{"action":"created","comment":{"url":"https://api.github.com/repos/dotnet/roslyn/pulls/comments/156171143","pull_request_review_id":82605571,"id":156171143,"diff_hunk":"@@ -242,6 +250,30 @@ internal static class PeWriter\n             }\n \n             return true;\n+\n+            Blob getChecksumBlob(PEBuilder builder)\n+                => (Blob)typeof(PEBuilder).GetRuntimeFields()\n+                    .Where(f => f.Name == \"_lazyChecksum\")\n+                    .Single()\n+                    .GetValue(builder);\n+        }\n+\n+        private static MethodInfo _calculateChecksumMethod;","path":"src/Compilers/Core/Portable/PEWriter/PeWriter.cs","position":null,"original_position":51,"commit_id":"d82885ae0d500728fd2dcf93efe96ad4b3fa2ed2","original_commit_id":"f99618fea9b83e02a63e8fb3f94a21717b8a9371","user":{"login":"agocke","id":515774,"avatar_url":"https://avatars2.githubusercontent.com/u/515774?v=4","gravatar_id":"","url":"https://api.github.com/users/agocke","html_url":"https://github.com/agocke","followers_url":"https://api.github.com/users/agocke/followers","following_url":"https://api.github.com/users/agocke/following{/other_user}","gists_url":"https://api.github.com/users/agocke/gists{/gist_id}","starred_url":"https://api.github.com/users/agocke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/agocke/subscriptions","organizations_url":"https://api.github.com/users/agocke/orgs","repos_url":"https://api.github.com/users/agocke/repos","events_url":"https://api.github.com/users/agocke/events{/privacy}","received_events_url":"https://api.github.com/users/agocke/received_events","type":"User","site_admin":false},"body":"Sorry, I wrote signature but I meant checksum. If I copied the code I would need to find the offset of the checksum field and exclude it from hashing. The APIs to do that are private, as far as I can tell. I could maybe get the raw byte array and then hard code the offset of the signature field, as well as copy over all the checksum code, but this doesn't seem better than using private reflection.","created_at":"2017-12-11T19:15:23Z","updated_at":"2017-12-11T19:15:23Z","html_url":"https://github.com/dotnet/roslyn/pull/23704#discussion_r156171143","pull_request_url":"https://api.github.com/repos/dotnet/roslyn/pulls/23704","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/dotnet/roslyn/pulls/comments/156171143"},"html":{"href":"https://github.com/dotnet/roslyn/pull/23704#discussion_r156171143"},"pull_request":{"href":"https://api.github.com/repos/dotnet/roslyn/pulls/23704"}},"in_reply_to_id":155989063},"pull_request":{"url":"https://api.github.com/repos/dotnet/roslyn/pulls/23704","id":157456540,"html_url":"https://github.com/dotnet/roslyn/pull/23704","diff_url":"https://github.com/dotnet/roslyn/pull/23704.diff","patch_url":"https://github.com/dotnet/roslyn/pull/23704.patch","issue_url":"https://api.github.com/repos/dotnet/roslyn/issues/23704","number":23704,"state":"open","locked":false,"title":"Fix and re-enable portable signing","user":{"login":"agocke","id":515774,"avatar_url":"https://avatars2.githubusercontent.com/u/515774?v=4","gravatar_id":"","url":"https://api.github.com/users/agocke","html_url":"https://github.com/agocke","followers_url":"https://api.github.com/users/agocke/followers","following_url":"https://api.github.com/users/agocke/following{/other_user}","gists_url":"https://api.github.com/users/agocke/gists{/gist_id}","starred_url":"https://api.github.com/users/agocke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/agocke/subscriptions","organizations_url":"https://api.github.com/users/agocke/orgs","repos_url":"https://api.github.com/users/agocke/repos","events_url":"https://api.github.com/users/agocke/events{/privacy}","received_events_url":"https://api.github.com/users/agocke/received_events","type":"User","site_admin":false},"body":"### Customer scenario\r\n\r\nRe-enable portable signing, allowing binaries to be signed on Mac & Linux.\r\n\r\nThere were two separate bugs here:\r\n    \r\n1. Fixing up the MVID of the binary was being done *after* signing,\r\n    when it should be done before.\r\n\r\n2. System.Reflection.Metadata has a bug where calculating the\r\n    checksum occurs before signing, when it should happen after.\r\n\r\nBoth of these isues have been fixed and the helper utility that checks\r\nto see whether a binary was signed has been changed to verify that the\r\nsignature and checksums of the binaries are valid, not just that the\r\nsigned bit is set on the assembly.\r\n\r\n### Bugs this fixes\r\n\r\nFixes #23521\r\n\r\n### Workarounds, if any\r\n\r\nNone. Binaries cannot be strongname signed on Mac or Linux without this change.\r\n\r\n### Risk\r\n\r\nThis change is isolated to signing.\r\n\r\n### Performance impact\r\n\r\nNone. Portable signing is likely faster since it allows PE streams to be signed without\r\ncopying to a temporary file.\r\n\r\n### Is this a regression from a previous update?\r\n\r\nNo.\r\n\r\n### Root cause analysis\r\n\r\nThe primary helper used by the signing tests, IsStreamSigned, only checked to see\r\nif the sign bit was set, not that the signature was valid. This helper has been modified\r\nto use the verification used by System.Reflection.Metadata for its tests as well. That\r\nhelper includes a test that verifies a large number of core framework types (mscorlib, et al)\r\nand thus is very likely to produce the same verification as the CLR itself.\r\n\r\n### How was the bug found?\r\n\r\nToolset insertion into Visual Studio, which verified the strong name signatures after signing.\r\n","created_at":"2017-12-10T23:29:10Z","updated_at":"2017-12-11T19:15:23Z","closed_at":null,"merged_at":null,"merge_commit_sha":"ef720b34347fa40a5af7a237164715e653211ac6","assignee":null,"assignees":[],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/dotnet/roslyn/pulls/23704/commits","review_comments_url":"https://api.github.com/repos/dotnet/roslyn/pulls/23704/comments","review_comment_url":"https://api.github.com/repos/dotnet/roslyn/pulls/comments{/number}","comments_url":"https://api.github.com/repos/dotnet/roslyn/issues/23704/comments","statuses_url":"https://api.github.com/repos/dotnet/roslyn/statuses/d82885ae0d500728fd2dcf93efe96ad4b3fa2ed2","head":{"label":"agocke:fix-portable-signing","ref":"fix-portable-signing","sha":"d82885ae0d500728fd2dcf93efe96ad4b3fa2ed2","user":{"login":"agocke","id":515774,"avatar_url":"https://avatars2.githubusercontent.com/u/515774?v=4","gravatar_id":"","url":"https://api.github.com/users/agocke","html_url":"https://github.com/agocke","followers_url":"https://api.github.com/users/agocke/followers","following_url":"https://api.github.com/users/agocke/following{/other_user}","gists_url":"https://api.github.com/users/agocke/gists{/gist_id}","starred_url":"https://api.github.com/users/agocke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/agocke/subscriptions","organizations_url":"https://api.github.com/users/agocke/orgs","repos_url":"https://api.github.com/users/agocke/repos","events_url":"https://api.github.com/users/agocke/events{/privacy}","received_events_url":"https://api.github.com/users/agocke/received_events","type":"User","site_admin":false},"repo":{"id":30560754,"name":"roslyn","full_name":"agocke/roslyn","owner":{"login":"agocke","id":515774,"avatar_url":"https://avatars2.githubusercontent.com/u/515774?v=4","gravatar_id":"","url":"https://api.github.com/users/agocke","html_url":"https://github.com/agocke","followers_url":"https://api.github.com/users/agocke/followers","following_url":"https://api.github.com/users/agocke/following{/other_user}","gists_url":"https://api.github.com/users/agocke/gists{/gist_id}","starred_url":"https://api.github.com/users/agocke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/agocke/subscriptions","organizations_url":"https://api.github.com/users/agocke/orgs","repos_url":"https://api.github.com/users/agocke/repos","events_url":"https://api.github.com/users/agocke/events{/privacy}","received_events_url":"https://api.github.com/users/agocke/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/agocke/roslyn","description":"The .NET Compiler Platform (\"Roslyn\") provides open-source C# and Visual Basic compilers with rich code analysis APIs.","fork":true,"url":"https://api.github.com/repos/agocke/roslyn","forks_url":"https://api.github.com/repos/agocke/roslyn/forks","keys_url":"https://api.github.com/repos/agocke/roslyn/keys{/key_id}","collaborators_url":"https://api.github.com/repos/agocke/roslyn/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/agocke/roslyn/teams","hooks_url":"https://api.github.com/repos/agocke/roslyn/hooks","issue_events_url":"https://api.github.com/repos/agocke/roslyn/issues/events{/number}","events_url":"https://api.github.com/repos/agocke/roslyn/events","assignees_url":"https://api.github.com/repos/agocke/roslyn/assignees{/user}","branches_url":"https://api.github.com/repos/agocke/roslyn/branches{/branch}","tags_url":"https://api.github.com/repos/agocke/roslyn/tags","blobs_url":"https://api.github.com/repos/agocke/roslyn/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/agocke/roslyn/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/agocke/roslyn/git/refs{/sha}","trees_url":"https://api.github.com/repos/agocke/roslyn/git/trees{/sha}","statuses_url":"https://api.github.com/repos/agocke/roslyn/statuses/{sha}","languages_url":"https://api.github.com/repos/agocke/roslyn/languages","stargazers_url":"https://api.github.com/repos/agocke/roslyn/stargazers","contributors_url":"https://api.github.com/repos/agocke/roslyn/contributors","subscribers_url":"https://api.github.com/repos/agocke/roslyn/subscribers","subscription_url":"https://api.github.com/repos/agocke/roslyn/subscription","commits_url":"https://api.github.com/repos/agocke/roslyn/commits{/sha}","git_commits_url":"https://api.github.com/repos/agocke/roslyn/git/commits{/sha}","comments_url":"https://api.github.com/repos/agocke/roslyn/comments{/number}","issue_comment_url":"https://api.github.com/repos/agocke/roslyn/issues/comments{/number}","contents_url":"https://api.github.com/repos/agocke/roslyn/contents/{+path}","compare_url":"https://api.github.com/repos/agocke/roslyn/compare/{base}...{head}","merges_url":"https://api.github.com/repos/agocke/roslyn/merges","archive_url":"https://api.github.com/repos/agocke/roslyn/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/agocke/roslyn/downloads","issues_url":"https://api.github.com/repos/agocke/roslyn/issues{/number}","pulls_url":"https://api.github.com/repos/agocke/roslyn/pulls{/number}","milestones_url":"https://api.github.com/repos/agocke/roslyn/milestones{/number}","notifications_url":"https://api.github.com/repos/agocke/roslyn/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/agocke/roslyn/labels{/name}","releases_url":"https://api.github.com/repos/agocke/roslyn/releases{/id}","deployments_url":"https://api.github.com/repos/agocke/roslyn/deployments","created_at":"2015-02-09T21:57:03Z","updated_at":"2016-11-08T21:22:04Z","pushed_at":"2017-12-11T18:30:29Z","git_url":"git://github.com/agocke/roslyn.git","ssh_url":"git@github.com:agocke/roslyn.git","clone_url":"https://github.com/agocke/roslyn.git","svn_url":"https://github.com/agocke/roslyn","homepage":"","size":251823,"stargazers_count":1,"watchers_count":1,"language":"C#","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":0,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"dotnet:master","ref":"master","sha":"eb32b2faa02d0e25d8fb9856e04d6f9e01d448ae","user":{"login":"dotnet","id":9141961,"avatar_url":"https://avatars0.githubusercontent.com/u/9141961?v=4","gravatar_id":"","url":"https://api.github.com/users/dotnet","html_url":"https://github.com/dotnet","followers_url":"https://api.github.com/users/dotnet/followers","following_url":"https://api.github.com/users/dotnet/following{/other_user}","gists_url":"https://api.github.com/users/dotnet/gists{/gist_id}","starred_url":"https://api.github.com/users/dotnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dotnet/subscriptions","organizations_url":"https://api.github.com/users/dotnet/orgs","repos_url":"https://api.github.com/users/dotnet/repos","events_url":"https://api.github.com/users/dotnet/events{/privacy}","received_events_url":"https://api.github.com/users/dotnet/received_events","type":"Organization","site_admin":false},"repo":{"id":29078997,"name":"roslyn","full_name":"dotnet/roslyn","owner":{"login":"dotnet","id":9141961,"avatar_url":"https://avatars0.githubusercontent.com/u/9141961?v=4","gravatar_id":"","url":"https://api.github.com/users/dotnet","html_url":"https://github.com/dotnet","followers_url":"https://api.github.com/users/dotnet/followers","following_url":"https://api.github.com/users/dotnet/following{/other_user}","gists_url":"https://api.github.com/users/dotnet/gists{/gist_id}","starred_url":"https://api.github.com/users/dotnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dotnet/subscriptions","organizations_url":"https://api.github.com/users/dotnet/orgs","repos_url":"https://api.github.com/users/dotnet/repos","events_url":"https://api.github.com/users/dotnet/events{/privacy}","received_events_url":"https://api.github.com/users/dotnet/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/dotnet/roslyn","description":"The .NET Compiler Platform (\"Roslyn\") provides open-source C# and Visual Basic compilers with rich code analysis APIs.","fork":false,"url":"https://api.github.com/repos/dotnet/roslyn","forks_url":"https://api.github.com/repos/dotnet/roslyn/forks","keys_url":"https://api.github.com/repos/dotnet/roslyn/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dotnet/roslyn/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dotnet/roslyn/teams","hooks_url":"https://api.github.com/repos/dotnet/roslyn/hooks","issue_events_url":"https://api.github.com/repos/dotnet/roslyn/issues/events{/number}","events_url":"https://api.github.com/repos/dotnet/roslyn/events","assignees_url":"https://api.github.com/repos/dotnet/roslyn/assignees{/user}","branches_url":"https://api.github.com/repos/dotnet/roslyn/branches{/branch}","tags_url":"https://api.github.com/repos/dotnet/roslyn/tags","blobs_url":"https://api.github.com/repos/dotnet/roslyn/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dotnet/roslyn/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dotnet/roslyn/git/refs{/sha}","trees_url":"https://api.github.com/repos/dotnet/roslyn/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dotnet/roslyn/statuses/{sha}","languages_url":"https://api.github.com/repos/dotnet/roslyn/languages","stargazers_url":"https://api.github.com/repos/dotnet/roslyn/stargazers","contributors_url":"https://api.github.com/repos/dotnet/roslyn/contributors","subscribers_url":"https://api.github.com/repos/dotnet/roslyn/subscribers","subscription_url":"https://api.github.com/repos/dotnet/roslyn/subscription","commits_url":"https://api.github.com/repos/dotnet/roslyn/commits{/sha}","git_commits_url":"https://api.github.com/repos/dotnet/roslyn/git/commits{/sha}","comments_url":"https://api.github.com/repos/dotnet/roslyn/comments{/number}","issue_comment_url":"https://api.github.com/repos/dotnet/roslyn/issues/comments{/number}","contents_url":"https://api.github.com/repos/dotnet/roslyn/contents/{+path}","compare_url":"https://api.github.com/repos/dotnet/roslyn/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dotnet/roslyn/merges","archive_url":"https://api.github.com/repos/dotnet/roslyn/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dotnet/roslyn/downloads","issues_url":"https://api.github.com/repos/dotnet/roslyn/issues{/number}","pulls_url":"https://api.github.com/repos/dotnet/roslyn/pulls{/number}","milestones_url":"https://api.github.com/repos/dotnet/roslyn/milestones{/number}","notifications_url":"https://api.github.com/repos/dotnet/roslyn/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dotnet/roslyn/labels{/name}","releases_url":"https://api.github.com/repos/dotnet/roslyn/releases{/id}","deployments_url":"https://api.github.com/repos/dotnet/roslyn/deployments","created_at":"2015-01-11T02:39:03Z","updated_at":"2017-12-11T17:50:05Z","pushed_at":"2017-12-11T19:01:19Z","git_url":"git://github.com/dotnet/roslyn.git","ssh_url":"git@github.com:dotnet/roslyn.git","clone_url":"https://github.com/dotnet/roslyn.git","svn_url":"https://github.com/dotnet/roslyn","homepage":"","size":260807,"stargazers_count":8546,"watchers_count":8546,"language":"C#","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":2072,"mirror_url":null,"archived":false,"open_issues_count":4239,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":2072,"open_issues":4239,"watchers":8546,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/dotnet/roslyn/pulls/23704"},"html":{"href":"https://github.com/dotnet/roslyn/pull/23704"},"issue":{"href":"https://api.github.com/repos/dotnet/roslyn/issues/23704"},"comments":{"href":"https://api.github.com/repos/dotnet/roslyn/issues/23704/comments"},"review_comments":{"href":"https://api.github.com/repos/dotnet/roslyn/pulls/23704/comments"},"review_comment":{"href":"https://api.github.com/repos/dotnet/roslyn/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/dotnet/roslyn/pulls/23704/commits"},"statuses":{"href":"https://api.github.com/repos/dotnet/roslyn/statuses/d82885ae0d500728fd2dcf93efe96ad4b3fa2ed2"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"agocke"}}