Nefarius.Tools.SignRelay.MSBuild 1.0.0

Nefarius.Tools.SignRelay.MSBuild

MSBuild targets that call signrelay submit after Publish (opt-in). Keeps code-signing keys off the CI runner.

About

This package injects a SignRelaySign target into consuming projects. When enabled, it resolves files to sign (publish output preferred), invokes the signrelay global tool in-place, and records a stamp file so incremental builds do not re-submit.

Features

• Opt-in via SignRelayEnabled (default false — local builds never hit the network)
• Hooks after Publish by default (SignRelayAfterTargets)
• Prefers $(PublishDir)$(TargetFileName), falls back to $(TargetPath)
• Explicit <SignRelayFile> items for multi-file jobs
• Passes the CI token via SIGN_RELAY_CI_TOKEN (not --token on the process command line)
• Stamp-file incrementality under $(IntermediateOutputPath)

Limitations

• Requires the Nefarius.Tools.SignRelay global tool on PATH (or SignRelayToolPath)
• Signs in-place only (no --output directory mode from MSBuild)
• Ordering versus Pack / archive targets is your responsibility — pack after SignRelaySign if archives must contain signed binaries
• Does not install or update the global tool for you

Supported systems

Install

Pin the MSBuild package and the CLI tool to the same published version:

<ItemGroup>
  <PackageReference Include="Nefarius.Tools.SignRelay.MSBuild" Version="1.0.0" PrivateAssets="all" />
</ItemGroup>

dotnet tool install --global Nefarius.Tools.SignRelay --version 1.0.0

Check NuGet / releases for the version to pin. Do not use Version="*".

Enable (CI only)

Signing is off by default so local builds never hit the network.

export SIGN_RELAY_CI_TOKEN='…'   # must match SignRelay__CiToken on the server
dotnet publish -c Release \
  /p:SignRelayEnabled=true \
  /p:SignRelayServer=https://relay.example.com

You may set /p:SignRelayToken=... instead of the environment variable; the targets still forward the value into SIGN_RELAY_CI_TOKEN for the CLI process (it is not placed on the signrelay command line).

Properties

Items

<ItemGroup>
  <SignRelayFile Include="$(PublishDir)MyApp.exe" />
  <SignRelayFile Include="$(PublishDir)MyApp.dll" />
</ItemGroup>

Behavior

• Signs in-place (signrelay submit --in-place).
• Uses a stamp file under $(IntermediateOutputPath) so incremental builds do not re-submit after the binary was already signed.
• Ordering versus Pack / archive targets is your responsibility — run packing after SignRelaySign if archives must contain signed binaries.

Build prerequisites (contributors)

git clone https://github.com/nefarius/SignRelay.git
cd SignRelay
dotnet restore SignRelay.sln
dotnet pack src/SignRelay.MSBuild/SignRelay.MSBuild.csproj -c Release -o ./artifacts/nuget

Or via NUKE: ./build.sh PackMsBuild / .\build.ps1 PackMsBuild.

Support policy

• Use the SignRelay issue tracker for defects in these targets.
• Operational setup (relay, tokens, agent, proxies) is out of scope — read CI-INTEGRATION.md first.
• Incomplete reproductions may be closed.

Docs

• CI integration
• Deployment

License

MIT — Copyright (c) 2026 Benjamin Höglinger-Stelzer.

Legal / trademark notes

Windows, .NET, and other product names are trademarks of their respective owners. References here are for identification only.

Sources / credits

• Project: nefarius/SignRelay
• Companion CLI: Nefarius.Tools.SignRelay
• Versioning: MinVer