From 9be66e8b330bc54bff9dfce4e602b7c905e38f93 Mon Sep 17 00:00:00 2001
From: wenytang-ms <wenyutang@microsoft.com>
Date: Mon, 17 Aug 2026 14:29:37 +0800
Subject: [PATCH] build: pin MicroBuild signing plugin

Use the last known-good Windows signing package in nightly and RC pipelines until the 1.1.1374 client certificate regression is resolved.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ac225268-483d-4498-a08f-fe79a87d4d2e
---
 .azure-pipelines/nightly.yml | 19 ++++++++++++++-----
 .azure-pipelines/rc.yml      | 19 ++++++++++++++-----
 2 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/.azure-pipelines/nightly.yml b/.azure-pipelines/nightly.yml
index 97ff7678..23013ce6 100644
--- a/.azure-pipelines/nightly.yml
+++ b/.azure-pipelines/nightly.yml
@@ -31,11 +31,7 @@ extends:
             templateContext:
               mb:
                  signing:
-                   enabled: true
-                   signType: real
-                   signWithProd: true
-                   zipSources: false
-                   feedSource: 'https://mseng.pkgs.visualstudio.com/DefaultCollection/_packaging/MicroBuildToolset/nuget/v3/index.json'
+                   enabled: false
               outputs:
                 - output: pipelineArtifact
                   artifactName: vsix
@@ -45,6 +41,19 @@ extends:
               - checkout: self
                 clean: true
                 fetchTags: false
+              # Pin the last known-good Windows plugin while the 1.1.1374 client certificate regression is unresolved.
+              - task: NuGetAuthenticate@1
+                displayName: Authenticate MicroBuild feed
+              - task: MicroBuildSigningPlugin@4
+                displayName: Install Signing Plugin 1.1.1330
+                inputs:
+                  signType: real
+                  version: '1.1.1330'
+                  zipSources: false
+                  ConnectedPMEServiceName: '40012d40-9ded-4f75-8476-d60758200346'
+                  feedSource: 'https://mseng.pkgs.visualstudio.com/DefaultCollection/_packaging/MicroBuildToolset/nuget/v3/index.json'
+                env:
+                  MicroBuildOutputFolderOverride: '$(Agent.TempDirectory)'
               - task: NodeTool@0
                 displayName: Use Node 20.x
                 inputs:
diff --git a/.azure-pipelines/rc.yml b/.azure-pipelines/rc.yml
index 101ade0d..ea308bda 100644
--- a/.azure-pipelines/rc.yml
+++ b/.azure-pipelines/rc.yml
@@ -26,11 +26,7 @@ extends:
             templateContext:
               mb:
                  signing:
-                   enabled: true
-                   signType: real
-                   signWithProd: true
-                   zipSources: false
-                   feedSource: 'https://mseng.pkgs.visualstudio.com/DefaultCollection/_packaging/MicroBuildToolset/nuget/v3/index.json'
+                   enabled: false
               outputs:
                 - output: pipelineArtifact
                   artifactName: vsix
@@ -40,6 +36,19 @@ extends:
               - checkout: self
                 clean: true
                 fetchTags: false
+              # Pin the last known-good Windows plugin while the 1.1.1374 client certificate regression is unresolved.
+              - task: NuGetAuthenticate@1
+                displayName: Authenticate MicroBuild feed
+              - task: MicroBuildSigningPlugin@4
+                displayName: Install Signing Plugin 1.1.1330
+                inputs:
+                  signType: real
+                  version: '1.1.1330'
+                  zipSources: false
+                  ConnectedPMEServiceName: '40012d40-9ded-4f75-8476-d60758200346'
+                  feedSource: 'https://mseng.pkgs.visualstudio.com/DefaultCollection/_packaging/MicroBuildToolset/nuget/v3/index.json'
+                env:
+                  MicroBuildOutputFolderOverride: '$(Agent.TempDirectory)'
               - task: NodeTool@0
                 displayName: Use Node 20.x
                 inputs: