aspnetcore/build/CodeSign.props

<Project>

  <ItemGroup>
    <!-- Use the PublicKeyToken of .NET assemblies to determine 'Microsoft' assemblies. -->
    <AssemblyToSign Include="AspNetCore" PublicKeyToken="adb9793829ddae60" CertificateName="Microsoft400" />
    <AssemblyToSign Include="MsSharedLib72" PublicKeyToken="31bf3856ad364e35" CertificateName="Microsoft400" />
    <AssemblyToSign Include="MsftStrongName" PublicKeyToken="b03f5f7f11d50a3a" CertificateName="Microsoft400" />
    <AssemblyToSign Include="MsftStrongName2" PublicKeyToken="b77a5c561934e089" CertificateName="Microsoft400" />
    <AssemblyToSign Include="MsftOpenStrongName" PublicKeyToken="cc7b13ffcd2ddd51" CertificateName="Microsoft400" />

    <!-- Native .dll's. These don't have a public key token, but are from Microsoft and should be signed. -->
    <FileNamesToSign Include="aspnetcore.dll" CertificateName="Microsoft400" />
    <FileNamesToSign Include="aspnetcorev2_inprocess.dll" CertificateName="Microsoft400" />
    <FileNamesToSign Include="aspnetcorev2_outofprocess.dll" CertificateName="Microsoft400" />
    <FileNamesToSign Include="aspnetcorev2.dll" CertificateName="Microsoft400" />
    <FileNamesToSign Include="dotnet-blazor.exe" CertificateName="Microsoft400" />
    <FileNamesToSign Include="dotnet-dev-certs.exe" CertificateName="Microsoft400" />
    <FileNamesToSign Include="dotnet-sql-cache.exe" CertificateName="Microsoft400" />
    <FileNamesToSign Include="dotnet-user-secrets.exe" CertificateName="Microsoft400" />
    <FileNamesToSign Include="dotnet-watch.exe" CertificateName="Microsoft400" />
    <FileNamesToSign Include="Microsoft.AspNetCore.Blazor.Build.exe" CertificateName="Microsoft400" />
    <FileNamesToSign Include="sni.dll" CertificateName="Microsoft400" />

    <!-- Third-party components which should be signed.  -->
    <FileNamesToSign Include="Newtonsoft.Json.dll" CertificateName="3PartySHA2" />
    <FileNamesToSign Include="AngleSharp.dll" CertificateName="3PartySHA2" />
    <FileNamesToSign Include="Mono.Cecil.dll" CertificateName="3PartySHA2" />
    <FileNamesToSign Include="Mono.Cecil.Mdb.dll" CertificateName="3PartySHA2" />
    <FileNamesToSign Include="Mono.Cecil.Pdb.dll" CertificateName="3PartySHA2" />
    <FileNamesToSign Include="Mono.Cecil.Rocks.dll" CertificateName="3PartySHA2" />
  </ItemGroup>

  <ItemGroup Label="Code sign exclusions">
    <!-- We don't need to code sign .js files because they are not used in Windows Script Host. -->
    <FileExtensionsToSign Include=".js" CertificateName="None" />
    <!-- We don't produce font files. We rebundle some for using the web brower, so they do not need to be signed. -->
    <FileExtensionsToSign Include=".otf" CertificateName="None" />
    <FileExtensionsToSign Include=".ttf" CertificateName="None" />
    <!-- This is a text file which doesn't need to be code signed, even though some .mof files can be signed. -->
    <FileNamesToSign Include="ancm.mof" CertificateName="None" />
    <!-- Exclude the apphost because this is expected to be code-signed by customers after the SDK modifies it. -->
    <FileNamesToSign Include="apphost.exe" CertificateName="None" />
  </ItemGroup>

</Project>