dotnet
SignCheck should be able to verify against a set of known subjects.
- [ ] This issue is blocking
- [ ] This issue is causing unreasonable pain
.NET uses its own signing signature (chained to the typical MS Authenticode cert) that we use to sign most of our binaries. These certs have subject names that have meaning to certain tools like Defender. If these change, we want to know and contact the Defender team.
To know when we should perform such an action, I recommend that SignCheck be altered to verify the subject of all authenticode signed files against a known list. If the subject is not in that list, point to a document in Arcade.
@ellahathaway Mitchell mentioned that you may have completed this work already.
@ellahathaway Mitchell mentioned that you may have completed this work already.
I have not done this. My work with SignCheck’s authenticode validation has been about making it work on .NET Core.
