From d7f420cff77cbc7dc4d71c9fb5092cc470ec03b6 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 19 Mar 2026 15:09:05 +0000
Subject: [PATCH 1/2] Initial plan


From 68c5a7c7793a98c0ac27aa0c6aab7ffc40acd806 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 19 Mar 2026 15:15:56 +0000
Subject: [PATCH 2/2] Gate WiX 3 and WiX 5 toolset downloads behind opt-in
 properties

Co-authored-by: rmarinho <1235097+rmarinho@users.noreply.github.com>
---
 .../tools/DefaultVersions.props                        |  4 ++++
 src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.proj        | 10 +++++++---
 src/Microsoft.DotNet.Arcade.Sdk/tools/Tools.proj       |  4 ++--
 src/Microsoft.DotNet.SignTool/src/BatchSignUtil.cs     |  2 +-
 src/Microsoft.DotNet.SignTool/src/SignToolTask.cs      |  4 ++--
 5 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/src/Microsoft.DotNet.Arcade.Sdk/tools/DefaultVersions.props b/src/Microsoft.DotNet.Arcade.Sdk/tools/DefaultVersions.props
index c59200dfa5b..90146d1b7f4 100644
--- a/src/Microsoft.DotNet.Arcade.Sdk/tools/DefaultVersions.props
+++ b/src/Microsoft.DotNet.Arcade.Sdk/tools/DefaultVersions.props
@@ -33,6 +33,10 @@
     <UsingToolVisualStudioIbcTraining Condition="'$(UsingToolVisualStudioIbcTraining)' == ''">false</UsingToolVisualStudioIbcTraining>
     <UsingToolNuGetRepack Condition="'$(UsingToolNuGetRepack)' == ''">false</UsingToolNuGetRepack>
     <UsingToolSymbolUploader Condition="'$(UsingToolSymbolUploader)' == ''">false</UsingToolSymbolUploader>
+    <!-- Set UsingToolWix3 to true if this repo produces WiX 3 MSI installers (wixpacks). -->
+    <UsingToolWix3 Condition="'$(UsingToolWix3)' == ''">false</UsingToolWix3>
+    <!-- Set UsingToolWix5 to true if this repo produces WiX 5 MSI installers (wixpacks). -->
+    <UsingToolWix5 Condition="'$(UsingToolWix5)' == ''">false</UsingToolWix5>
 
     <!-- Deprecated features -->
     <!--
diff --git a/src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.proj b/src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.proj
index 8049677420e..43a46abbd32 100644
--- a/src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.proj
+++ b/src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.proj
@@ -31,7 +31,7 @@
   <Import Project="Sign.props" />
 
   <!-- Import the wix props to get the install path -->
-  <Import Project="$(NuGetPackageRoot)microsoft.signed.wix\$(MicrosoftSignedWixVersion)\build\Microsoft.Signed.Wix.props" />
+  <Import Project="$(NuGetPackageRoot)microsoft.signed.wix\$(MicrosoftSignedWixVersion)\build\Microsoft.Signed.Wix.props" Condition="'$(UsingToolWix3)' == 'true'" />
 
   <!-- Update sign infos that were using Microsoft400 to use the .NET-specific cert if UseDotNetCertificate is present.
        This will update any use, even if explicitly specified.
@@ -60,6 +60,10 @@
 
       <!-- SN is only available on Windows -->
       <SNBinaryPath Condition="$([MSBuild]::IsOSPlatform('Windows'))">$(NuGetPackageRoot)sn\$(SNVersion)\sn.exe</SNBinaryPath>
+
+      <!-- Only set WiX tool paths when the corresponding tool is opted-in -->
+      <_Wix3ToolsPath Condition="'$(UsingToolWix3)' == 'true'">$(WixInstallPath)</_Wix3ToolsPath>
+      <_WixToolsPath Condition="'$(UsingToolWix5)' == 'true'">$(NuGetPackageRoot)microsoft.wixtoolset.sdk\$(MicrosoftWixToolsetSdkVersion)\tools\net472\x64</_WixToolsPath>
     </PropertyGroup>
 
     <ItemGroup>
@@ -90,8 +94,8 @@
         DotNetPath="$(_DotNetCorePath)"
         SNBinaryPath="$(SNBinaryPath)"
         MicroBuildCorePath="$(NuGetPackageRoot)microsoft.visualstudioeng.microbuild.core\$(MicrosoftVisualStudioEngMicroBuildCoreVersion)"
-        Wix3ToolsPath="$(WixInstallPath)"
-        WixToolsPath="$(NuGetPackageRoot)microsoft.wixtoolset.sdk\$(MicrosoftWixToolsetSdkVersion)\tools\net472\x64"
+        Wix3ToolsPath="$(_Wix3ToolsPath)"
+        WixToolsPath="$(_WixToolsPath)"
         PkgToolPath="@(MacOSPkgCliItem)"
         RepackParallelism="$(SignToolRepackParallelism)"
         MaximumParallelFileSize="$(SignToolRepackMaximumParallelFileSize)"
diff --git a/src/Microsoft.DotNet.Arcade.Sdk/tools/Tools.proj b/src/Microsoft.DotNet.Arcade.Sdk/tools/Tools.proj
index c5ba4421054..ffcc3b55b5b 100644
--- a/src/Microsoft.DotNet.Arcade.Sdk/tools/Tools.proj
+++ b/src/Microsoft.DotNet.Arcade.Sdk/tools/Tools.proj
@@ -52,8 +52,8 @@
     <PackageDownload Include="Microsoft.VisualStudioEng.MicroBuild.Core" Version="[$(MicrosoftVisualStudioEngMicroBuildCoreVersion)]" />
     <PackageDownload Include="MicroBuild.Core.Sentinel" Version="[1.0.0]" />
     <PackageDownload Include="vswhere" Version="[$(VSWhereVersion)]" />
-    <PackageDownload Include="Microsoft.Signed.Wix" Version="[$(MicrosoftSignedWixVersion)]" />
-    <PackageDownload Include="Microsoft.WixToolset.Sdk" Version="[$(MicrosoftWixToolsetSdkVersion)]" />
+    <PackageDownload Include="Microsoft.Signed.Wix" Version="[$(MicrosoftSignedWixVersion)]" Condition="'$(UsingToolWix3)' == 'true'" />
+    <PackageDownload Include="Microsoft.WixToolset.Sdk" Version="[$(MicrosoftWixToolsetSdkVersion)]" Condition="'$(UsingToolWix5)' == 'true'" />
     <PackageDownload Include="Microsoft.DotNet.SignTool" Version="[$(MicrosoftDotNetSignToolVersion)]" />
     <PackageDownload Include="Microsoft.DotNet.MacOsPkg.Cli" Version="[$(MicrosoftDotNetMacOsPkgVersion)]" />
     <PackageDownload Include="Microsoft.SymbolUploader.Build.Task" Version="[$(MicrosoftSymbolUploaderBuildTaskVersion)]" Condition="'$(PublishToSymbolServer)' == 'true'" />
diff --git a/src/Microsoft.DotNet.SignTool/src/BatchSignUtil.cs b/src/Microsoft.DotNet.SignTool/src/BatchSignUtil.cs
index 7f4fcfba4d1..010b0ba4cd6 100644
--- a/src/Microsoft.DotNet.SignTool/src/BatchSignUtil.cs
+++ b/src/Microsoft.DotNet.SignTool/src/BatchSignUtil.cs
@@ -411,7 +411,7 @@ List<FileSignInfo> identifyNextGroup()
 
         internal static bool RunWixTool(string toolName, string arguments, string workingDirectory, string wixToolsPath, TaskLoggingHelper log)
         {
-            if (wixToolsPath == null)
+            if (string.IsNullOrEmpty(wixToolsPath))
             {
                 log.LogError("WixToolsPath must be defined to run WiX tooling. Wixpacks are used to produce signed msi's during post-build signing. If this repository is using in-build signing, remove '*.wixpack.zip' from ItemsToSign.");
                 return false;
diff --git a/src/Microsoft.DotNet.SignTool/src/SignToolTask.cs b/src/Microsoft.DotNet.SignTool/src/SignToolTask.cs
index 7767fcbd5b7..7669d9f4245 100644
--- a/src/Microsoft.DotNet.SignTool/src/SignToolTask.cs
+++ b/src/Microsoft.DotNet.SignTool/src/SignToolTask.cs
@@ -209,11 +209,11 @@ public void ExecuteImpl()
                     Log.LogError($"PkgToolPath ('{PkgToolPath}') does not exist & is required for unpacking, repacking, and notarizing .pkg files and .app bundles on MacOS.");
                 }
             }
-            if(Wix3ToolsPath != null && !Directory.Exists(Wix3ToolsPath))
+            if(!string.IsNullOrEmpty(Wix3ToolsPath) && !Directory.Exists(Wix3ToolsPath))
             {
                 Log.LogError($"Wix3ToolsPath ('{Wix3ToolsPath}') does not exist.");
             }
-            if(WixToolsPath != null && !Directory.Exists(WixToolsPath))
+            if(!string.IsNullOrEmpty(WixToolsPath) && !Directory.Exists(WixToolsPath))
             {
                 Log.LogError($"WixToolsPath ('{WixToolsPath}') does not exist.");
             }