From 0277246919486344f2fb477263a226225d4dfe7e Mon Sep 17 00:00:00 2001
From: Jesus Zarate <jezarat@microsoft.com>
Date: Tue, 26 May 2026 16:57:59 -0600
Subject: [PATCH] Add 3PartySHA2 signing for Newtonsoft.Json.dll and
 PowerArgs.dll

These 3rd-party NuGet dependencies ship without Microsoft Authenticode
signatures. Adding FilesToSign entries so MicroBuild signs them with
3PartySHA2 before VSIX packaging.

Fixes VS signing scan violations in the mscredentialprovider payload.

Bug: https://devdiv.visualstudio.com/DevDiv/_workitems/edit/2991357
---
 .../CredentialProvider.Microsoft.csproj                        | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CredentialProvider.Microsoft/CredentialProvider.Microsoft.csproj b/CredentialProvider.Microsoft/CredentialProvider.Microsoft.csproj
index 34195cd5..e0f03de2 100644
--- a/CredentialProvider.Microsoft/CredentialProvider.Microsoft.csproj
+++ b/CredentialProvider.Microsoft/CredentialProvider.Microsoft.csproj
@@ -55,5 +55,8 @@
     <FilesToSign Include="$(OutDir)$(TargetFileName)" Authenticode="Microsoft400" StrongName="StrongName" />
     <FilesToSign Include="$(IntermediateOutputPath)$(TargetFileName)" Authenticode="Microsoft400" StrongName="StrongName" />
     <FilesToSign Include="$(IntermediateOutputPath)apphost.exe" Condition=" '$(UseAppHost)' == 'true' " Authenticode="Microsoft400" />
+    <!-- 3rd-party NuGet dependencies -->
+    <FilesToSign Include="$(OutDir)Newtonsoft.Json.dll" Authenticode="3PartySHA2" />
+    <FilesToSign Include="$(OutDir)PowerArgs.dll" Authenticode="3PartySHA2" />
   </ItemGroup>
 </Project>