From c5d1bed787660f4059677311f23073e504f9cf9c Mon Sep 17 00:00:00 2001
From: Matthew John Cheetham <mjcheetham@outlook.com>
Date: Wed, 7 Oct 2026 13:36:32 +0100
Subject: [PATCH] release: codesign .NET Tool NuGet package

Ensure that we actually codesign the NuGet package for the .NET tool.
This step was accidentally dropped during reworking of the release
pipeline during initial GCM 3.x development.

Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
---
 .azure-pipelines/release.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/.azure-pipelines/release.yml b/.azure-pipelines/release.yml
index 34f7a5b6e..2adc88f08 100644
--- a/.azure-pipelines/release.yml
+++ b/.azure-pipelines/release.yml
@@ -576,6 +576,23 @@ extends:
                   targetType: filePath
                   filePath: './build/dntool/pack.sh'
                   arguments: --configuration release
+              # ESRP-sign the NuGet package itself
+              - ${{ if eq(parameters.esrp, true) }}:
+                - template: .azure-pipelines/esrp/sign.yml@self
+                  parameters:
+                    displayName: 'Sign payload'
+                    folderPath: '$(Build.SourcesDirectory)/out/package/release'
+                    pattern: '**/*.nupkg'
+                    inlineOperation: |
+                      [
+                        {
+                          "KeyCode": "CP-401405",
+                          "OperationCode": "NuGetSign",
+                          "ToolName": "sign",
+                          "ToolVersion": "1.0",
+                          "Parameters": {}
+                        }
+                      ]
               - task: Bash@3
                 displayName: 'Collect artifacts for publishing'
                 inputs: