Do not sign ASP.NET Core static web assets in containers

[ChatchawanIllyes]

Fixes #1045

Problem

Packages produced by the ASP.NET Core SDK (Blazor and Razor class libraries) carry their browser assets in a staticwebassets directory and record each asset's integrity hash at pack time in build/Microsoft.AspNetCore.StaticWebAssets.props.

.js is in the signable extension list because Windows Script Host scripts are .js, so recursing into such a package signs its .js assets. That changes the files, invalidates the recorded hashes, and consuming applications fail with an integrity conflict. The workaround reported in #1045 was --recurse-containers false, which gives up signing the package contents entirely.

Change

When recursing into a container, AggregatingSigner now skips the files in a package's staticwebassets directory and logs a warning naming each skipped file.

Detection is convention-based and scoped to the package that declares the assets:

• A package is recognized by a Microsoft.AspNetCore.StaticWebAsset*.props file in its build, buildTransitive, or buildMultiTargeting directory. The wildcard also covers Microsoft.AspNetCore.StaticWebAssetEndpoints.props (.NET 9 and later).
• Only that package's own staticwebassets directory is skipped --- a staticwebassets directory elsewhere in the container is not.
• Files elsewhere in the package are unaffected, including .js files outside of staticwebassets, so genuine Windows Script Host scripts are still signed.

Filtering applies only when no file list was provided. A caller who explicitly listed files has already stated an intent, so static web assets can still be signed by listing them with --file-list.

The new IStaticWebAssetFilter works on the file paths already enumerated from the container, so it adds no IContainer.GetFiles(...) calls.

Notes

• This changes default behavior: files that were previously signed inside static web asset packages are now skipped, with a warning. Signing a file that a browser integrity-checks is never the intent, so this seemed preferable to a warning-only change, but I am happy to switch to warning-only or to add an opt-out option if you would rather not change the default.
• One new resource string, with the .xlf files updated by the build.

Testing

• New StaticWebAssetFilterTests covering the marker file locations and names, non-.js assets (.wasm, .dll), a .js file outside staticwebassets, a similarly named directory, case insensitivity, and the warning.
• New AggregatingSignerTests cases for a .nupkg container with and without a file list.
• I developed this on macOS, where Sign.Core.Test compiles but cannot run (the projects are win-x64 and Sign.TestInfrastructure needs mage.exe). I verified the new and existing AggregatingSigner tests --- 55 in total --- by compiling the same sources into a scratch net8.0 project and running them locally; they all pass. CI is the first Windows run.

🤖 Generated with Claude Code

[ChatchawanIllyes]

@dotnet-policy-service agree

[kartheekp-ms]

@ChatchawanIllyes please rebase since we migrated tests from Moq to NSubstitute.