Add XSLT Transform for apphost (#9609)

To avoid sign check whitelist apphost.exe name changes very build. Sign check uses File Id in MSI as whitelist name. Template apphost.exe get a new "File Id" in msi different every time (since File Id is generated according to file path, and file path has version number). Use XSLT tranform to match the file path contains "AppHostTemplate\apphost.exe" and give it the same ID all the time.

build/package/Installer.MSI.targets

@@ -14,6 +14,7 @@
       <CombinedFrameworkSdkHostBundleEngineName>$(InstallerOutputDirectory)/$(ArtifactNameWithVersionCombinedHostHostFxrFrameworkSdk)-engine.exe</CombinedFrameworkSdkHostBundleEngineName>
 
       <SdkGenerateMsiPowershellScript>$(RepoRoot)/packaging/windows/clisdk/generatemsi.ps1</SdkGenerateMsiPowershellScript>
+      <SdkStableFileIdForApphostTransform>$(RepoRoot)/packaging/windows/clisdk/stablefileidforapphosttransform.xslt</SdkStableFileIdForApphostTransform>
       <SdkGenerateBundlePowershellScript>$(RepoRoot)/packaging/windows/clisdk/generatebundle.ps1</SdkGenerateBundlePowershellScript>
       <SdkGenerateNupkgPowershellScript>$(RepoRoot)/packaging/windows/clisdk/generatenupkg.ps1</SdkGenerateNupkgPowershellScript>
 
@@ -110,7 +111,9 @@
                       '$(SimpleVersion)'
                       '$(NugetVersion)'
                       '$(SdkInstallerUpgradeCode)'
-                      '$(Architecture)'" />
+                      '$(Architecture)'
+                      '$(SdkStableFileIdForApphostTransform)'
+                      " />
     </Target>
 
     <Target Name="GenerateMSBuildExtensionsMsi"

packaging/windows/clisdk/StableFileIdForApphostTransform.xslt

@@ -0,0 +1,26 @@
+<xsl:stylesheet version="1.0"
+            xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+            xmlns:msxsl="urn:schemas-microsoft-com:xslt"
+            exclude-result-prefixes="msxsl"
+            xmlns:wix="http://schemas.microsoft.com/wix/2006/wi"
+            xmlns:my="my:my">
+
+    <xsl:output method="xml" indent="yes" />
+
+    <xsl:strip-space elements="*"/>
+
+    <xsl:template match="@*|node()">
+        <xsl:copy>
+            <xsl:apply-templates select="@*|node()"/>
+        </xsl:copy>
+    </xsl:template>
+
+    <xsl:template match='wix:Wix/wix:Fragment/wix:ComponentGroup/wix:Component/wix:File[contains(@Source, "AppHostTemplate\apphost.exe")]'>
+        <xsl:copy>
+            <xsl:apply-templates select="@*"/>
+            <xsl:attribute name="Id">
+                <xsl:text>apphosttemplateapphostexe</xsl:text>
+            </xsl:attribute>
+        </xsl:copy>
+    </xsl:template>
+</xsl:stylesheet>

packaging/windows/clisdk/generatemsi.ps1

@@ -10,7 +10,8 @@ param(
     [Parameter(Mandatory=$true)][string]$DotnetCLIDisplayVersion,
     [Parameter(Mandatory=$true)][string]$DotnetCLINugetVersion,
     [Parameter(Mandatory=$true)][string]$UpgradeCode,
-    [Parameter(Mandatory=$true)][string]$Architecture
+    [Parameter(Mandatory=$true)][string]$Architecture,
+    [Parameter(Mandatory=$true)][string]$StableFileIdForApphostTransform
 )
 
 . "$PSScriptRoot\..\..\..\scripts\common\_common.ps1"
@@ -26,7 +27,19 @@ function RunHeat
 
     Write-Output Running heat..
 
-    .\heat.exe dir `"$inputDir`" -template fragment -sreg -gg -var var.DotnetSrc -cg InstallFiles -srd -dr DOTNETHOME -out $InstallFileswsx | Out-Host
+    # -t $StableFileIdForApphostTransform to avoid sign check baseline apphost.exe name changes every build. Sign check uses File Id in MSI as whitelist name.
+    # Template apphost.exe get a new "File Id" in msi different every time (since File Id is generated according to file
+    # path, and file path has version number)
+    # use XSLT tranform to match the file path contains "AppHostTemplate\apphost.exe" and give it the same ID all the time.
+
+    .\heat.exe dir `"$inputDir`" -template fragment  `
+        -sreg -gg  `
+        -var var.DotnetSrc  `
+        -cg InstallFiles  `
+        -srd  `
+        -dr DOTNETHOME  `
+        -t $StableFileIdForApphostTransform  `
+        -out $InstallFileswsx | Out-Host
 
     if($LastExitCode -ne 0)
     {