From 0f7eb2912a81c85c16f1cf0eda4481a783bdc37a Mon Sep 17 00:00:00 2001
From: Gregoire Pailler <gregoire@pailler.fr>
Date: Thu, 2 Oct 2025 09:33:54 +0700
Subject: [PATCH] fix(tools): use Microsoft.Windows.SDK.BuildTools for SignTool
 instead of predefined Windows SDK paths

Fixes nuke-build/nuke#1186
---
 .../Tools/SignTool/SignTool.Generated.cs      |  5 ++-
 .../Nuke.Common/Tools/SignTool/SignTool.json  |  3 ++
 .../Tools/SignTool/SignToolTasks.cs           | 34 +++++++------------
 3 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/source/Nuke.Common/Tools/SignTool/SignTool.Generated.cs b/source/Nuke.Common/Tools/SignTool/SignTool.Generated.cs
index c825816ec..d8d21c714 100644
--- a/source/Nuke.Common/Tools/SignTool/SignTool.Generated.cs
+++ b/source/Nuke.Common/Tools/SignTool/SignTool.Generated.cs
@@ -20,9 +20,12 @@ namespace Nuke.Common.Tools.SignTool;
 /// <summary><p>Sign Tool is a command-line tool that digitally signs files, verifies signatures in files, and time-stamps files.</p><p>For more details, visit the <a href="https://docs.microsoft.com/en-us/dotnet/framework/tools/signtool-exe">official website</a>.</p></summary>
 [PublicAPI]
 [ExcludeFromCodeCoverage]
-public partial class SignToolTasks : ToolTasks
+[NuGetTool(Id = PackageId, Executable = PackageExecutable)]
+public partial class SignToolTasks : ToolTasks, IRequireNuGetPackage
 {
     public static string SignToolPath { get => new SignToolTasks().GetToolPathInternal(); set => new SignToolTasks().SetToolPath(value); }
+    public const string PackageId = "Microsoft.Windows.SDK.BuildTools";
+    public const string PackageExecutable = "signtool.exe";
     /// <summary><p>Sign Tool is a command-line tool that digitally signs files, verifies signatures in files, and time-stamps files.</p><p>For more details, visit the <a href="https://docs.microsoft.com/en-us/dotnet/framework/tools/signtool-exe">official website</a>.</p></summary>
     public static IReadOnlyCollection<Output> SignTool(ArgumentStringHandler arguments, string workingDirectory = null, IReadOnlyDictionary<string, string> environmentVariables = null, int? timeout = null, bool? logOutput = null, bool? logInvocation = null, Action<OutputType, string> logger = null, Func<IProcess, object> exitHandler = null) => new SignToolTasks().Run(arguments, workingDirectory, environmentVariables, timeout, logOutput, logInvocation, logger, exitHandler);
     /// <summary><p>Use the <c>sign</c> command to sign files using embedded signatures. Signing protects a file from tampering, and allows users to verify the signer (you) based on a signing certificate. The options below allow you to specify signing parameters and to select the signing certificate you wish to use.</p><p>For more details, visit the <a href="https://docs.microsoft.com/en-us/dotnet/framework/tools/signtool-exe">official website</a>.</p></summary>
diff --git a/source/Nuke.Common/Tools/SignTool/SignTool.json b/source/Nuke.Common/Tools/SignTool/SignTool.json
index db58143cd..e5862f07d 100644
--- a/source/Nuke.Common/Tools/SignTool/SignTool.json
+++ b/source/Nuke.Common/Tools/SignTool/SignTool.json
@@ -6,6 +6,9 @@
   "name": "SignTool",
   "officialUrl": "https://docs.microsoft.com/en-us/dotnet/framework/tools/signtool-exe",
   "help": "Sign Tool is a command-line tool that digitally signs files, verifies signatures in files, and time-stamps files.",
+  "nugetPackageId": "Microsoft.Windows.SDK.BuildTools",
+  "packageExecutable": "signtool.exe",
+  "customExecutable": true,
   "tasks": [
     {
       "help": "Use the <c>sign</c> command to sign files using embedded signatures. Signing protects a file from tampering, and allows users to verify the signer (you) based on a signing certificate. The options below allow you to specify signing parameters and to select the signing certificate you wish to use.",
diff --git a/source/Nuke.Common/Tools/SignTool/SignToolTasks.cs b/source/Nuke.Common/Tools/SignTool/SignToolTasks.cs
index 881368dc8..b462e947c 100644
--- a/source/Nuke.Common/Tools/SignTool/SignToolTasks.cs
+++ b/source/Nuke.Common/Tools/SignTool/SignToolTasks.cs
@@ -1,10 +1,9 @@
-// Copyright 2023 Maintainers of NUKE.
+// Copyright 2025 Maintainers of NUKE.
 // Distributed under the MIT License.
 // https://github.com/nuke-build/nuke/blob/master/LICENSE
 
 using System;
-using System.Linq;
-using Nuke.Common.IO;
+using System.Runtime.InteropServices;
 using Nuke.Common.Tooling;
 
 namespace Nuke.Common.Tools.SignTool;
@@ -13,24 +12,17 @@ partial class SignToolTasks
 {
     protected override string GetToolPath(ToolOptions options = null)
     {
-        var programDirectory = EnvironmentInfo.SpecialFolder(
-            EnvironmentInfo.Is64Bit
-                ? SpecialFolders.ProgramFilesX86
-                : SpecialFolders.ProgramFiles).NotNull();
+        var architecture = RuntimeInformation.OSArchitecture switch
+        {
+            Architecture.Arm64 => "arm64",
+            Architecture.X86 => "x86",
+            Architecture.X64 => "x64",
+            _ => throw new ArgumentException("Unsupported architecture")
+        };
 
-        var platformIdentifier = EnvironmentInfo.Is64Bit ? "x64" : "x86";
-
-        return new[]
-            {
-                programDirectory / "Windows Kits" / "10" / "bin" / "10.0.15063.0",
-                programDirectory / "Windows Kits" / "10" / "App Certification Kit",
-                programDirectory / "Windows Kits" / "10" / "bin" / platformIdentifier,
-                programDirectory / "Windows Kits" / "8.1" / "bin" / platformIdentifier,
-                programDirectory / "Windows Kits" / "8.0" / "bin" / platformIdentifier,
-                programDirectory / "Microsoft SDKs" / "Windows" / "v7.1A" / "Bin"
-            }
-            .Select(x => x / "signtool.exe")
-            .WhereFileExists()
-            .FirstOrDefault();
+        return NuGetToolPathResolver.GetPackageExecutable(
+            packageId: PackageId,
+            packageExecutable: PackageExecutable,
+            framework: architecture);
     }
 }