Matt Mitchell

### To double check: * [ ] The right tests are in and the right validation has happened. Guidance: https://github.com/dotnet/arcade/blob/main/Documentation/Validation.md

SignCheck should be able to verify against a set of known subjects.

3

- [ ] This issue is blocking - [ ] This issue is causing unreasonable pain .NET uses its own signing signature (chained to the typical MS Authenticode cert) that...

Remove old source-build controls

3

Remove parameters and environment vars passed in VMR builds that activate old arcade source build control paths.

In case multiple builds match the same sha when building a dependency graph, and maestro doesn't know which is actually in use in the repo, it may be possible to...

Post build signing removal in release branches

1

- [ ] This issue is blocking - [ ] This issue is causing unreasonable pain Post-build signing should be turned off for 6.0 (and 7.0+). It complicates the process...

[darc/maestro++] Use webhooks for subscription updates

1

Rather than polling every 5 minutes or so, we should receive github webhooks to control subscription updates.

[darc/maestro++] Should use its own fork for GitHub updates

4

Darc should not push new branches to the main repo. It introduces a cleanup issue over time (if branches are not deleted) and increased number of refs.