From 5ccd217aa86d5d60f376f425d216bc344de7787b Mon Sep 17 00:00:00 2001
From: Chuy Zarate <jezarat@microsoft.com>
Date: Mon, 27 Apr 2026 12:34:03 -0600
Subject: [PATCH 1/2] Add catalog signing for JS/XML content files

Generate .cat files covering all JS and XML content shipped in the
NodejsTools and TestAdapter VSIXes. This fixes VS signing compliance
for 32 unsigned files (31 .js + 1 .xml) flagged by the SignVerify scan.

- Add GenerateContentCatalog target in ProjectAfter.targets
- Add IncludeCatalogInVsix target to ship .cat in VSIX
- Update signWhiteList.txt to remove .js and .xml exclusions

Bug: https://devdiv.visualstudio.com/DevDiv/_workitems/edit/2982241
---
 Nodejs/Product/ProjectAfter.targets | 78 +++++++++++++++++++++++++++++
 signWhiteList.txt                   |  2 -
 2 files changed, 78 insertions(+), 2 deletions(-)

diff --git a/Nodejs/Product/ProjectAfter.targets b/Nodejs/Product/ProjectAfter.targets
index a9e1e97b5..1e38a5e43 100644
--- a/Nodejs/Product/ProjectAfter.targets
+++ b/Nodejs/Product/ProjectAfter.targets
@@ -8,4 +8,82 @@
       </FilesToSign>
     </ItemGroup>
   </Target>
+
+  <!--
+    Generate a catalog (.cat) file covering all JS and XML content shipped in the VSIX.
+    This satisfies VS signing compliance (SignVerify) for non-PE files that cannot carry
+    direct Authenticode signatures (template files users will modify, XML data files).
+    The .cat is signed with Microsoft400 by MicroBuild and included in the VSIX.
+  -->
+  <Target Name="GenerateContentCatalog"
+          AfterTargets="Build"
+          Condition="'$(CreateVsixContainer)' == 'true'">
+
+    <PropertyGroup>
+      <_CatBaseName>$(MSBuildProjectName)-content</_CatBaseName>
+      <_CdfFile>$(IntermediateOutputPath)$(_CatBaseName).cdf</_CdfFile>
+      <_CatFile>$(OutDir)$(_CatBaseName).cat</_CatFile>
+    </PropertyGroup>
+
+    <!-- Collect JS and XML files from the project's content/template output -->
+    <ItemGroup>
+      <!-- NodejsToolsVsix: project templates, item templates, and extras -->
+      <_CatalogSourceDir Condition="'$(MSBuildProjectName)' == 'NodejsToolsVsix'"
+                         Include="$(MSBuildThisFileDirectory)..\Nodejs\ProjectTemplates;$(MSBuildThisFileDirectory)..\Nodejs\Templates\Files;$(MSBuildThisFileDirectory)..\..\Extras" />
+      <!-- TestAdapterVsix: test framework scripts -->
+      <_CatalogSourceDir Condition="'$(MSBuildProjectName)' == 'TestAdapterVsix'"
+                         Include="$(MSBuildThisFileDirectory)..\TestAdapter\TestFrameworks" />
+    </ItemGroup>
+
+    <ItemGroup>
+      <_CatSourceFile Include="%(_CatalogSourceDir.Identity)\**\*.js" />
+      <_CatSourceFile Include="%(_CatalogSourceDir.Identity)\**\*.xml"
+                      Exclude="%(_CatalogSourceDir.Identity)\**\*.vstemplate" />
+    </ItemGroup>
+
+    <!-- Write CDF (Catalog Definition File) -->
+    <WriteLinesToFile File="$(_CdfFile)" Lines="[CatalogHeader]" Overwrite="true" />
+    <WriteLinesToFile File="$(_CdfFile)" Lines="Name=$(_CatBaseName).cat" />
+    <WriteLinesToFile File="$(_CdfFile)" Lines="ResultDir=$(OutDir)" />
+    <WriteLinesToFile File="$(_CdfFile)" Lines="CatalogVersion=2" />
+    <WriteLinesToFile File="$(_CdfFile)" Lines="HashAlgorithms=SHA256" />
+    <WriteLinesToFile File="$(_CdfFile)" Lines="" />
+    <WriteLinesToFile File="$(_CdfFile)" Lines="[CatalogFiles]" />
+    <WriteLinesToFile File="$(_CdfFile)" Lines="@(_CatSourceFile->'&lt;hash&gt;%(Filename)%(Extension)=%(FullPath)')" />
+
+    <MakeDir Directories="$(OutDir)" />
+    <Exec Command="makecat.exe &quot;$(_CdfFile)&quot;"
+          StandardOutputImportance="High"
+          IgnoreExitCode="true"
+          Condition="@(_CatSourceFile->Count()) > 0">
+      <Output TaskParameter="ExitCode" PropertyName="_MakecatExitCode" />
+    </Exec>
+
+    <Warning Text="makecat.exe not found or failed (exit code $(_MakecatExitCode)). Catalog file not generated. This is expected for local builds without the Windows SDK."
+             Condition="'$(_MakecatExitCode)' != '0' AND @(_CatSourceFile->Count()) > 0" />
+
+    <!-- Sign the .cat file -->
+    <ItemGroup Condition="Exists('$(_CatFile)')">
+      <FilesToSign Include="$(_CatFile)">
+        <Authenticode>Microsoft400</Authenticode>
+      </FilesToSign>
+    </ItemGroup>
+  </Target>
+
+  <!--
+    Include the signed .cat file in the VSIX container.
+    Runs after MicroBuild signing so the .cat is already signed.
+  -->
+  <Target Name="IncludeCatalogInVsix"
+          BeforeTargets="CreateVsixContainer"
+          Condition="'$(CreateVsixContainer)' == 'true'"
+          DependsOnTargets="GenerateContentCatalog">
+    <PropertyGroup>
+      <_CatBaseName>$(MSBuildProjectName)-content</_CatBaseName>
+      <_CatFile>$(OutDir)$(_CatBaseName).cat</_CatFile>
+    </PropertyGroup>
+    <ItemGroup Condition="Exists('$(_CatFile)')">
+      <VSIXSourceItem Include="$(_CatFile)" />
+    </ItemGroup>
+  </Target>
 </Project>
diff --git a/signWhiteList.txt b/signWhiteList.txt
index cec6908c5..73ef7c374 100644
--- a/signWhiteList.txt
+++ b/signWhiteList.txt
@@ -1,3 +1 @@
-*.js, ignore js files
 *.vsman, ignore vsman files
-*.xml, ignore template files

From 2d2cf486435902c65988a2d31ca89cf40b0f3b42 Mon Sep 17 00:00:00 2001
From: Chuy Zarate <jezarat@microsoft.com>
Date: Wed, 29 Apr 2026 12:26:47 -0600
Subject: [PATCH 2/2] Gate catalog signing on SignType to skip local dev builds

Only run GenerateContentCatalog and IncludeCatalogInVsix when
MicroBuild sets SignType (real on CI, test on PR builds).
Local builds have empty SignType, so makecat.exe is never invoked
and developers don't need the Windows SDK installed.
---
 Nodejs/Product/ProjectAfter.targets | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Nodejs/Product/ProjectAfter.targets b/Nodejs/Product/ProjectAfter.targets
index 1e38a5e43..ed25443e5 100644
--- a/Nodejs/Product/ProjectAfter.targets
+++ b/Nodejs/Product/ProjectAfter.targets
@@ -17,7 +17,7 @@
   -->
   <Target Name="GenerateContentCatalog"
           AfterTargets="Build"
-          Condition="'$(CreateVsixContainer)' == 'true'">
+          Condition="'$(CreateVsixContainer)' == 'true' AND '$(SignType)' != ''">
 
     <PropertyGroup>
       <_CatBaseName>$(MSBuildProjectName)-content</_CatBaseName>
@@ -76,7 +76,7 @@
   -->
   <Target Name="IncludeCatalogInVsix"
           BeforeTargets="CreateVsixContainer"
-          Condition="'$(CreateVsixContainer)' == 'true'"
+          Condition="'$(CreateVsixContainer)' == 'true' AND '$(SignType)' != ''"
           DependsOnTargets="GenerateContentCatalog">
     <PropertyGroup>
       <_CatBaseName>$(MSBuildProjectName)-content</_CatBaseName>