Azure Pipelines中TrustedSigning@0任务签名失败（403/0x80004005）

在Azure Pipelines中使用TrustedSigning@0任务对exe文件进行签名时，遇到403错误，提示：

Error: SignerSign() failed. (-2147467259/0x80004005)

已确认的正常配置 #

• 应用注册（App Registration）拥有有效密钥
• 身份验证（Identity validation）已完成
• 证书配置文件（Certificate Profile）处于激活状态
• 应用注册在Trusted Signing账户的IAM中已分配TS Cert Profile Signer和TS Identity Verifier RBAC角色
• YAML中的TenantID、ClientID、ClientSecret与应用注册中的信息一致

日志中发现的异常点 #

从执行日志可见，任务尝试对icon.png和task.json文件进行签名，导致SignTool报错"无法识别文件格式"，最终SignTool以退出码1失败，同时出现Azure.RequestFailedException，状态码403（Forbidden）。

相关配置代码 #

流水线YAML配置 #

stages:
  - stage: Build
    displayName: Build and Publish Artifact for later signing
    pool: 
      vmImage: windows-latest
    jobs:
     - job: Build_And_Publish
       displayName: Build and Publish HelloWorld
       steps:
         - task: CMake@1
           displayName: CMake prep
           inputs:
             workingDir: build
             cmakeArgs: '..'
        
         - task: CMake@1
           displayName: CMake build
           inputs:
             workingDir: build
             cmakeArgs: '--build .'

         - task: CopyFiles@2
           displayName: Prepare for artifact storage
           inputs:
             contents: 'build\Debug\*'
             targetFolder: '$(Build.ArtifactStagingDirectory)'

         - task: TrustedSigning@0
           displayName: Sign hello_world
           inputs:
             AzureTenantID: 'XXX'
             AzureClientID: 'XXX'
             AzureClientSecret: 'XXX'
             Endpoint: 'https://eus.codesigning.azure.net/'
             CodeSigningAccountName: 'trusted-signing'
             CertificateProfileName: 'LeidosSESPublicTrustTest'
             FilesFolder: '$(Build.ArtifactStagingDirectory)'
             FilesFolderFilter: 'exe'
             FilesFolderRecurse: true
             FileDigest: 'SHA256'
             TimestampRfc3161: 'http://timestamp.acs.microsoft.com'
             TimestampDigest: 'SHA256'

Trusted Signing资源JSON #

{
    "id": "/subscriptions/XXX/resourceGroups/softops/providers/Microsoft.CodeSigning/codesigningaccounts/LeidosSESTrust",
    "name": "LeidosSESTrust",
    "type": "microsoft.codesigning/codesigningaccounts",
    "location": "eastus",
    "tags": {},
    "systemData": {
        "createdBy": "XXX@XXX.onmicrosoft.com",
        "createdByType": "User",
        "createdAt": "2024-05-28T15:22:45.554212Z",
        "lastModifiedBy": "XXX@XXX.onmicrosoft.com",
        "lastModifiedByType": "User",
        "lastModifiedAt": "2024-05-28T15:22:45.554212Z"
    },
    "properties": {
        "sku": {
            "name": "Basic"
        },
        "provisioningState": "Succeeded",
        "accountUri": "https://eus.codesigning.azure.net/"
    }
}

应用注册清单 #

{
    "id": "XXX",
    "acceptMappedClaims": null,
    "accessTokenAcceptedVersion": null,
    "addIns": [],
    "allowPublicClient": true,
    "appId": "XXX",
    "appRoles": [],
    "oauth2AllowUrlPathMatching": false,
    "createdDateTime": "2024-06-26T12:01:43Z",
    "description": null,
    "certification": null,
    "disabledByMicrosoftStatus": null,
    "groupMembershipClaims": null,
    "identifierUris": [],
    "informationalUrls": {
        "termsOfService": null,
        "support": null,
        "privacy": null,
        "marketing": null
    },
    "keyCredentials": [],
    "knownClientApplications": [],
    "logoUrl": null,
    "logoutUrl": null,
    "name": "trusted-signing",
    "notes": null,
    "oauth2AllowIdTokenImplicitFlow": false,
    "oauth2AllowImplicitFlow": false,
    "oauth2Permissions": [],
    "oauth2RequirePostResponse": false,
    "optionalClaims": null,
    "orgRestrictions": [],
    "parentalControlSettings": {
        "countriesBlockedForMinors": [],
        "legalAgeGroupRule": "Allow"
    },
    "passwordCredentials": [
        {
            "customKeyIdentifier": null,
            "endDate": "2026-06-26T18:31:28.017Z",
            "keyId": "XXX",
            "startDate": "2024-06-26T18:31:28.017Z",
            "value": null,
            "createdOn": "2024-06-26T18:31:38.0827539Z",
            "hint": "QRa",
            "displayName": "trusted-signing"
        },
        {
            "customKeyIdentifier": null,
            "endDate": "2026-06-26T12:02:59.453Z",
            "keyId": "fba82768-03ad-4d92-a627-4b8aa8a80ed0",
            "startDate": "2024-06-26T12:02:59.453Z",
            "value": null,
            "createdOn": "2024-06-26T12:03:34.5485852Z",
            "hint": "34y",
            "displayName": "trusted-signing-secret"
        }
    ],
    "preAuthorizedApplications": [],
    "publisherDomain": "XXX.onmicrosoft.com",
    "replyUrlsWithType": [],
    "requiredResourceAccess": [
        {
            "resourceAppId": "XXX",
            "resourceAccess": [
                {
                    "id": "eXXX",
                    "type": "Scope"
                }
            ]
        }
    ],
    "samlMetadataUrl": null,
    "signInUrl": null,
    "signInAudience": "AzureADMultipleOrgs",
    "tags": [],
    "tokenEncryptionKeyId": null
}

已排查了常见的403故障点，包括角色分配、配置名称、网络访问等，但问题仍未解决，希望得到技术支持。

内容的提问来源于stack exchange，提问作者Brian Baker