Add option to skip NuGet signature verification

Introduce NUGET_SIGN_SKIP_VERIFICATION to allow skipping signed package verification. Expose a new signature_verification_enabled output (steps.signing.outputs.verify_enabled) and write verify_enabled to GITHUB_OUTPUT based on the env/secret. Update publish-artifacts, publish-packages, publish-attested and release-drafter to accept the new input/secret and gate 'Verify signed packages' steps on both signing_enabled and signature_verification_enabled. This enables disabling verification in CI without turning off signing.

Author: rian-be

.github/workflows/publish-artifacts.yml

@@ -6,6 +6,9 @@ on:
       signing_enabled:
         description: "Whether package signing was enabled for this run."
         value: ${{ jobs.package.outputs.signing_enabled }}
+      signature_verification_enabled:
+        description: "Whether signed package verification was enabled for this run."
+        value: ${{ jobs.package.outputs.signature_verification_enabled }}
     inputs:
       package_version:
         description: "Optional package version, usually the release tag without the leading v."
@@ -47,6 +50,8 @@ on:
         required: false
       NUGET_SIGN_TIMESTAMP_URL:
         required: false
+      NUGET_SIGN_SKIP_VERIFICATION:
+        required: false
 
 permissions:
   contents: read
@@ -57,6 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       signing_enabled: ${{ steps.signing.outputs.enabled }}
+      signature_verification_enabled: ${{ steps.signing.outputs.verify_enabled }}
 
     steps:
       - name: Checkout
@@ -150,6 +156,7 @@ jobs:
           NUGET_SIGN_CERTIFICATE_PASSWORD: ${{ secrets.NUGET_SIGN_CERTIFICATE_PASSWORD }}
           NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT: ${{ secrets.NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT }}
           NUGET_SIGN_TIMESTAMP_URL: ${{ secrets.NUGET_SIGN_TIMESTAMP_URL }}
+          NUGET_SIGN_SKIP_VERIFICATION: ${{ secrets.NUGET_SIGN_SKIP_VERIFICATION }}
         run: |
           if [ -n "$NUGET_SIGN_CERTIFICATE_BASE64" ] \
             && [ -n "$NUGET_SIGN_CERTIFICATE_PASSWORD" ] \
@@ -162,6 +169,14 @@ jobs:
             echo "Package signing disabled. Continuing with unsigned packages."
           fi
 
+          if [ "${NUGET_SIGN_SKIP_VERIFICATION,,}" = "true" ]; then
+            echo "verify_enabled=false" >> "$GITHUB_OUTPUT"
+            echo "Signed package verification disabled by NUGET_SIGN_SKIP_VERIFICATION."
+          else
+            echo "verify_enabled=true" >> "$GITHUB_OUTPUT"
+            echo "Signed package verification enabled."
+          fi
+
       - name: Import signing certificate
         if: ${{ steps.signing.outputs.enabled == 'true' }}
         env:
@@ -186,7 +201,7 @@ jobs:
           done
 
       - name: Verify signed packages
-        if: ${{ steps.signing.outputs.enabled == 'true' }}
+        if: ${{ steps.signing.outputs.enabled == 'true' && steps.signing.outputs.verify_enabled == 'true' }}
         env:
           NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT: ${{ secrets.NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT }}
         run: |

.github/workflows/publish-attested.yml

@@ -22,6 +22,8 @@ on:
         required: false
       NUGET_SIGN_TIMESTAMP_URL:
         required: false
+      NUGET_SIGN_SKIP_VERIFICATION:
+        required: false
 
 permissions:
   contents: write
@@ -39,6 +41,7 @@ jobs:
       NUGET_SIGN_CERTIFICATE_PASSWORD: ${{ secrets.NUGET_SIGN_CERTIFICATE_PASSWORD }}
       NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT: ${{ secrets.NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT }}
       NUGET_SIGN_TIMESTAMP_URL: ${{ secrets.NUGET_SIGN_TIMESTAMP_URL }}
+      NUGET_SIGN_SKIP_VERIFICATION: ${{ secrets.NUGET_SIGN_SKIP_VERIFICATION }}
 
   release:
     name: Upload artifacts to draft release

.github/workflows/publish-packages.yml

@@ -106,6 +106,7 @@ jobs:
       NUGET_SIGN_CERTIFICATE_PASSWORD: ${{ secrets.NUGET_SIGN_CERTIFICATE_PASSWORD }}
       NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT: ${{ secrets.NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT }}
       NUGET_SIGN_TIMESTAMP_URL: ${{ secrets.NUGET_SIGN_TIMESTAMP_URL }}
+      NUGET_SIGN_SKIP_VERIFICATION: ${{ secrets.NUGET_SIGN_SKIP_VERIFICATION }}
 
   publish-nuget:
     name: Publish to NuGet.org
@@ -130,7 +131,7 @@ jobs:
           merge-multiple: true
 
       - name: Verify signed packages
-        if: ${{ needs.package.outputs.signing_enabled == 'true' }}
+        if: ${{ needs.package.outputs.signing_enabled == 'true' && needs.package.outputs.signature_verification_enabled == 'true' }}
         env:
           NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT: ${{ secrets.NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT }}
         run: |
@@ -180,7 +181,7 @@ jobs:
           merge-multiple: true
 
       - name: Verify signed packages
-        if: ${{ needs.package.outputs.signing_enabled == 'true' }}
+        if: ${{ needs.package.outputs.signing_enabled == 'true' && needs.package.outputs.signature_verification_enabled == 'true' }}
         env:
           NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT: ${{ secrets.NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT }}
         run: |

.github/workflows/release-drafter.yml

@@ -43,3 +43,4 @@ jobs:
       NUGET_SIGN_CERTIFICATE_PASSWORD: ${{ secrets.NUGET_SIGN_CERTIFICATE_PASSWORD }}
       NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT: ${{ secrets.NUGET_SIGN_CERTIFICATE_SHA256_FINGERPRINT }}
       NUGET_SIGN_TIMESTAMP_URL: ${{ secrets.NUGET_SIGN_TIMESTAMP_URL }}
+      NUGET_SIGN_SKIP_VERIFICATION: ${{ secrets.NUGET_SIGN_SKIP_VERIFICATION }}