Sign our binaries a little smarter to shave off build time

[davkean]

@jasonmalinowski says:

Doing the math, this means we do 2n sign jobs for n VSIXes, which is pretty ugly, and then a few more sign jobs afterwards. This has two bad effects for our signed build:

1. We are submitting many signing jobs, each of which has a high latency.
2. We can’t do the build in parallel. Since we are signing in the binaries listed in the item group that the VS SDK targets consume, this includes binaries in the Binaries folder. If we had multiple VSIX packaging jobs trying to sign the same binary, bad things might happen, and trying to synchronize that across multiple projects and still allow batching is very tricky to do in MSBuild.

The hope as I’d fix 2) after this initial setup went in, but that never happened in favor of higher priority work.

My proposal: change our signing back to a post-processing step which is what we did before we had nested VSIXes. The binaries build goes back to operating in parallel and produces the binaries build as we do unsigned builds. Then, we do some step to produce the list of binaries we need to sign. We already have an item group in SignExtraFiles for some one-offs, but we could easily take that list and then scavenge all our .VSIXes to make sure that at least all of those binaries get signed with our default key. Once we’ve done a pass for the binaries, then have a small build task that simply replaces the binaries inside VSIXes with their signed one, and then we hand all the VISXes off to be signed again. If we need nested VSIXes again, then this post-process step obviously gets trickier (you need to do it more than once for however deep your VSIX nesting is) but it’s a lot fewer than we do now.

This would move us to two sign jobs total, plus we can re-enable parallel build. I’d expect this to shave off 20 minutes or so, but I honestly can’t tell right now looking at our signed queue how long our current build (vs. tests) is taking.

[davkean]

Here you go.

[genlu]

First attempt at this:
https://github.com/dotnet/roslyn-internal/pull/734
#9950

[jasonmalinowski]

Closing since #10519 is now tracking this as move to MicroBuild.