Skip to content

[SignTool] Improve memory usage for large files when DryRun signing #15927

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

akoeplinger
Copy link
Member

@akoeplinger akoeplinger commented Jun 23, 2025

We can avoid creating a MemoryStream copy of files in .nupkg by calling ZipArchiveEntry.Open() separately for computing the content hash.

This drops the memory usage from 1.1GB to 170MB (30MB with second fix, see below) when processing the android runtime pack.

Contributes to dotnet/dotnet#969

if (peHeaders.PEHeader.CheckSum == 0)
{
return false;
}
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an unrelated fix but it allows dropping the memory usage further from 170MB -> 30MB when processing the android runtime pack since we avoid allocating the peBuffer (i.e. a complete copy of the .dll)

I'd appreciate a second set of eyes on this, from what I've seen the checksum shouldn't be zero when the file is signed, but I could be wrong.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is valid, based on lines 83-86 and the corresponding signing code. If the checksum was null, then for sure we would fail the checksum validation below. I wrote the sn verification to match the native sn.exe implementation.

{
// the stream returned by zipArchiveEntry.Open() isn't seekable,
// we can avoid creating a MemoryStream copy by just opening a separate instance for computing the content hash
using var contentHashStream = zipArchiveEntry.Open();
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Slick. I like it.

@akoeplinger
Copy link
Member Author

I'll look at the test failures, they are related

@mmitche
Copy link
Member

mmitche commented Jun 23, 2025

I took a quick look. On the surface, the tar.gz entries that are directory entries have a null content stream. But there are additional issues below that.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants