diff --git a/eng/ManualVersions.props b/eng/ManualVersions.props
index cb76746e4..a5b100458 100644
--- a/eng/ManualVersions.props
+++ b/eng/ManualVersions.props
@@ -9,8 +9,8 @@
      Basically: In this file, choose the highest version when resolving merge conflicts.
  -->
   <PropertyGroup>
-    <MicrosoftWindowsSDKNETRef10_0_17763PackageVersion>10.0.17763.3-preview</MicrosoftWindowsSDKNETRef10_0_17763PackageVersion>
-    <MicrosoftWindowsSDKNETRef10_0_18362PackageVersion>10.0.18362.4-preview</MicrosoftWindowsSDKNETRef10_0_18362PackageVersion>
-    <MicrosoftWindowsSDKNETRef10_0_19041PackageVersion>10.0.19041.3-preview</MicrosoftWindowsSDKNETRef10_0_19041PackageVersion>
+    <MicrosoftWindowsSDKNETRef10_0_17763PackageVersion>10.0.17763.10</MicrosoftWindowsSDKNETRef10_0_17763PackageVersion>
+    <MicrosoftWindowsSDKNETRef10_0_18362PackageVersion>10.0.18362.10</MicrosoftWindowsSDKNETRef10_0_18362PackageVersion>
+    <MicrosoftWindowsSDKNETRef10_0_19041PackageVersion>10.0.19041.10</MicrosoftWindowsSDKNETRef10_0_19041PackageVersion>
   </PropertyGroup>
 </Project>
diff --git a/eng/Publishing.props b/eng/Publishing.props
index 9520cf240..e34b66cc2 100644
--- a/eng/Publishing.props
+++ b/eng/Publishing.props
@@ -8,7 +8,6 @@
   <PropertyGroup>
     <Product>Sdk</Product>
     <BlobStoragePartialRelativePath>$(Product)</BlobStoragePartialRelativePath>
-    <BlobStoragePartialRelativePath Condition="'$(IsNotOrchestratedPublish)' == 'false'">assets/$(Product)</BlobStoragePartialRelativePath>
     <ChecksumsFeedUrl>$(DotnetPublishChecksumsBlobFeedUrl)</ChecksumsFeedUrl>
     <SdkAssetsFeedUrl>$(DotnetPublishSdkAssetsBlobFeedUrl)</SdkAssetsFeedUrl>
 
@@ -56,10 +55,8 @@
       <BaseAssetManifestFileName>$(AssetManifestOS)</BaseAssetManifestFileName>
       <BaseAssetManifestFileName Condition="'$(AGENT_JOBNAME)' == '' and '$(Architecture)' != ''">$(AssetManifestOS)-$(Architecture)</BaseAssetManifestFileName>
       <InstallersAssetManifestFileName>$(BaseAssetManifestFileName)-installers</InstallersAssetManifestFileName>
-      <ChecksumsAssetManifestFileName>$(BaseAssetManifestFileName)-checksums</ChecksumsAssetManifestFileName>
       <!-- Property AssetManifestFilePath would be reassigned by the Arcade SDK, so use a different name (InstallersAssetManifestFilePath) -->
       <InstallersAssetManifestFilePath>$(ArtifactsLogDir)AssetManifest\$(InstallersAssetManifestFileName).xml</InstallersAssetManifestFilePath>
-      <ChecksumsAssetManifestFilePath>$(ArtifactsLogDir)AssetManifest\$(ChecksumsAssetManifestFileName).xml</ChecksumsAssetManifestFilePath>
 
       <DotnetTempWorkingDirectory>$(ArtifactsDir)..\DotnetAssetsTmpDir\$([System.Guid]::NewGuid())</DotnetTempWorkingDirectory>
       <ChecksumTempWorkingDirectory>$(ArtifactsDir)..\ChecksumAssetsTmpDir\$([System.Guid]::NewGuid())</ChecksumTempWorkingDirectory>
@@ -119,26 +116,29 @@
       </ChecksumsToPushToBlobFeed>
     </ItemGroup>
 
+    <PropertyGroup>
+      <IsStableBuild>false</IsStableBuild>
+      <IsStableBuild Condition="'$(DotNetFinalVersionKind)' == 'release'">true</IsStableBuild>
+    </PropertyGroup>
+
     <PushToAzureDevOpsArtifacts
-      ItemsToPush="@(SdkAssetsToPushToBlobFeed)"
+      AzureDevOpsCollectionUri="$(SYSTEM_TEAMFOUNDATIONCOLLECTIONURI)"
+      AzureDevOpsProject="$(SYSTEM_TEAMPROJECT)"
+      AzureDevOpsBuildId="$(BUILD_BUILDID)"
+      ItemsToPush="@(SdkAssetsToPushToBlobFeed);@(ChecksumsToPushToBlobFeed)"
+      ItemsToSign="@(ItemsToSignPostBuild)"
+      CertificatesSignInfo="@(CertificatesSignInfo)"
+      StrongNameSignInfo="@(StrongNameSignInfo)"
+      FileSignInfo="@(FileSignInfo)"
+      FileExtensionSignInfo="@(FileExtensionSignInfo)"
       ManifestBuildData="@(ManifestBuildData)"
-      ManifestRepoUri="$(BUILD_REPOSITORY_NAME)"
+      ManifestRepoName="$(BUILD_REPOSITORY_NAME)"
       ManifestBranch="$(BUILD_SOURCEBRANCH)"
       ManifestBuildId="$(BUILD_BUILDNUMBER)"
       ManifestCommit="$(BUILD_SOURCEVERSION)"
       AssetManifestPath="$(InstallersAssetManifestFilePath)"
       PublishFlatContainer="true"
-      PublishingVersion="3"/>
-
-    <PushToAzureDevOpsArtifacts
-      ItemsToPush="@(ChecksumsToPushToBlobFeed)"
-      ManifestBuildData="@(ManifestBuildData)"
-      ManifestRepoUri="$(BUILD_REPOSITORY_NAME)"
-      ManifestBranch="$(BUILD_SOURCEBRANCH)"
-      ManifestBuildId="$(BUILD_BUILDNUMBER)"
-      ManifestCommit="$(BUILD_SOURCEVERSION)"
-      AssetManifestPath="$(ChecksumsAssetManifestFilePath)"
-      PublishFlatContainer="true" 
-      PublishingVersion="3"/>
+      IsStableBuild="$(IsStableBuild)"
+      PublishingVersion="3" />
   </Target>
 </Project>
diff --git a/eng/SignCheckExclusionsFile.txt b/eng/SignCheckExclusionsFile.txt
new file mode 100644
index 000000000..ea5b10fb8
--- /dev/null
+++ b/eng/SignCheckExclusionsFile.txt
@@ -0,0 +1,4 @@
+;; Exclusions for SignCheck.
+;; Format: https://github.com/dotnet/arcade/blob/397316e195639450b6c76bfeb9823b40bee72d6d/src/SignCheck/Microsoft.SignCheck/Verification/Exclusion.cs#L23-L35
+
+*.js;; We do not sign JavaScript files.
diff --git a/eng/Signing.props b/eng/Signing.props
index 17360d175..bac80eb60 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -1,16 +1,56 @@
 <Project>
 
   <ItemGroup>
-    <!-- Do not sign non-shipping packages -->
+    <!-- Do not sign non-shipping packages when doing in-build signing -->
     <ItemsToSign Remove="$(ArtifactsNonShippingPackagesDir)**\*.nupkg" />
   </ItemGroup>
 
+  <ItemGroup Condition="'$(PostBuildSign)' == 'true'">
+    <ItemsToSignPostBuild Include="$(ArtifactsShippingPackagesDir)*.zip" />
+    <ItemsToSignPostBuild Include="$(ArtifactsShippingPackagesDir)*.exe" />
+    <ItemsToSignPostBuild Include="$(ArtifactsShippingPackagesDir)*.msi" />
+    <ItemsToSignPostBuild Include="$(ArtifactsShippingPackagesDir)*.nupkg" />
+    <ItemsToSignPostBuild Include="$(ArtifactsNonShippingPackagesDir)*.msi" />
+    <ItemsToSignPostBuild Include="$(ArtifactsNonShippingPackagesDir)*.zip" />
+    <ItemsToSignPostBuild Include="$(ArtifactsNonShippingPackagesDir)*.nupkg" />
+  </ItemGroup>
+
   <PropertyGroup>
+    <ExternalCertificateId Condition="'$(ExternalCertificateId)' == ''">3PartySHA2</ExternalCertificateId>
+    <InternalCertificateId Condition="'$(InternalCertificateId)' == ''">Microsoft400</InternalCertificateId>
+
     <!--
       Signing of shipping artifacts (layout, msi, bundle) are handled separately.
-      It is therefore expected that above removal can yield an empty set.
+      It is therefore expected that <ItemsToSign> could be an empty set.
     -->
     <AllowEmptySignList>true</AllowEmptySignList>
   </PropertyGroup>
 
+  <ItemGroup>
+    <FileSignInfo Include="Newtonsoft.Json.dll" CertificateName="$(ExternalCertificateId)" />
+    <FileSignInfo Include="MessagePack.Annotations.dll" CertificateName="$(ExternalCertificateId)" />
+    <FileSignInfo Include="MessagePack.dll" CertificateName="$(ExternalCertificateId)" />
+    <FileSignInfo Include="Nerdbank.Streams.dll" CertificateName="$(ExternalCertificateId)" />
+    <FileSignInfo Include="StreamJsonRpc.dll" CertificateName="$(ExternalCertificateId)" />
+
+    <!-- Files in the layout that should not be signed -->
+    <FileSignInfo Include="apphost.exe" CertificateName="None" />
+
+    <!-- These are 3rd party nupkgs and should not be signed with an MS cert -->
+    <FileSignInfo Include="nunit3.dotnetnew.template.$(NUnit3Templates21PackageVersion).nupkg" CertificateName="None" />
+    <FileSignInfo Include="nunit3.dotnetnew.template.$(NUnit3Templates30PackageVersion).nupkg" CertificateName="None" />
+    <FileSignInfo Include="nunit3.dotnetnew.template.$(NUnit3Templates31PackageVersion).nupkg" CertificateName="None" />
+    <FileSignInfo Include="nunit3.dotnetnew.template.$(NUnit3Templates50PackageVersion).nupkg" CertificateName="None" />
+
+    <FileExtensionSignInfo Include=".msi" CertificateName="$(InternalCertificateId)" />
+    <!-- .ttf and .js files come in from some older aspnetcore packages (e.g. 2.1).
+          These files in the 5.0 packages are NOT signed. When doing postbuild signing,
+          SignTool will recognize that the files in the installer zips came from the 5.0 packages
+          pulled in from aspnetcore, and aspnetcore said not to sign them. This info is not
+          available for the 2.1 packages, so we need to avoid signing these in this repo. -->
+    <FileExtensionSignInfo Include=".ttf" CertificateName="None" />
+    <FileExtensionSignInfo Remove=".js" />
+    <FileExtensionSignInfo Include=".js" CertificateName="None" />
+  </ItemGroup>
+
 </Project>
diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
index d25e541ff..45d3cb6f1 100644
--- a/eng/Version.Details.xml
+++ b/eng/Version.Details.xml
@@ -59,6 +59,10 @@
       <Uri>https://github.com/dotnet/aspnetcore</Uri>
       <Sha>b866b765b3493c7943829ce830e509d61f958102</Sha>
     </Dependency>
+    <Dependency Name="Microsoft.EntityFrameworkCore" Version="6.0.0-alpha.1.20509.5" CoherentParentDependency="Microsoft.AspNetCore.App.Runtime.win-x64">
+      <Uri>https://github.com/dotnet/efcore</Uri>
+      <Sha>2352499b52cdfc95ddcfd81c4967e12512e00eee</Sha>
+    </Dependency>
     <Dependency Name="dotnet-dev-certs" Version="6.0.0-alpha.1.20513.8" CoherentParentDependency="Microsoft.NET.Sdk">
       <Uri>https://github.com/dotnet/aspnetcore</Uri>
       <Sha>be472db60f4711404ba5de268f7b9d4a887926f8</Sha>
diff --git a/eng/Versions.props b/eng/Versions.props
index eceb56500..60518f467 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -119,7 +119,7 @@
     <MicrosoftDotnetWinFormsProjectTemplates31PackageVersion>4.8.1-servicing.19605.5</MicrosoftDotnetWinFormsProjectTemplates31PackageVersion>
     <MicrosoftDotNetWpfProjectTemplates31PackageVersion>3.1.2-servicing.20066.4</MicrosoftDotNetWpfProjectTemplates31PackageVersion>
     <NUnit3Templates31PackageVersion>1.7.2</NUnit3Templates31PackageVersion>
-    <MicrosoftDotNetCommonItemTemplates31PackageVersion>3.1.2</MicrosoftDotNetCommonItemTemplates31PackageVersion>
+    <MicrosoftDotNetCommonItemTemplates31PackageVersion>3.1.8</MicrosoftDotNetCommonItemTemplates31PackageVersion>
     <MicrosoftDotNetCommonProjectTemplates31PackageVersion>$(MicrosoftDotNetCommonItemTemplates31PackageVersion)</MicrosoftDotNetCommonProjectTemplates31PackageVersion>
     <MicrosoftDotNetTestProjectTemplates31PackageVersion>$(MicrosoftDotNetTestProjectTemplates50PackageVersion)</MicrosoftDotNetTestProjectTemplates31PackageVersion>
     <AspNetCorePackageVersionFor31Templates>3.1.9</AspNetCorePackageVersionFor31Templates>
diff --git a/eng/dockerrun.sh b/eng/dockerrun.sh
index 63d75b53c..69e7d5471 100755
--- a/eng/dockerrun.sh
+++ b/eng/dockerrun.sh
@@ -166,6 +166,7 @@ docker run $INTERACTIVE -t --rm --sig-proxy=true \
     -e BUILD_BUILDID \
     -e BUILD_SOURCEVERSION \
     -e SYSTEM_TEAMPROJECT \
+    -e POSTBUILDSIGN \
     -e SYSTEM_DEFINITIONID \
     -e SYSTEM_TEAMFOUNDATIONCOLLECTIONURI \
     -e DOTNETCLIMSRC_READ_SAS_TOKEN \
diff --git a/src/redist/targets/GenerateBundledVersions.targets b/src/redist/targets/GenerateBundledVersions.targets
index 00ea258f3..60a9d248b 100644
--- a/src/redist/targets/GenerateBundledVersions.targets
+++ b/src/redist/targets/GenerateBundledVersions.targets
@@ -40,9 +40,9 @@
       <_AspNet50RuntimePackVersion>5.0.0-rc.2.20475.17</_AspNet50RuntimePackVersion>
       <_AspNet50TargetingPackVersion>5.0.0-rc.2.20475.17</_AspNet50TargetingPackVersion>
 
-      <_NETCoreApp31RuntimePackVersion>3.1.7</_NETCoreApp31RuntimePackVersion>
+      <_NETCoreApp31RuntimePackVersion>3.1.9</_NETCoreApp31RuntimePackVersion>
       <_NETCoreApp31TargetingPackVersion>3.1.0</_NETCoreApp31TargetingPackVersion>
-      <_WindowsDesktop31RuntimePackVersion>3.1.2</_WindowsDesktop31RuntimePackVersion>
+      <_WindowsDesktop31RuntimePackVersion>3.1.9</_WindowsDesktop31RuntimePackVersion>
       <_WindowsDesktop31TargetingPackVersion>3.1.0</_WindowsDesktop31TargetingPackVersion>
       <_AspNet31RuntimePackVersion>3.1.9</_AspNet31RuntimePackVersion>
       <_AspNet31TargetingPackVersion>3.1.8</_AspNet31TargetingPackVersion>
@@ -159,7 +159,7 @@
       <ImplicitPackageVariable Include="Microsoft.NETCore.App"
                                TargetFrameworkVersion="2.1"
                                DefaultVersion="2.1.0"
-                               LatestVersion="2.1.17" />
+                               LatestVersion="2.1.23" />
       <ImplicitPackageVariable Include="Microsoft.NETCore.App"
                                TargetFrameworkVersion="2.2"
                                DefaultVersion="2.2.0"
@@ -167,11 +167,11 @@
       <ImplicitPackageVariable Include="Microsoft.AspNetCore.App"
                                TargetFrameworkVersion="2.1"
                                DefaultVersion="2.1.1"
-                               LatestVersion="2.1.17"/>
+                               LatestVersion="2.1.23"/>
       <ImplicitPackageVariable Include="Microsoft.AspNetCore.All"
                                TargetFrameworkVersion="2.1"
                                DefaultVersion="2.1.1"
-                               LatestVersion="2.1.17"/>
+                               LatestVersion="2.1.23"/>
 
       <ImplicitPackageVariable Include="Microsoft.AspNetCore.App"
                                TargetFrameworkVersion="2.2"
diff --git a/src/redist/targets/Signing.targets b/src/redist/targets/Signing.targets
index 10e927a13..dbaacdbc2 100644
--- a/src/redist/targets/Signing.targets
+++ b/src/redist/targets/Signing.targets
@@ -3,54 +3,13 @@
      <PackageReference Include="Microsoft.DotNet.SignTool" Version="$(MicrosoftDotNetSignToolVersion)" PrivateAssets="All"  />
   </ItemGroup>
 
+  <!-- Import Arcade's Sign.props, when then imports the eng/Signing.props for this repo -->
+  <Import Project="../tools/Sign.props" Sdk="Microsoft.DotNet.Arcade.Sdk" />
+    
   <Target Name="SetSignProps"
           Condition="'$(SignCoreSdk)' == 'true'">
 
     <MakeDir Directories="$(ArtifactsTmpDir)" Condition="!Exists('$(ArtifactsTmpDir)')" />
-    
-    <PropertyGroup>
-      <ExternalCertificateId Condition="'$(ExternalCertificateId)' == ''">3PartySHA2</ExternalCertificateId>
-      <InternalCertificateId Condition="'$(InternalCertificateId)' == ''">Microsoft400</InternalCertificateId>
-      <NugetCertificateId Condition="'$(NugetCertificateId)' == ''">NuGet</NugetCertificateId>
-    </PropertyGroup>
-
-
-    <!-- Logic copied from https://github.com/dotnet/arcade/blob/master/src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.proj -->
-
-    <ItemGroup>
-      <!--
-      This is intended to hold information about the certificates used for signing.
-      For now the only information required is whether or not the certificate can be
-      used for signing already signed files - DualSigningAllowed==true.
-    -->
-      <CertificatesSignInfo Include="3PartyDual" DualSigningAllowed="true" />
-      <CertificatesSignInfo Include="3PartySHA2" DualSigningAllowed="true" />
-
-      <!-- List of container files that will be opened and checked for files that need to be signed. -->
-      <!--<ItemsToSign Include="$(ArtifactsPackagesDir)**\*.nupkg" />
-      <ItemsToSign Include="$(VisualStudioSetupOutputPath)**\*.vsix" />-->
-
-      <!--
-      Map of file extensions to default certificate name. Files with these extensions are
-      signed with the specified certificate. Particularly useful for files that don't have
-      a public key token.
-      The certificate can be overriden using the StrongNameSignInfo or the FileSignInfo item group.
-    -->
-      <FileExtensionSignInfo Include=".jar" CertificateName="MicrosoftJAR" />
-      <FileExtensionSignInfo Include=".js;.ps1;.psd1;.psm1;.psc1;.py" CertificateName="Microsoft400" />
-      <FileExtensionSignInfo Include=".dll;.exe" CertificateName="Microsoft400" />
-      <FileExtensionSignInfo Include=".nupkg" CertificateName="NuGet" />
-      <FileExtensionSignInfo Include=".vsix" CertificateName="VsixSHA2" />
-      <FileExtensionSignInfo Include=".zip" CertificateName="None" />
-    </ItemGroup>
-
-    <PropertyGroup>
-      <!-- Control whether an empty ItemsToSign item group is allowed when calling SignToolTask. -->
-      <AllowEmptySignList>false</AllowEmptySignList>
-    </PropertyGroup>
-
-    <!-- Allow repository to customize signing configuration -->
-    <!--<Import Project="$(RepositoryEngineeringDir)Signing.props" Condition="Exists('$(RepositoryEngineeringDir)Signing.props')" />-->
 
     <!-- Logic copied from https://github.com/dotnet/arcade/blob/master/src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.proj -->
     <Error Text="The value of DotNetSignType is invalid: '$(DotNetSignType)'"
@@ -81,53 +40,41 @@
   </Target>
   
   <Target Name="SignLayout"
-          Condition="'$(SignCoreSdk)' == 'true'"
+          Condition="'$(SignCoreSdk)' == 'true' and '$(PostBuildSign)' != 'true'"
           DependsOnTargets="SetSignProps">
 
     <ItemGroup>
-      <!-- External files -->
-      <LayoutFilesToSign Include="$(SdkOutputDirectory)**/Newtonsoft.Json.dll;
-                            $(SdkOutputDirectory)**/MessagePack.Annotations.dll;
-                            $(SdkOutputDirectory)**/MessagePack.dll;
-                            $(SdkOutputDirectory)**/Nerdbank.Streams.dll;
-                            $(SdkOutputDirectory)**/StreamJsonRpc.dll">
-        <CertificateName>$(ExternalCertificateId)</CertificateName>
-      </LayoutFilesToSign>
-      <!-- Built binaries -->
       <LayoutFilesToSign Include="$(SdkOutputDirectory)**/csc.exe;
-                            $(SdkOutputDirectory)**/csc.dll;
-                            $(SdkOutputDirectory)**/VBCSCompiler.dll;
-                            $(SdkOutputDirectory)**/vbc.exe;
-                            $(SdkOutputDirectory)**/vbc.dll;
-                            $(SdkOutputDirectory)**/fsc.exe;
-                            $(SdkOutputDirectory)**/fsi.exe;
-                            $(SdkOutputDirectory)**/FSharp.*.dll;
-                            $(SdkOutputDirectory)**/Interactive.DependencyManager.dll;
-                            $(SdkOutputDirectory)**/dotnet.dll;
-                            $(SdkOutputDirectory)**/dotnet.resources.dll;
-                            $(SdkOutputDirectory)**/System.*.dll;
-                            $(SdkOutputDirectory)**/Microsoft.*.dll;
-                            $(SdkOutputDirectory)**/NuGet*.dll;
-                            $(SdkOutputDirectory)**/datacollector.dll;
-                            $(SdkOutputDirectory)**/datacollector.exe;
-                            $(SdkOutputDirectory)**/MSBuild.dll;
-                            $(SdkOutputDirectory)**/MSBuild.resources.dll;
-                            $(SdkOutputDirectory)**/PresentationBuildTasks.dll;
-                            $(SdkOutputDirectory)**/redist.dll;
-                            $(SdkOutputDirectory)**/rzc.dll;
-                            $(SdkOutputDirectory)**/testhost.dll;
-                            $(SdkOutputDirectory)**/testhost.exe;
-                            $(SdkOutputDirectory)**/testhost.x86.exe;
-                            $(SdkOutputDirectory)**/vstest.console.dll;
-                            $(SdkOutputDirectory)**/vstest.console.resources.dll">
-        <CertificateName>$(InternalCertificateId)</CertificateName>
-      </LayoutFilesToSign>
-
-      
-      <LayoutFileSignInfo Include="@(LayoutFilesToSign->'%(Filename)%(Extension)')">
-        <CertificateName>%(CertificateName)</CertificateName>
-      </LayoutFileSignInfo>
-      <DistinctLayoutFileSignInfo Include="@(LayoutFileSignInfo->Distinct())" />
+                                  $(SdkOutputDirectory)**/csc.dll;
+                                  $(SdkOutputDirectory)**/VBCSCompiler.dll;
+                                  $(SdkOutputDirectory)**/vbc.exe;
+                                  $(SdkOutputDirectory)**/vbc.dll;
+                                  $(SdkOutputDirectory)**/fsc.exe;
+                                  $(SdkOutputDirectory)**/fsi.exe;
+                                  $(SdkOutputDirectory)**/FSharp.*.dll;
+                                  $(SdkOutputDirectory)**/Interactive.DependencyManager.dll;
+                                  $(SdkOutputDirectory)**/dotnet.dll;
+                                  $(SdkOutputDirectory)**/dotnet.resources.dll;
+                                  $(SdkOutputDirectory)**/System.*.dll;
+                                  $(SdkOutputDirectory)**/Microsoft.*.dll;
+                                  $(SdkOutputDirectory)**/NuGet*.dll;
+                                  $(SdkOutputDirectory)**/datacollector.dll;
+                                  $(SdkOutputDirectory)**/datacollector.exe;
+                                  $(SdkOutputDirectory)**/MSBuild.dll;
+                                  $(SdkOutputDirectory)**/MSBuild.resources.dll;
+                                  $(SdkOutputDirectory)**/PresentationBuildTasks.dll;
+                                  $(SdkOutputDirectory)**/redist.dll;
+                                  $(SdkOutputDirectory)**/rzc.dll;
+                                  $(SdkOutputDirectory)**/testhost.dll;
+                                  $(SdkOutputDirectory)**/testhost.exe;
+                                  $(SdkOutputDirectory)**/testhost.x86.exe;
+                                  $(SdkOutputDirectory)**/vstest.console.dll;
+                                  $(SdkOutputDirectory)**/vstest.console.resources.dll;
+                                  $(SdkOutputDirectory)**/Newtonsoft.Json.dll;
+                                  $(SdkOutputDirectory)**/MessagePack.Annotations.dll;
+                                  $(SdkOutputDirectory)**/MessagePack.dll;
+                                  $(SdkOutputDirectory)**/Nerdbank.Streams.dll;
+                                  $(SdkOutputDirectory)**/StreamJsonRpc.dll" />
     </ItemGroup>
 
     <Error Condition="'$(AllowEmptySignList)' != 'true' AND '@(LayoutFilesToSign)' == ''"
@@ -136,10 +83,10 @@
     <Microsoft.DotNet.SignTool.SignToolTask
       DryRun="$(_DryRun)"
       TestSign="$(_TestSign)"
-      CertificatesSignInfo="$(CertificatesSignInfo)"
+      CertificatesSignInfo="@(CertificatesSignInfo)"
       ItemsToSign="@(LayoutFilesToSign)"
       StrongNameSignInfo="@(StrongNameSignInfo)"
-      FileSignInfo="@(DistinctLayoutFileSignInfo)"
+      FileSignInfo="@(FileSignInfo)"
       FileExtensionSignInfo="@(FileExtensionSignInfo)"
       TempDir="$(ArtifactsTmpDir)"
       LogDir="$(ArtifactsLogDir)"
@@ -150,25 +97,20 @@
   </Target>
 
   <Target Name="SignSdkMsi"
-        Condition="'$(SignCoreSdk)' == 'true'"
+        Condition="'$(SignCoreSdk)' == 'true' and '$(PostBuildSign)' != 'true'"
         DependsOnTargets="SetSignProps">
 
     <ItemGroup>
       <SdkMsiFilesToSign Include="$(SdkMSIInstallerFile)" />
-
-      <SdkMsiFileSignInfo Include="@(SdkMsiFilesToSign->'%(Filename)%(Extension)')">
-        <CertificateName>$(InternalCertificateId)</CertificateName>
-      </SdkMsiFileSignInfo>
-      <DistinctSdkMsiFileSignInfo Include="@(SdkMsiFileSignInfo->Distinct())" />
     </ItemGroup>
 
     <Microsoft.DotNet.SignTool.SignToolTask
         DryRun="$(_DryRun)"
         TestSign="$(_TestSign)"
-        CertificatesSignInfo="$(CertificatesSignInfo)"
+        CertificatesSignInfo="@(CertificatesSignInfo)"
         ItemsToSign="@(SdkMsiFilesToSign)"
         StrongNameSignInfo="@(StrongNameSignInfo)"
-        FileSignInfo="@(DistinctSdkMsiFileSignInfo)"
+        FileSignInfo="@(FileSignInfo)"
         FileExtensionSignInfo="@(FileExtensionSignInfo)"
         TempDir="$(ArtifactsTmpDir)"
         LogDir="$(ArtifactsLogDir)"
@@ -179,27 +121,20 @@
   </Target>
 
   <Target Name="SignTemplatesMsis"
-      Condition="'$(SignCoreSdk)' == 'true'"
+      Condition="'$(SignCoreSdk)' == 'true' and '$(PostBuildSign)' != 'true'"
       DependsOnTargets="SetSignProps;SetupTemplatesMsis">
 
     <ItemGroup>
       <TemplatesMsiFilesToSign Include="@(TemplatesMsiComponent->'%(MSIInstallerFile)')" />
     </ItemGroup>
 
-    <ItemGroup>
-      <TemplatesMsiFileSignInfo Include="@(TemplatesMsiFilesToSign->'%(Filename)%(Extension)')">
-        <CertificateName>$(InternalCertificateId)</CertificateName>
-      </TemplatesMsiFileSignInfo>
-      <DistinctTemplatesMsiFileSignInfo Include="@(TemplatesMsiFileSignInfo->Distinct())" />
-    </ItemGroup>
-
     <Microsoft.DotNet.SignTool.SignToolTask
         DryRun="$(_DryRun)"
         TestSign="$(_TestSign)"
-        CertificatesSignInfo="$(CertificatesSignInfo)"
+        CertificatesSignInfo="@(CertificatesSignInfo)"
         ItemsToSign="@(TemplatesMsiFilesToSign)"
         StrongNameSignInfo="@(StrongNameSignInfo)"
-        FileSignInfo="@(DistinctTemplatesMsiFileSignInfo)"
+        FileSignInfo="@(FileSignInfo)"
         FileExtensionSignInfo="@(FileExtensionSignInfo)"
         TempDir="$(ArtifactsTmpDir)"
         LogDir="$(ArtifactsLogDir)"
@@ -210,7 +145,7 @@
   </Target>
 
   <Target Name="SignSdkBundle"
-      Condition="'$(SignCoreSdk)' == 'true'"
+      Condition="'$(SignCoreSdk)' == 'true' and '$(PostBuildSign)' != 'true'"
       DependsOnTargets="SetSignProps">
 
     <!-- Extract engine from bundle -->
@@ -219,16 +154,14 @@
     <!-- Sign engine-->
     <ItemGroup>
       <EngineFileToSign Include="$(CombinedFrameworkSdkHostBundleEngineName)" />
-      <EngineFileSignInfo Include="$([System.IO.Path]::GetFileName('$(CombinedFrameworkSdkHostBundleEngineName)'))"
-                          CertificateName="$(InternalCertificateId)"/>
     </ItemGroup>
     <Microsoft.DotNet.SignTool.SignToolTask
         DryRun="$(_DryRun)"
         TestSign="$(_TestSign)"
-        CertificatesSignInfo="$(CertificatesSignInfo)"
+        CertificatesSignInfo="@(CertificatesSignInfo)"
         ItemsToSign="@(EngineFileToSign)"
         StrongNameSignInfo="@(StrongNameSignInfo)"
-        FileSignInfo="@(EngineFileSignInfo)"
+        FileSignInfo="@(FileSignInfo)"
         FileExtensionSignInfo="@(FileExtensionSignInfo)"
         TempDir="$(ArtifactsTmpDir)"
         LogDir="$(ArtifactsLogDir)"
@@ -242,17 +175,15 @@
     <!-- Sign bundle -->
     <ItemGroup>
       <BundleFileToSign Include="$(CombinedFrameworkSdkHostMSIInstallerFile)" />
-      <BundleFileSignInfo Include="$([System.IO.Path]::GetFileName('$(CombinedFrameworkSdkHostMSIInstallerFile)'))"
-                          CertificateName="$(InternalCertificateId)"/>
     </ItemGroup>
 
     <Microsoft.DotNet.SignTool.SignToolTask
         DryRun="$(_DryRun)"
         TestSign="$(_TestSign)"
-        CertificatesSignInfo="$(CertificatesSignInfo)"
+        CertificatesSignInfo="@(CertificatesSignInfo)"
         ItemsToSign="@(BundleFileToSign)"
         StrongNameSignInfo="@(StrongNameSignInfo)"
-        FileSignInfo="@(BundleFileSignInfo)"
+        FileSignInfo="@(FileSignInfo)"
         FileExtensionSignInfo="@(FileExtensionSignInfo)"
         TempDir="$(ArtifactsTmpDir)"
         LogDir="$(ArtifactsLogDir)"
@@ -263,25 +194,20 @@
   </Target>
 
   <Target Name="SignSdkPlaceholderMsi"
-      Condition="'$(SignCoreSdk)' == 'true'"
+      Condition="'$(SignCoreSdk)' == 'true' and '$(PostBuildSign)' != 'true'"
       DependsOnTargets="SetSignProps">
 
     <ItemGroup>
       <SdkPlaceholderMsiFilesToSign Include="$(SdkPlaceholderMSIInstallerFile)" />
-
-      <SdkPlaceholderMsiFileSignInfo Include="@(SdkPlaceholderMsiFilesToSign->'%(Filename)%(Extension)')">
-        <CertificateName>$(InternalCertificateId)</CertificateName>
-      </SdkPlaceholderMsiFileSignInfo>
-      <DistinctSdkPlaceholderMsiFileSignInfo Include="@(SdkPlaceholderMsiFileSignInfo->Distinct())" />
     </ItemGroup>
 
     <Microsoft.DotNet.SignTool.SignToolTask
         DryRun="$(_DryRun)"
         TestSign="$(_TestSign)"
-        CertificatesSignInfo="$(CertificatesSignInfo)"
+        CertificatesSignInfo="@(CertificatesSignInfo)"
         ItemsToSign="@(SdkPlaceholderMsiFilesToSign)"
         StrongNameSignInfo="@(StrongNameSignInfo)"
-        FileSignInfo="@(DistinctSdkPlaceholderMsiFileSignInfo)"
+        FileSignInfo="@(FileSignInfo)"
         FileExtensionSignInfo="@(FileExtensionSignInfo)"
         TempDir="$(ArtifactsTmpDir)"
         LogDir="$(ArtifactsLogDir)"
diff --git a/test/Microsoft.DotNet.Tools.Tests.Utilities/Assertions/FileInfoAssertions.cs b/test/Microsoft.DotNet.Tools.Tests.Utilities/Assertions/FileInfoAssertions.cs
index dca27f0c5..92670beb2 100644
--- a/test/Microsoft.DotNet.Tools.Tests.Utilities/Assertions/FileInfoAssertions.cs
+++ b/test/Microsoft.DotNet.Tools.Tests.Utilities/Assertions/FileInfoAssertions.cs
@@ -23,6 +23,8 @@ namespace Microsoft.DotNet.Tools.Test.Utilities
 
         public FileInfo FileInfo => _fileInfo;
 
+        private static DateTime defaultUtcTime = new DateTime(1601, 1, 1, 0, 0, 0);
+
         public AndConstraint<FileInfoAssertions> Exist(string because = "", params object[] reasonArgs)
         {
             Execute.Assertion