See https://microsoft-my.sharepoint.com/:w:/p/mmitche/ERcEQy4Xex9CpRyTiGx9HrkBqf4iGDjDjwSk98QsczcROw?e=A8pF4J for design info.

In addition to work in SignTool, we need to do additional work to enable signing on Mac and Linux machines. This includes:

Add service connections to dnceng for Mac and Linux. MicroBuild normally uses a certificate installed on the host machine for authenticating to ESRP. For Mac (and maybe Linux?) cases, a service connection is added which is referenced at the time of installing the MicroBuild signing plugin. See MicroBuild documentation.

See https://devdiv.visualstudio.com/DevDiv/_wiki/wikis/DevDiv.wiki/12267/ESRP-Signing-in-Mac-or-Linux-Pipelines