Azure.Developer.ArtifactSigning.CryptoProvider;
using Azure.Identity;

// Create credentials
var credential = new DefaultAzureCredential();

// Create the signing context
var context = new AzSignContext(
    tokenCredential: credential,
    accountName: "your-signing-account",
    certProfile: "your-certificate-profile",
    baseUrl: new Uri("https://your-region.codesigning.azure.net")
);

// Get the signing certificate
var signingCert = context.GetSigningCertificate();

// Get the full certificate chain
var certChain = context.GetCertChain();

// Sign a digest
byte[] digest = /* your digest bytes */;
byte[] signature = context.SignDigest(digest);

Using RSAAzSign for Signing Operations

using Azure.Developer.ArtifactSigning.CryptoProvider;
using System.Security.Cryptography;

// Create the RSA provider backed by Azure Artifact Signing
var rsaProvider = new RSAAzSign(context);

// Sign a hash
byte[] hash = SHA256.HashData(dataToSign);
byte[] signature = rsaProvider.SignHash(hash, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);

// Verify a signature
bool isValid = rsaProvider.VerifyHash(hash, signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);

With Authenticode Hashes

// For Authenticode signing scenarios
var rsaProvider = new RSAAzSign(context, fileHash: fileHashBytes, authenticodeHash: authenticodeHashBytes);

byte[] signature = rsaProvider.SignHash(tbsHash, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);

Configuring Options

using Azure.Developer.ArtifactSigning.CryptoProvider.Models;

// Configure retry and timeout behavior
var options = new AzSignContextOptions
{
    TaskRetryCount = 5,        // Number of retries (default: 3)
    TaskTimeOutInSeconds = 120  // Timeout in seconds (default: 60)
};

var context = new AzSignContext(
    tokenCredential: credential,
    accountName: "your-signing-account",
    certProfile: "your-certificate-profile",
    baseUrl: new Uri("https://your-region.codesigning.azure.net"),
    signContextOptions: options
);

Using an Existing CertificateProfileClient

using Azure.CodeSigning;

// If you already have a CertificateProfileClient instance
var cpClient = new CertificateProfileClient(/* your configuration */);

var context = new AzSignContext(
    accountName: "your-signing-account",
    certProfile: "your-certificate-profile",
    cpClient: cpClient
);

API Reference

AzSignContext

The main class for interacting with Azure Artifact Signing.

RSAAzSign

An RSA implementation that delegates signing to Azure Artifact Signing.

Documentation

• Azure Artifact Signing Documentation
• Azure Code Signing SDK

Contributing

See CONTRIBUTING.md for guidelines on contributing to this project.

Changelog

See CHANGELOG.md for version history and release notes.