Introduce "msi inscribe" command and use it in wix.signing.targets

10 files changed, 376 insertions, 31 deletions

diff --git a/src/wix/WixToolset.BuildTasks/InscribeMsiWithCabinetSignatures.cs b/src/wix/WixToolset.BuildTasks/InscribeMsiWithCabinetSignatures.cs
new file mode 100644
index 00000000..9f78caa5
--- /dev/null
+++ b/src/wix/WixToolset.BuildTasks/InscribeMsiWithCabinetSignatures.cs
@@ -0,0 +1,33 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+namespace WixToolset.BuildTasks
+{
+    using Microsoft.Build.Framework;
+
+    /// <summary>
+    /// An MSBuild task to run WiX to update cabinet signatures in a MSI.
+    /// </summary>
+    public sealed partial class InscribeMsiWithCabinetSignatures : WixExeBaseTask
+    {
+        [Required]
+        public ITaskItem DatabaseFile { get; set; }
+
+        [Required]
+        public ITaskItem IntermediateDirectory { get; set; }
+
+        public ITaskItem OutputFile { get; set; }
+
+        protected override void BuildCommandLine(WixCommandLineBuilder commandLineBuilder)
+        {
+            commandLineBuilder.AppendTextUnquoted("msi inscribe");
+
+            commandLineBuilder.AppendFileNameIfNotNull(this.DatabaseFile);
+            commandLineBuilder.AppendSwitchIfNotNull("-out ", this.OutputFile);
+            commandLineBuilder.AppendSwitchIfNotNull("-intermediatefolder ", this.IntermediateDirectory);
+
+            base.BuildCommandLine(commandLineBuilder);
+
+            commandLineBuilder.AppendTextIfNotWhitespace(this.AdditionalOptions);
+        }
+    }
+}
diff --git a/src/wix/WixToolset.Core.WindowsInstaller/Inscribe/InscribeMsiPackageCommand.cs b/src/wix/WixToolset.Core.WindowsInstaller/Inscribe/InscribeMsiPackageCommand.cs
index 57f2f753..80fcb8e1 100644
--- a/src/wix/WixToolset.Core.WindowsInstaller/Inscribe/InscribeMsiPackageCommand.cs
+++ b/src/wix/WixToolset.Core.WindowsInstaller/Inscribe/InscribeMsiPackageCommand.cs
@@ -12,20 +12,25 @@ namespace WixToolset.Core.WindowsInstaller.Inscribe
     using WixToolset.Core.WindowsInstaller.Bind;
     using WixToolset.Data;
     using WixToolset.Data.WindowsInstaller;
-    using WixToolset.Extensibility.Data;
     using WixToolset.Extensibility.Services;
 
     internal class InscribeMsiPackageCommand
     {
-        public InscribeMsiPackageCommand(IInscribeContext context)
+        public InscribeMsiPackageCommand(IServiceProvider serviceProvider, string inputPath, string intermediateFolder, string outputPath)
         {
-            this.Context = context;
-            this.Messaging = context.ServiceProvider.GetService<IMessaging>();
-            this.WindowsInstallerBackendHelper = context.ServiceProvider.GetService<IWindowsInstallerBackendHelper>();
+            this.Messaging = serviceProvider.GetService<IMessaging>();
+            this.WindowsInstallerBackendHelper = serviceProvider.GetService<IWindowsInstallerBackendHelper>();
             this.TableDefinitions = new TableDefinitionCollection(WindowsInstallerTableDefinitions.All);
+            this.InputPath = inputPath;
+            this.IntermediateFolder = intermediateFolder;
+            this.OutputPath = outputPath;
         }
 
-        private IInscribeContext Context { get; }
+        private string InputPath { get; }
+
+        private string IntermediateFolder { get; }
+
+        private string OutputPath { get; }
 
         private IMessaging Messaging { get; }
 
@@ -39,14 +44,22 @@ namespace WixToolset.Core.WindowsInstaller.Inscribe
             var foundUnsignedExternals = false;
             var shouldCommit = false;
 
-            var attributes = File.GetAttributes(this.Context.InputFilePath);
+            var databasePath = this.OutputPath;
+
+            if (!String.Equals(this.InputPath, this.OutputPath, StringComparison.OrdinalIgnoreCase))
+            {
+                Directory.CreateDirectory(Path.GetDirectoryName(this.OutputPath));
+                File.Copy(this.InputPath, this.OutputPath, true);
+            }
+
+            var attributes = File.GetAttributes(databasePath);
             if (FileAttributes.ReadOnly == (attributes & FileAttributes.ReadOnly))
             {
-                this.Messaging.Write(ErrorMessages.ReadOnlyOutputFile(this.Context.InputFilePath));
+                this.Messaging.Write(ErrorMessages.ReadOnlyOutputFile(databasePath));
                 return shouldCommit;
             }
 
-            using (var database = new Database(this.Context.InputFilePath, OpenDatabase.Transact))
+            using (var database = new Database(databasePath, OpenDatabase.Transact))
             {
                 // Just use the English codepage, because the tables we're importing only have binary streams / MSI identifiers / other non-localizable content
                 var codepage = 1252;
@@ -65,8 +78,7 @@ namespace WixToolset.Core.WindowsInstaller.Inscribe
                     {
                         foreach (var digitalSignatureRecord in digitalSignatureView.Records)
                         {
-                            Row digitalSignatureRow = null;
-                            digitalSignatureRow = digitalSignatureTable.CreateRow(null);
+                            var digitalSignatureRow = digitalSignatureTable.CreateRow(null);
 
                             var table = digitalSignatureRecord.GetString(0);
                             var signObject = digitalSignatureRecord.GetString(1);
@@ -78,7 +90,7 @@ namespace WixToolset.Core.WindowsInstaller.Inscribe
                             if (false == digitalSignatureRecord.IsNull(3))
                             {
                                 // Export to a file, because the MSI API's require us to provide a file path on disk
-                                var hashPath = Path.Combine(this.Context.IntermediateFolder, "MsiDigitalSignature");
+                                var hashPath = Path.Combine(this.IntermediateFolder, "MsiDigitalSignature");
                                 var hashFileName = String.Concat(table, ".", signObject, ".bin");
 
                                 Directory.CreateDirectory(hashPath);
@@ -111,7 +123,7 @@ namespace WixToolset.Core.WindowsInstaller.Inscribe
                             var certificateId = digitalCertificateRecord.GetString(1); // get the identifier of the certificate
 
                             // Export to a file, because the MSI API's require us to provide a file path on disk
-                            var certPath = Path.Combine(this.Context.IntermediateFolder, "MsiDigitalCertificate");
+                            var certPath = Path.Combine(this.IntermediateFolder, "MsiDigitalCertificate");
                             Directory.CreateDirectory(certPath);
                             certPath = Path.Combine(certPath, String.Concat(certificateId, ".cer"));
 
@@ -147,7 +159,6 @@ namespace WixToolset.Core.WindowsInstaller.Inscribe
                     foreach (var mediaRecord in mediaView.Records)
                     {
                         X509Certificate2 cert2 = null;
-                        Row digitalSignatureRow = null;
 
                         var cabName = mediaRecord.GetString(4); // get the name of the cab
                                                                 // If there is no cabinet or it's an internal cab, skip it.
@@ -157,7 +168,7 @@ namespace WixToolset.Core.WindowsInstaller.Inscribe
                         }
 
                         var cabId = mediaRecord.GetString(1); // get the ID of the cab
-                        var cabPath = Path.Combine(Path.GetDirectoryName(this.Context.InputFilePath), cabName);
+                        var cabPath = Path.Combine(Path.GetDirectoryName(this.InputPath), cabName);
 
                         // If the cabs aren't there, throw an error but continue to catch the other errors
                         if (!File.Exists(cabPath))
@@ -207,7 +218,7 @@ namespace WixToolset.Core.WindowsInstaller.Inscribe
                             digitalCertificateRow[0] = certificateGeneratedId;
 
                             // Export to a file, because the MSI API's require us to provide a file path on disk
-                            var certPath = Path.Combine(this.Context.IntermediateFolder, "MsiDigitalCertificate");
+                            var certPath = Path.Combine(this.IntermediateFolder, "MsiDigitalCertificate");
                             Directory.CreateDirectory(certPath);
                             certPath = Path.Combine(certPath, String.Concat(cert2.Thumbprint, ".cer"));
                             File.Delete(certPath);
@@ -224,7 +235,7 @@ namespace WixToolset.Core.WindowsInstaller.Inscribe
                             certificates.Add(cert2.Thumbprint, certificateGeneratedId);
                         }
 
-                        digitalSignatureRow = digitalSignatureTable.CreateRow(null);
+                        var digitalSignatureRow = digitalSignatureTable.CreateRow(null);
 
                         digitalSignatureRow[0] = "Media";
                         digitalSignatureRow[1] = cabId;
@@ -234,7 +245,7 @@ namespace WixToolset.Core.WindowsInstaller.Inscribe
 
                 if (digitalCertificateTable.Rows.Count > 0)
                 {
-                    var command = new CreateIdtFileCommand(this.Messaging, digitalCertificateTable, codepage, this.Context.IntermediateFolder, true);
+                    var command = new CreateIdtFileCommand(this.Messaging, digitalCertificateTable, codepage, this.IntermediateFolder, true);
                     command.Execute();
 
                     database.Import(command.IdtPath);
@@ -243,7 +254,7 @@ namespace WixToolset.Core.WindowsInstaller.Inscribe
 
                 if (digitalSignatureTable.Rows.Count > 0)
                 {
-                    var command = new CreateIdtFileCommand(this.Messaging, digitalSignatureTable, codepage, this.Context.IntermediateFolder, true);
+                    var command = new CreateIdtFileCommand(this.Messaging, digitalSignatureTable, codepage, this.IntermediateFolder, true);
                     command.Execute();
 
                     database.Import(command.IdtPath);
@@ -257,7 +268,7 @@ namespace WixToolset.Core.WindowsInstaller.Inscribe
                 // If we did find external cabs but not all of them were signed, give a warning
                 if (foundUnsignedExternals)
                 {
-                    this.Messaging.Write(WarningMessages.ExternalCabsAreNotSigned(this.Context.InputFilePath));
+                    this.Messaging.Write(WarningMessages.ExternalCabsAreNotSigned(this.InputPath));
                 }
 
                 if (shouldCommit)
diff --git a/src/wix/WixToolset.Core.WindowsInstaller/InscribeSubcommand.cs b/src/wix/WixToolset.Core.WindowsInstaller/InscribeSubcommand.cs
new file mode 100644
index 00000000..d44fb0bd
--- /dev/null
+++ b/src/wix/WixToolset.Core.WindowsInstaller/InscribeSubcommand.cs
@@ -0,0 +1,80 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+namespace WixToolset.Core.WindowsInstaller
+{
+    using System;
+    using System.IO;
+    using System.Threading;
+    using System.Threading.Tasks;
+    using WixToolset.Core.WindowsInstaller.Inscribe;
+    using WixToolset.Extensibility.Services;
+
+    internal class InscribeSubcommand : WindowsInstallerSubcommandBase
+    {
+        public InscribeSubcommand(IServiceProvider serviceProvider)
+        {
+            this.ServiceProvider = serviceProvider;
+            this.Messaging = serviceProvider.GetService<IMessaging>();
+        }
+
+        private IServiceProvider ServiceProvider { get; }
+
+        private IMessaging Messaging { get; }
+
+        private string InputPath { get; set; }
+
+        private string IntermediateFolder { get; set; }
+
+        private string OutputPath { get; set; }
+
+        public override Task<int> ExecuteAsync(CancellationToken cancellationToken)
+        {
+            if (String.IsNullOrEmpty(this.InputPath))
+            {
+                Console.Error.WriteLine("Input MSI database is required");
+                return Task.FromResult(-1);
+            }
+
+            if (String.IsNullOrEmpty(this.IntermediateFolder))
+            {
+                this.IntermediateFolder = Path.GetTempPath();
+            }
+
+            if (String.IsNullOrEmpty(this.OutputPath))
+            {
+                this.OutputPath = this.InputPath;
+            }
+
+            var command = new InscribeMsiPackageCommand(this.ServiceProvider, this.InputPath, this.IntermediateFolder, this.OutputPath);
+            command.Execute();
+
+            return Task.FromResult(this.Messaging.LastErrorNumber);
+        }
+
+        public override bool TryParseArgument(ICommandLineParser parser, string argument)
+        {
+            if (parser.IsSwitch(argument))
+            {
+                var parameter = argument.Substring(1);
+                switch (parameter.ToLowerInvariant())
+                {
+                    case "intermediatefolder":
+                        this.IntermediateFolder = parser.GetNextArgumentAsDirectoryOrError(argument);
+                        return true;
+
+                    case "o":
+                    case "out":
+                        this.OutputPath = parser.GetNextArgumentAsFilePathOrError(argument);
+                        return true;
+                }
+            }
+            else if (String.IsNullOrEmpty(this.InputPath))
+            {
+                this.InputPath = argument;
+                return true;
+            }
+
+            return false;
+        }
+    }
+}
diff --git a/src/wix/WixToolset.Core.WindowsInstaller/MsiBackend.cs b/src/wix/WixToolset.Core.WindowsInstaller/MsiBackend.cs
index 3bd58c25..ab8def5f 100644
--- a/src/wix/WixToolset.Core.WindowsInstaller/MsiBackend.cs
+++ b/src/wix/WixToolset.Core.WindowsInstaller/MsiBackend.cs
@@ -2,6 +2,7 @@
 
 namespace WixToolset.Core.WindowsInstaller
 {
+    using System;
     using WixToolset.Core.WindowsInstaller.Bind;
     using WixToolset.Core.WindowsInstaller.Decompile;
     using WixToolset.Core.WindowsInstaller.Inscribe;
@@ -72,8 +73,9 @@ namespace WixToolset.Core.WindowsInstaller
 
         public bool Inscribe(IInscribeContext context)
         {
-            var command = new InscribeMsiPackageCommand(context);
-            return command.Execute();
+            //var command = new InscribeMsiPackageCommand(context);
+            //return command.Execute();
+            throw new NotImplementedException();
         }
 
         public Intermediate Unbind(IUnbindContext context)
diff --git a/src/wix/WixToolset.Core.WindowsInstaller/WindowsInstallerCommand.cs b/src/wix/WixToolset.Core.WindowsInstaller/WindowsInstallerCommand.cs
new file mode 100644
index 00000000..cedc65b2
--- /dev/null
+++ b/src/wix/WixToolset.Core.WindowsInstaller/WindowsInstallerCommand.cs
@@ -0,0 +1,73 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+namespace WixToolset.Core.WindowsInstaller
+{
+    using System;
+    using System.Threading;
+    using System.Threading.Tasks;
+    using WixToolset.Extensibility.Data;
+    using WixToolset.Extensibility.Services;
+
+    /// <summary>
+    /// Windows Installer specialized command.
+    /// </summary>
+    internal class WindowsInstallerCommand : ICommandLineCommand
+    {
+        public WindowsInstallerCommand(IServiceProvider serviceProvider)
+        {
+            this.ServiceProvider = serviceProvider;
+        }
+
+        public bool ShowHelp { get; set; }
+
+        public bool ShowLogo { get; set; }
+
+        public bool StopParsing { get; set; }
+
+        private IServiceProvider ServiceProvider { get; }
+
+        private WindowsInstallerSubcommandBase Subcommand { get; set; }
+
+        public Task<int> ExecuteAsync(CancellationToken cancellationToken)
+        {
+            if (this.ShowHelp || this.Subcommand is null)
+            {
+                DisplayHelp();
+                return Task.FromResult(1);
+            }
+
+            return this.Subcommand.ExecuteAsync(cancellationToken);
+        }
+
+        public bool TryParseArgument(ICommandLineParser parser, string argument)
+        {
+            if (this.Subcommand is null)
+            {
+                switch (argument.ToLowerInvariant())
+                {
+                    case "inscribe":
+                        this.Subcommand = new InscribeSubcommand(this.ServiceProvider);
+                        return true;
+                }
+
+                return false;
+            }
+
+            return this.Subcommand.TryParseArgument(parser, argument);
+        }
+
+        private static void DisplayHelp()
+        {
+            Console.WriteLine();
+            Console.WriteLine("Usage: wix msi inscribe input.msi [-intermedidateFolder folder] [-out output.msi]");
+            Console.WriteLine();
+            Console.WriteLine("Options:");
+            Console.WriteLine("  -h|--help         Show command line help.");
+            Console.WriteLine("  --nologo          Suppress displaying the logo information.");
+            Console.WriteLine();
+            Console.WriteLine("Commands:");
+            Console.WriteLine();
+            Console.WriteLine("  inscribe          Updates MSI database with cabinet signature information.");
+        }
+    }
+}
diff --git a/src/wix/WixToolset.Core.WindowsInstaller/WindowsInstallerExtensionCommandLine.cs b/src/wix/WixToolset.Core.WindowsInstaller/WindowsInstallerExtensionCommandLine.cs
new file mode 100644
index 00000000..4c516d0d
--- /dev/null
+++ b/src/wix/WixToolset.Core.WindowsInstaller/WindowsInstallerExtensionCommandLine.cs
@@ -0,0 +1,41 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+namespace WixToolset.Core.WindowsInstaller
+{
+    using System;
+    using System.Collections.Generic;
+    using WixToolset.Extensibility;
+    using WixToolset.Extensibility.Data;
+    using WixToolset.Extensibility.Services;
+
+    /// <summary>
+    /// Parses the "msi" command-line command. See <c>WindowsInstallerCommand</c>
+    /// for the bulk of the command-line processing.
+    /// </summary>
+    internal class WindowsInstallerExtensionCommandLine : BaseExtensionCommandLine
+    {
+        public WindowsInstallerExtensionCommandLine(IServiceProvider serviceProvider)
+        {
+            this.ServiceProvider = serviceProvider;
+        }
+
+        private IServiceProvider ServiceProvider { get; }
+
+        public override IReadOnlyCollection<ExtensionCommandLineSwitch> CommandLineSwitches => new ExtensionCommandLineSwitch[]
+        {
+            new ExtensionCommandLineSwitch { Switch = "msi", Description = "Windows Installer specialized operations." },
+        };
+
+        public override bool TryParseCommand(ICommandLineParser parser, string argument, out ICommandLineCommand command)
+        {
+            command = null;
+
+            if ("msi".Equals(argument, StringComparison.OrdinalIgnoreCase))
+            {
+                command = new WindowsInstallerCommand(this.ServiceProvider);
+            }
+
+            return command != null;
+        }
+    }
+}
diff --git a/src/wix/WixToolset.Core.WindowsInstaller/WindowsInstallerExtensionFactory.cs b/src/wix/WixToolset.Core.WindowsInstaller/WindowsInstallerExtensionFactory.cs
index 7b12fc8c..0eb4df5e 100644
--- a/src/wix/WixToolset.Core.WindowsInstaller/WindowsInstallerExtensionFactory.cs
+++ b/src/wix/WixToolset.Core.WindowsInstaller/WindowsInstallerExtensionFactory.cs
@@ -1,4 +1,4 @@
-// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
 
 namespace WixToolset.Core.WindowsInstaller
 {
@@ -7,11 +7,22 @@ namespace WixToolset.Core.WindowsInstaller
 
     internal class WindowsInstallerExtensionFactory : IExtensionFactory
     {
+        public WindowsInstallerExtensionFactory(IServiceProvider serviceProvider)
+        {
+            this.ServiceProvider = serviceProvider;
+        }
+
+        private IServiceProvider ServiceProvider { get; }
+
         public bool TryCreateExtension(Type extensionType, out object extension)
         {
             extension = null;
 
-            if (extensionType == typeof(IBackendFactory))
+            if (extensionType == typeof(IExtensionCommandLine))
+            {
+                extension = new WindowsInstallerExtensionCommandLine(this.ServiceProvider);
+            }
+            else if (extensionType == typeof(IBackendFactory))
             {
                 extension = new WindowsInstallerBackendFactory();
             }
diff --git a/src/wix/WixToolset.Core.WindowsInstaller/WindowsInstallerSubcommandBase.cs b/src/wix/WixToolset.Core.WindowsInstaller/WindowsInstallerSubcommandBase.cs
new file mode 100644
index 00000000..c5156a1d
--- /dev/null
+++ b/src/wix/WixToolset.Core.WindowsInstaller/WindowsInstallerSubcommandBase.cs
@@ -0,0 +1,15 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+namespace WixToolset.Core.WindowsInstaller
+{
+    using System.Threading;
+    using System.Threading.Tasks;
+    using WixToolset.Extensibility.Services;
+
+    internal abstract class WindowsInstallerSubcommandBase
+    {
+        public abstract bool TryParseArgument(ICommandLineParser parser, string argument);
+
+        public abstract Task<int> ExecuteAsync(CancellationToken cancellationToken);
+    }
+}
diff --git a/src/wix/WixToolset.Sdk/tools/wix.signing.targets b/src/wix/WixToolset.Sdk/tools/wix.signing.targets
index 5a4ea98d..3df05d51 100644
--- a/src/wix/WixToolset.Sdk/tools/wix.signing.targets
+++ b/src/wix/WixToolset.Sdk/tools/wix.signing.targets
@@ -11,6 +11,10 @@
   <UsingTask TaskName="GetCabList" AssemblyFile="$(WixTasksPath)" />
   <UsingTask TaskName="GetLooseFileList" AssemblyFile="$(WixTasksPath)" />
 
+  <UsingTask TaskName="InscribeMsiWithCabinetSignatures" Condition=" '$(WixTasksPath64)' == '' " AssemblyFile="$(WixTasksPath)" />
+  <UsingTask TaskName="InscribeMsiWithCabinetSignatures" Condition=" '$(WixTasksPath64)' != '' " AssemblyFile="$(WixTasksPath)" Architecture="x86" />
+  <UsingTask TaskName="InscribeMsiWithCabinetSignatures" Condition=" '$(WixTasksPath64)' != '' " AssemblyFile="$(WixTasksPath64)" Architecture="x64" />
+
   <!-- Default Inscribe properties. -->
   <PropertyGroup>
     <InscribeNoLogo Condition=" '$(InscribeNoLogo)' == '' ">$(NoLogo)</InscribeNoLogo>
@@ -21,6 +25,10 @@
     <InscribeVerboseOutput Condition=" '$(InscribeVerboseOutput)' == '' ">$(VerboseOutput)</InscribeVerboseOutput>
   </PropertyGroup>
 
+  <PropertyGroup>
+    <SignOutputCabs Condition=" '$(SignOutputCabs)'=='' ">$(SignOutput)</SignOutputCabs>
+  </PropertyGroup>
+
   <!--
   ==================================================================================================
   Signing
@@ -58,7 +66,7 @@
   <Target
       Name="Signing"
       DependsOnTargets="$(SigningDependsOn)"
-      Inputs="$(TargetPath)"
+      Inputs="@(_WixBuildOutputFile)"
       Outputs="$(SignedFilePath)"
       Condition=" '$(SignOutput)' == 'true' ">
 
@@ -76,7 +84,7 @@
   <Target
       Name="CalculateSignTargetFiles">
     <ItemGroup>
-      <SignTargetPath Include="$(TargetPath)" />
+      <SignTargetPath Include="@(_WixBuildOutputFile)" />
     </ItemGroup>
   </Target>
 
@@ -98,7 +106,8 @@
   <Target
       Name="GetCabsToSign"
       Inputs="@(SignTargetPath)"
-      Outputs="$(SignedFilePath)">
+      Outputs="$(SignedFilePath)"
+      Condition=" '$(SignOutputCabs)' == 'true' ">
     <GetCabList Database="%(SignTargetPath.FullPath)">
       <Output TaskParameter="CabList" ItemName="SignCabs" />
       <Output TaskParameter="CabList" ItemName="FileWrites" />
@@ -174,18 +183,22 @@
       Outputs="$(SignedFilePath)"
       Condition=" '@(SignCabs)' != '' ">
 
-    <Insignia
+    <InscribeMsiWithCabinetSignatures
         DatabaseFile="%(SignTargetPath.FullPath)"
         OutputFile="%(SignTargetPath.FullPath)"
-        ToolPath="$(WixToolPath)"
+        IntermediateDirectory="%(SignTargetPath.RootDir)%(SignTargetPath.Directory)"
+
         NoLogo="$(InscribeNoLogo)"
-        RunAsSeparateProcess="$(RunWixToolsOutOfProc)"
         SuppressAllWarnings="$(InscribeSuppressAllWarnings)"
         SuppressSpecificWarnings="$(InscribeSuppressSpecificWarnings)"
         TreatWarningsAsErrors="$(InscribeTreatWarningsAsErrors)"
         TreatSpecificWarningsAsErrors="$(InscribeTreatSpecificWarningsAsErrors)"
         VerboseOutput="$(InscribeVerboseOutput)"
-        AdditionalOptions="$(InscribeAdditionalOptions)" />
+        AdditionalOptions="$(InscribeAdditionalOptions)"
+
+        RunAsSeparateProcess="$(RunWixToolsOutOfProc)"
+        ToolExe="$(WixToolExe)"
+        ToolPath="$(WixToolDir)" />
   </Target>
 
   <!--
diff --git a/src/wix/test/WixToolsetTest.CoreIntegration/SigningFixture.cs b/src/wix/test/WixToolsetTest.CoreIntegration/SigningFixture.cs
new file mode 100644
index 00000000..79896172
--- /dev/null
+++ b/src/wix/test/WixToolsetTest.CoreIntegration/SigningFixture.cs
@@ -0,0 +1,66 @@
+// Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
+
+namespace WixToolsetTest.CoreIntegration
+{
+    using System.IO;
+    using WixBuildTools.TestSupport;
+    using WixToolset.Core.TestPackage;
+    using Xunit;
+
+    public class SigningFixture
+    {
+        [Fact]
+        public void CanInscribeMsiWithSignedCabinet()
+        {
+            var folder = TestData.Get(@"TestData\SingleFileCompressed");
+            var signedFolder = TestData.Get(@"TestData\.Data");
+
+            using (var fs = new DisposableFileSystem())
+            {
+                var baseFolder = fs.GetFolder();
+                var intermediateFolder = Path.Combine(baseFolder, "obj");
+                var outputMsi = Path.Combine(intermediateFolder, @"bin\test.msi");
+                var signedMsi = Path.Combine(baseFolder, @"signed.msi");
+
+                var result = WixRunner.Execute(new[]
+                {
+                    "build",
+                    Path.Combine(folder, "Package.wxs"),
+                    Path.Combine(folder, "PackageComponents.wxs"),
+                    "-loc", Path.Combine(folder, "Package.en-us.wxl"),
+                    "-bindpath", Path.Combine(folder, "data"),
+                    "-intermediateFolder", intermediateFolder,
+                    "-o", outputMsi
+                });
+
+                result.AssertSuccess();
+
+                var beforeRows = Query.QueryDatabase(outputMsi, new[] { "MsiDigitalSignature", "MsiDigitalCertificate" });
+                Assert.Empty(beforeRows);
+
+                // Swap in a pre-signed cabinet since signing during the unit test
+                // is a challenge. The cabinet contents almost definitely don't
+                // match but that's okay for these testing purposes.
+                File.Copy(Path.Combine(signedFolder, "signed_cab1.cab"), Path.Combine(Path.GetDirectoryName(outputMsi), "example.cab"), true);
+
+                result = WixRunner.Execute(new[]
+                {
+                    "msi",
+                    "inscribe",
+                    outputMsi,
+                    "-o", signedMsi,
+                    "-intermediateFolder", intermediateFolder,
+                });
+
+                result.AssertSuccess();
+
+                var rows = Query.QueryDatabase(signedMsi, new[] { "MsiDigitalSignature", "MsiDigitalCertificate" });
+                WixAssert.CompareLineByLine(new[]
+                {
+                    "MsiDigitalCertificate:cer8xpsawK5TG4sIx4em8F.i7ocIKU\t[Binary data]",
+                    "MsiDigitalSignature:Media\t1\tcer8xpsawK5TG4sIx4em8F.i7ocIKU\t"
+                }, rows);
+            }
+        }
+    }
+}