Add code signing

Author: AArnott

azure-pipelines/SignClient.json

@@ -0,0 +1,13 @@
+{
+  "SignClient": {
+    "AzureAd": {
+      "AADInstance": "https://login.microsoftonline.com/",
+      "ClientId": "c248d68a-ba6f-4aa9-8a68-71fe872063f8",
+      "TenantId": "16076fdc-fcc1-4a15-b1ca-32c9a255900e"
+    },
+    "Service": {
+      "Url": "https://codesign.dotnetfoundation.org/",
+      "ResourceId": "https://SignService/3c30251f-36f3-490b-a955-520addb85001"
+    }
+  }
+}

azure-pipelines/build.yml

@@ -4,6 +4,8 @@ parameters:
 jobs:
 - job: Windows
   pool: ${{ parameters.windowsPool }}
+  variables:
+  - group: pinvoke code signing
   steps:
   - checkout: self
     clean: true

azure-pipelines/dotnet.yml

@@ -10,6 +10,21 @@ steps:
 - powershell: .\build.ps1 -Test
   displayName: Test
 
+- pwsh: >
+    dotnet tool install --tool-path obj SignClient
+
+    obj/SignClient sign
+    --baseDirectory '$(System.DefaultWorkingDirectory)/bin/$(BuildConfiguration)/Packages'
+    --input '**/*'
+    --config '$(System.DefaultWorkingDirectory)/azure-pipelines/SignClient.json'
+    --filelist '$(System.DefaultWorkingDirectory)/azure-pipelines/signfiles.txt'
+    --user '$(codesign_username)'
+    --secret '$(codesign_secret)'
+    --name 'PInvoke'
+    --descriptionUrl 'https://github.com/dotnet/pinvoke'
+  displayName: Code sign
+  condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'))
+
 - task: PowerShell@2
   inputs:
     filePath: azure-pipelines/variables/_pipelines.ps1

azure-pipelines/signfiles.txt

@@ -0,0 +1 @@
+**/PInvoke.*.dll