From abc2233dd4fc3bf1afda92ef28eea3d560bb63fc Mon Sep 17 00:00:00 2001
From: "dotnet-maestro[bot]" <dotnet-maestro[bot]@users.noreply.github.com>
Date: Mon, 9 Feb 2026 08:59:38 +0000
Subject: [PATCH] =?UTF-8?q?[arcade]=20Source=20update=209f286dd=20?=
 =?UTF-8?q?=E2=86=92=2058d7536=20Diff:=20https://github.com/dotnet/arcade/?=
 =?UTF-8?q?compare/9f286ddee40065ea225611cb43ab0415e48994c2..58d75363f4b03?=
 =?UTF-8?q?e408aa2502e0db546173be722d4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: https://github.com/dotnet/arcade/commit/9f286ddee40065ea225611cb43ab0415e48994c2
To: https://github.com/dotnet/arcade/commit/58d75363f4b03e408aa2502e0db546173be722d4

[[ commit created by automation ]]
---
 src/arcade/azure-pipelines-unofficial.yml     |   2 +-
 src/arcade/azure-pipelines.yml                |   4 +-
 src/arcade/eng/Version.Details.props          |   4 +-
 src/arcade/eng/Version.Details.xml            |  12 +-
 .../job/publish-build-assets.yml              |   2 +-
 .../core-templates/job/source-build.yml       |   8 +-
 .../core-templates/post-build/post-build.yml  |   4 +-
 .../templates/variables/pool-providers.yml    |   2 +-
 src/arcade/eng/common/tools.ps1               |  13 +-
 src/arcade/eng/promote-build.yml              |   2 +-
 src/arcade/eng/validate-sdk.yml               |   2 +-
 src/arcade/global.json                        |   8 +-
 .../tools/Sign.props                          |   1 +
 .../SignToolTests.cs                          | 272 +++++++++++-------
 .../src/BatchSignUtil.cs                      |  21 +-
 .../src/Configuration.cs                      |  98 ++++---
 ...rtificateKey.cs => ExplicitSignInfoKey.cs} |  17 +-
 .../src/FileSignInfo.cs                       |   5 +-
 .../src/FileSignInfoEntry.cs                  |  21 ++
 .../Microsoft.DotNet.SignTool/src/SignInfo.cs |  34 ++-
 .../Microsoft.DotNet.SignTool/src/SignTool.cs |   2 +-
 .../src/SignToolConstants.cs                  |   6 +
 .../src/SignToolTask.cs                       |  30 +-
 .../SignCheckResources.Designer.cs            |   9 +
 .../SignCheckResources.resx                   |   3 +
 .../Verification/ArchiveVerifier.cs           |  12 +
 .../Verification/Exclusions.cs                |  11 +-
 .../SignatureVerificationResult.cs            |   9 +
 .../SignCheck/SignCheckTask/src/SignCheck.cs  |  15 +-
 .../src/SignCheckResources.Designer.cs        |   2 +-
 .../SignCheckTask/src/SignCheckResources.resx |   2 +-
 src/source-manifest.json                      |  38 +--
 32 files changed, 445 insertions(+), 226 deletions(-)
 rename src/arcade/src/Microsoft.DotNet.SignTool/src/{ExplicitCertificateKey.cs => ExplicitSignInfoKey.cs} (60%)
 create mode 100644 src/arcade/src/Microsoft.DotNet.SignTool/src/FileSignInfoEntry.cs

diff --git a/src/arcade/azure-pipelines-unofficial.yml b/src/arcade/azure-pipelines-unofficial.yml
index 887f46d621d6..d63cd797c6c8 100644
--- a/src/arcade/azure-pipelines-unofficial.yml
+++ b/src/arcade/azure-pipelines-unofficial.yml
@@ -20,7 +20,7 @@ extends:
   parameters:
     pool:
       name: $(DncEngInternalBuildPool)
-      image: windows.vs2019.amd64
+      image: windows.vs2022.amd64
       os: windows
 
     stages:
diff --git a/src/arcade/azure-pipelines.yml b/src/arcade/azure-pipelines.yml
index 373ee74dd6b2..123ab961fae4 100644
--- a/src/arcade/azure-pipelines.yml
+++ b/src/arcade/azure-pipelines.yml
@@ -38,9 +38,11 @@ resources:
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
+    settings:
+      networkIsolationPolicy: Permissive, CFSClean, CFSClean2
     pool:
       name: $(DncEngInternalBuildPool)
-      image: windows.vs2019.amd64
+      image: windows.vs2022.amd64
       os: windows
     sdl:
       policheck:
diff --git a/src/arcade/eng/Version.Details.props b/src/arcade/eng/Version.Details.props
index fcf78f01aa9f..764be49eb1d4 100644
--- a/src/arcade/eng/Version.Details.props
+++ b/src/arcade/eng/Version.Details.props
@@ -14,8 +14,8 @@ This file should be imported by eng/Versions.props
     <!-- dotnet/templating dependencies -->
     <MicrosoftTemplateEngineAuthoringTasksPackageVersion>10.0.100-preview.4.25220.1</MicrosoftTemplateEngineAuthoringTasksPackageVersion>
     <!-- dotnet/arcade dependencies -->
-    <MicrosoftDotNetArcadeSdkPackageVersion>10.0.0-beta.25608.3</MicrosoftDotNetArcadeSdkPackageVersion>
-    <MicrosoftDotNetHelixSdkPackageVersion>10.0.0-beta.25608.3</MicrosoftDotNetHelixSdkPackageVersion>
+    <MicrosoftDotNetArcadeSdkPackageVersion>10.0.0-beta.26080.4</MicrosoftDotNetArcadeSdkPackageVersion>
+    <MicrosoftDotNetHelixSdkPackageVersion>10.0.0-beta.26080.4</MicrosoftDotNetHelixSdkPackageVersion>
     <!-- dotnet/arcade-services dependencies -->
     <MicrosoftDotNetDarcLibPackageVersion>1.1.0-beta.25424.1</MicrosoftDotNetDarcLibPackageVersion>
     <MicrosoftDotNetProductConstructionServiceClientPackageVersion>1.1.0-beta.25424.1</MicrosoftDotNetProductConstructionServiceClientPackageVersion>
diff --git a/src/arcade/eng/Version.Details.xml b/src/arcade/eng/Version.Details.xml
index 16bce2645e23..b31557fc20e4 100644
--- a/src/arcade/eng/Version.Details.xml
+++ b/src/arcade/eng/Version.Details.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Dependencies>
-  <Source Uri="https://github.com/dotnet/dotnet" Mapping="arcade" Sha="20abd87658f89b288b8beeb3a0fcb2c89b0af69a" BarId="292473" />
+  <Source Uri="https://github.com/dotnet/dotnet" Mapping="arcade" Sha="b6995982889aca81f3e8a3e1406629e1f379b31f" BarId="295588" />
   <ProductDependencies>
   </ProductDependencies>
   <ToolsetDependencies>
@@ -20,13 +20,13 @@
       <Uri>https://github.com/dotnet/templating</Uri>
       <Sha>43b5827697e501c442eb75ffff832cd4df2514fe</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="10.0.0-beta.25608.3">
+    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="10.0.0-beta.26080.4">
       <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>6605fb5db42d56000a040ed7a0736bc505be9743</Sha>
+      <Sha>b0f891cf7c1febc0ebbae7dd787f8a0b4c0cbc95</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.DotNet.Helix.Sdk" Version="10.0.0-beta.25608.3">
+    <Dependency Name="Microsoft.DotNet.Helix.Sdk" Version="10.0.0-beta.26080.4">
       <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>6605fb5db42d56000a040ed7a0736bc505be9743</Sha>
+      <Sha>b0f891cf7c1febc0ebbae7dd787f8a0b4c0cbc95</Sha>
     </Dependency>
     <Dependency Name="Microsoft.DotNet.ProductConstructionService.Client" Version="1.1.0-beta.25424.1">
       <Uri>https://github.com/dotnet/arcade-services</Uri>
@@ -174,4 +174,4 @@
       <Sha>0a2e291c0d9c0c7675d445703e51750363a549ef</Sha>
     </Dependency>
   </ToolsetDependencies>
-</Dependencies>
+</Dependencies>
\ No newline at end of file
diff --git a/src/arcade/eng/common/core-templates/job/publish-build-assets.yml b/src/arcade/eng/common/core-templates/job/publish-build-assets.yml
index 3437087c80fc..b955fac6e13f 100644
--- a/src/arcade/eng/common/core-templates/job/publish-build-assets.yml
+++ b/src/arcade/eng/common/core-templates/job/publish-build-assets.yml
@@ -80,7 +80,7 @@ jobs:
     # If it's not devdiv, it's dnceng
     ${{ if ne(variables['System.TeamProject'], 'DevDiv') }}:
       name: NetCore1ESPool-Publishing-Internal
-      image: windows.vs2019.amd64
+      image: windows.vs2022.amd64
       os: windows
   steps:
   - ${{ if eq(parameters.is1ESPipeline, '') }}:
diff --git a/src/arcade/eng/common/core-templates/job/source-build.yml b/src/arcade/eng/common/core-templates/job/source-build.yml
index d805d5faeb94..1997c2ae00d7 100644
--- a/src/arcade/eng/common/core-templates/job/source-build.yml
+++ b/src/arcade/eng/common/core-templates/job/source-build.yml
@@ -60,19 +60,19 @@ jobs:
       pool:
         ${{ if eq(variables['System.TeamProject'], 'public') }}:
           name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore-Svc-Public' ), False, 'NetCore-Public')]
-          demands: ImageOverride -equals build.ubuntu.2004.amd64
+          demands: ImageOverride -equals build.azurelinux.3.amd64.open
         ${{ if eq(variables['System.TeamProject'], 'internal') }}:
           name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore1ESPool-Svc-Internal'), False, 'NetCore1ESPool-Internal')]
-          image: 1es-mariner-2
+          image: build.azurelinux.3.amd64
           os: linux
     ${{ else }}:
       pool:
         ${{ if eq(variables['System.TeamProject'], 'public') }}:
           name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore-Svc-Public' ), False, 'NetCore-Public')]
-          demands: ImageOverride -equals Build.Ubuntu.2204.Amd64.Open
+          demands: ImageOverride -equals build.azurelinux.3.amd64.open
         ${{ if eq(variables['System.TeamProject'], 'internal') }}:
           name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore1ESPool-Svc-Internal'), False, 'NetCore1ESPool-Internal')]
-          demands: ImageOverride -equals Build.Ubuntu.2204.Amd64
+          demands: ImageOverride -equals build.azurelinux.3.amd64
   ${{ if ne(parameters.platform.pool, '') }}:
     pool: ${{ parameters.platform.pool }}
 
diff --git a/src/arcade/eng/common/core-templates/post-build/post-build.yml b/src/arcade/eng/common/core-templates/post-build/post-build.yml
index 9423d71ca3a2..b942a79ef02d 100644
--- a/src/arcade/eng/common/core-templates/post-build/post-build.yml
+++ b/src/arcade/eng/common/core-templates/post-build/post-build.yml
@@ -293,11 +293,11 @@ stages:
         ${{ else }}:
           ${{ if eq(parameters.is1ESPipeline, true) }}:          
             name: NetCore1ESPool-Publishing-Internal
-            image: windows.vs2019.amd64
+            image: windows.vs2022.amd64
             os: windows
           ${{ else }}:
             name: NetCore1ESPool-Publishing-Internal
-            demands: ImageOverride -equals windows.vs2019.amd64          
+            demands: ImageOverride -equals windows.vs2022.amd64          
       steps:
         - template: /eng/common/core-templates/post-build/setup-maestro-vars.yml
           parameters:
diff --git a/src/arcade/eng/common/templates/variables/pool-providers.yml b/src/arcade/eng/common/templates/variables/pool-providers.yml
index e0b19c14a073..18693ea120d5 100644
--- a/src/arcade/eng/common/templates/variables/pool-providers.yml
+++ b/src/arcade/eng/common/templates/variables/pool-providers.yml
@@ -23,7 +23,7 @@
 #
 #        pool:
 #           name: $(DncEngInternalBuildPool)
-#           demands: ImageOverride -equals windows.vs2019.amd64
+#           demands: ImageOverride -equals windows.vs2022.amd64
 variables:
   - ${{ if eq(variables['System.TeamProject'], 'internal') }}:
     - template: /eng/common/templates-official/variables/pool-providers.yml
diff --git a/src/arcade/eng/common/tools.ps1 b/src/arcade/eng/common/tools.ps1
index bef4affa4a41..049fe6db994e 100644
--- a/src/arcade/eng/common/tools.ps1
+++ b/src/arcade/eng/common/tools.ps1
@@ -560,19 +560,26 @@ function LocateVisualStudio([object]$vsRequirements = $null){
     })
   }
 
-  if (!$vsRequirements) { $vsRequirements = $GlobalJson.tools.vs }
+  if (!$vsRequirements) {
+    if (Get-Member -InputObject $GlobalJson.tools -Name 'vs' -ErrorAction SilentlyContinue) {
+      $vsRequirements = $GlobalJson.tools.vs
+    } else {
+      $vsRequirements = $null
+    }
+  }
+
   $args = @('-latest', '-format', 'json', '-requires', 'Microsoft.Component.MSBuild', '-products', '*')
 
   if (!$excludePrereleaseVS) {
     $args += '-prerelease'
   }
 
-  if (Get-Member -InputObject $vsRequirements -Name 'version') {
+  if ($vsRequirements -and (Get-Member -InputObject $vsRequirements -Name 'version' -ErrorAction SilentlyContinue)) {
     $args += '-version'
     $args += $vsRequirements.version
   }
 
-  if (Get-Member -InputObject $vsRequirements -Name 'components') {
+  if ($vsRequirements -and (Get-Member -InputObject $vsRequirements -Name 'components' -ErrorAction SilentlyContinue)) {
     foreach ($component in $vsRequirements.components) {
       $args += '-requires'
       $args += $component
diff --git a/src/arcade/eng/promote-build.yml b/src/arcade/eng/promote-build.yml
index ed690454a158..e2693fc36d82 100644
--- a/src/arcade/eng/promote-build.yml
+++ b/src/arcade/eng/promote-build.yml
@@ -69,7 +69,7 @@ extends:
         os: windows
       ${{ else }}:
         name: NetCore1ESPool-Publishing-Internal
-        image: windows.vs2019.amd64
+        image: windows.vs2022.amd64
         os: windows
     sdl:
       policheck:
diff --git a/src/arcade/eng/validate-sdk.yml b/src/arcade/eng/validate-sdk.yml
index 5dd1a0e4d081..4b1cfbd8a0df 100644
--- a/src/arcade/eng/validate-sdk.yml
+++ b/src/arcade/eng/validate-sdk.yml
@@ -29,7 +29,7 @@ jobs:
     - template: /eng/common/templates-official/variables/pool-providers.yml@self
     pool:
       name: $(DncEngInternalBuildPool)
-      demands: ImageOverride -equals windows.vs2019.amd64
+      demands: ImageOverride -equals windows.vs2022.amd64
     preSteps:
     - checkout: self
       clean: true
diff --git a/src/arcade/global.json b/src/arcade/global.json
index 5cbbc0dad8f8..8f5fc8480688 100644
--- a/src/arcade/global.json
+++ b/src/arcade/global.json
@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "10.0.100",
+    "version": "10.0.101",
     "rollForward": "latestFeature",
     "paths": [
       ".dotnet",
@@ -9,11 +9,11 @@
     "errorMessage": "The required .NET SDK wasn't found. Please run ./eng/common/dotnet.cmd/sh to install it."
   },
   "tools": {
-    "dotnet": "10.0.100"
+    "dotnet": "10.0.101"
   },
   "msbuild-sdks": {
-    "Microsoft.DotNet.Arcade.Sdk": "10.0.0-beta.25608.3",
-    "Microsoft.DotNet.Helix.Sdk": "10.0.0-beta.25608.3",
+    "Microsoft.DotNet.Arcade.Sdk": "10.0.0-beta.26080.4",
+    "Microsoft.DotNet.Helix.Sdk": "10.0.0-beta.26080.4",
     "Microsoft.Build.NoTargets": "3.7.0"
   }
 }
diff --git a/src/arcade/src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.props b/src/arcade/src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.props
index 3ff26ef1da29..06147aea7276 100644
--- a/src/arcade/src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.props
+++ b/src/arcade/src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.props
@@ -32,6 +32,7 @@
     <CertificatesSignInfo Include="MacDeveloperVNextHardenWithNotarization" MacCertificate="MacDeveloperVNextHarden" MacNotarizationAppName="dotnet" />
     <!-- Certificates Which support detached signatures -->
     <CertificatesSignInfo Include="LinuxSignTar" SupportsDetachedSignature="true" />
+    <CertificatesSignInfo Include="LinuxSign500180PGP" SupportsDetachedSignature="true" />
   </ItemGroup>
 
   <!-- Only publish packages that contain this build's Target RID in the name.
diff --git a/src/arcade/src/Microsoft.DotNet.SignTool.Tests/SignToolTests.cs b/src/arcade/src/Microsoft.DotNet.SignTool.Tests/SignToolTests.cs
index 488ddf0e89e3..879174e31497 100644
--- a/src/arcade/src/Microsoft.DotNet.SignTool.Tests/SignToolTests.cs
+++ b/src/arcade/src/Microsoft.DotNet.SignTool.Tests/SignToolTests.cs
@@ -327,7 +327,7 @@ public void Dispose()
         private void ValidateGeneratedProject(
             List<ItemToSign> itemsToSign,
             Dictionary<string, List<SignInfo>> strongNameSignInfo,
-            Dictionary<ExplicitCertificateKey, string> fileSignInfo,
+            Dictionary<ExplicitSignInfoKey, FileSignInfoEntry> fileSignInfo,
             Dictionary<string, List<SignInfo>> extensionsSignInfo,
             string[] expectedXmlElementsPerSigningRound,
             Dictionary<string, List<AdditionalCertificateInformation>> additionalCertificateInfo = null,
@@ -381,7 +381,7 @@ private void ValidateGeneratedProject(
         private void ValidateFileSignInfos(
             List<ItemToSign> itemsToSign,
             Dictionary<string, List<SignInfo>> strongNameSignInfo,
-            Dictionary<ExplicitCertificateKey, string> fileSignInfo,
+            Dictionary<ExplicitSignInfoKey, FileSignInfoEntry> fileSignInfo,
             Dictionary<string, List<SignInfo>> extensionsSignInfo,
             string[] expected,
             string[] expectedCopyFiles = null,
@@ -531,7 +531,7 @@ public void EmptySigningList()
 
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>();
 
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             var task = new SignToolTask { BuildEngine = new FakeBuildEngine() };
             var signingInput = new Configuration(_tmpDir, itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, null, null, tarToolPath: s_tarToolPath, pkgToolPath: s_pkgToolPath, snPath: s_snPath, task.Log).GenerateListOfFiles();
@@ -598,7 +598,7 @@ public void OnlyContainer()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfoWithCollisionId, new[]
             {
@@ -633,10 +633,10 @@ public void SkipSigning()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>
             {
-                { new ExplicitCertificateKey("NativeLibrary.dll"), "None" },
-                { new ExplicitCertificateKey("ProjectOne.dll", publicKeyToken: "581d91ccdfc4ea9c", targetFramework: ".NETCoreApp,Version=v2.1"), "None" }
+                { new ExplicitSignInfoKey("NativeLibrary.dll"), new FileSignInfoEntry("None") },
+                { new ExplicitSignInfoKey("ProjectOne.dll", publicKeyToken: "581d91ccdfc4ea9c", targetFramework: ".NETCoreApp,Version=v2.1"), new FileSignInfoEntry("None") }
             };
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
@@ -666,7 +666,7 @@ public void SkipStrongNamingForAlreadyStrongNamedBinary()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, Array.Empty<string>());
         }
@@ -687,7 +687,7 @@ public void DoNotSkipStrongNamingForDelaySignedBinary()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[] 
             {
@@ -711,7 +711,7 @@ public void SkipStrongNamingForCrossGennedBinary()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -735,7 +735,7 @@ public void SkipStrongNamingBinaryButDontSkipAuthenticode()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -763,7 +763,7 @@ public void OnlyAuthenticodeSignByPKT()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, new Dictionary<string, List<SignInfo>>(), new[]
             {
@@ -796,9 +796,9 @@ public void OnlyContainerAndOverridingByPKT()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>()
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>()
             {
-                { new ExplicitCertificateKey("ProjectOne.dll", "581d91ccdfc4ea9c"), "OverriddenCertificate" }
+                { new ExplicitSignInfoKey("ProjectOne.dll", "581d91ccdfc4ea9c"), new FileSignInfoEntry("OverriddenCertificate") }
             };
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
@@ -838,10 +838,10 @@ public void OnlyContainerAndOverridingByFileName()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>()
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>()
             {
-                { new ExplicitCertificateKey("NativeLibrary.dll", collisionPriorityId: "123"), "OverriddenCertificate1" },
-                { new ExplicitCertificateKey("ProjectOne.dll", collisionPriorityId: "123"), "3PartySHA2" }
+                { new ExplicitSignInfoKey("NativeLibrary.dll", collisionPriorityId: "123"), new FileSignInfoEntry("OverriddenCertificate1") },
+                { new ExplicitSignInfoKey("ProjectOne.dll", collisionPriorityId: "123"), new FileSignInfoEntry("3PartySHA2") }
             };
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfoWithCollisionId, new[]
@@ -878,9 +878,9 @@ public void EmptyPKT()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>()
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>()
             {
-                { new ExplicitCertificateKey("EmptyPKT.dll"), "3PartySHA2" }
+                { new ExplicitSignInfoKey("EmptyPKT.dll"), new FileSignInfoEntry("3PartySHA2") }
             };
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
@@ -907,9 +907,9 @@ public void CrossGenerated()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>()
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>()
             {
-                { new ExplicitCertificateKey("EmptyPKT.dll", collisionPriorityId: "123"), "3PartySHA2" }
+                { new ExplicitSignInfoKey("EmptyPKT.dll", collisionPriorityId: "123"), new FileSignInfoEntry("3PartySHA2") }
             };
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, new Dictionary<string, List<SignInfo>>(), new[]
@@ -943,7 +943,7 @@ public void DefaultCertificateForAssemblyWithoutStrongName()
                 { "", new List<SignInfo>{ new SignInfo("3PartySHA2", collisionPriorityId: "123") } }
             };
 
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>() { };
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>() { };
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -965,9 +965,9 @@ public void CustomTargetFrameworkAttribute()
                 {  "", new List<SignInfo>{ new SignInfo("DefaultCertificate", collisionPriorityId: "123") } }
             };
 
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>()
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>()
             {
-                { new ExplicitCertificateKey("CustomTargetFrameworkAttribute.dll", targetFramework: ".NETFramework,Version=v2.0", collisionPriorityId: "123"), "3PartySHA2" }
+                { new ExplicitSignInfoKey("CustomTargetFrameworkAttribute.dll", targetFramework: ".NETFramework,Version=v2.0", collisionPriorityId: "123"), new FileSignInfoEntry("3PartySHA2") }
             };
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
@@ -986,7 +986,7 @@ public void ThirdPartyLibraryMicrosoftCertificate()
             };
 
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>() { };
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>() { };
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>() { };
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -1008,7 +1008,7 @@ public void NoWarnThirdPartyLibraryMicrosoftCertificate()
             };
 
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>() { };
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>() { };
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>() { };
             var noWarn3rdPartySet = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "EmptyPKT.dll" };
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
@@ -1035,7 +1035,7 @@ public void DoubleNestedContainer()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfoWithCollisionId, new[]
             {
@@ -1086,7 +1086,7 @@ public void NestedContainer()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfoWithCollisionId, new[]
             {
@@ -1165,9 +1165,9 @@ public void NestedContainerWithCollisions()
 
             // Overriding information. Since ContainerOne.dll collides with ContainerTwo.dll already in the hash mapping
             // table with collition id 123, we end up using ArcadeStrongTest instead of OverriddenCertificate1
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>()
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>()
             {
-                { new ExplicitCertificateKey("ContainerOne.dll", collisionPriorityId: "456"), "OverriddenCertificate1" }
+                { new ExplicitSignInfoKey("ContainerOne.dll", collisionPriorityId: "456"), new FileSignInfoEntry("OverriddenCertificate1") }
             };
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfoWithCollisionId, new[]
@@ -1247,7 +1247,7 @@ public void SignZipFile()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -1298,11 +1298,11 @@ public void SignArchivesUsingDetachedSignature()
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>();
 
             // Overriding information
-            var explicitCertKeys = new Dictionary<ExplicitCertificateKey, string>()
+            var explicitCertKeys = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>()
             {
-                { new ExplicitCertificateKey("test.zip"), "ArchiveCert" },
-                { new ExplicitCertificateKey("test.tgz"), "ArchiveCert" },
-                { new ExplicitCertificateKey("InnerZipFile.zip"), "ArchiveCert" }
+                { new ExplicitSignInfoKey("test.zip"), new FileSignInfoEntry("ArchiveCert") },
+                { new ExplicitSignInfoKey("test.tgz"), new FileSignInfoEntry("ArchiveCert") },
+                { new ExplicitSignInfoKey("InnerZipFile.zip"), new FileSignInfoEntry("ArchiveCert") }
             };
 
             var additionalCertificateInfo = new Dictionary<string, List<AdditionalCertificateInformation>>()
@@ -1390,7 +1390,7 @@ public void SignJustPkgWithoutUnpack()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -1424,7 +1424,7 @@ public void UnpackAndSignPkg()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -1491,9 +1491,9 @@ public void SignAndNotarizePkgFile()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>()
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>()
             {
-                { new ExplicitCertificateKey("test.pkg"), "MacDeveloperHardenWithNotarization" }
+                { new ExplicitSignInfoKey("test.pkg"), new FileSignInfoEntry("MacDeveloperHardenWithNotarization") }
             };
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
@@ -1557,7 +1557,7 @@ public void SignNestedPkgFile()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -1609,7 +1609,7 @@ public void SignPkgFileWithApp()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             // When .apps are unpacked from .pkgs, they get zipped so they can be signed
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
@@ -1655,7 +1655,7 @@ public void SignTarGZipFile()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -1707,7 +1707,7 @@ public void SymbolsNupkg()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -1759,7 +1759,7 @@ public void SignedSymbolsNupkg()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
             var tempFileExtensionSignInfo = s_fileExtensionSignInfo.Where(s => s.Key != ".symbols.nupkg").ToDictionary(e => e.Key, e => e.Value);
             
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, tempFileExtensionSignInfo, new[]
@@ -1810,7 +1810,7 @@ public void CheckDebSigning()
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>();
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -1854,7 +1854,7 @@ public void CheckRpmSigningOnWindows()
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>();
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -1882,7 +1882,7 @@ public void CheckRpmSigning()
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>();
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -1925,7 +1925,7 @@ public void VerifyDebIntegrity()
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>();
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             var expectedFilesToBeSigned = new List<string>
             {
@@ -1956,7 +1956,7 @@ public void VerifyRpmIntegrity()
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>();
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             var expectedFilesToBeSigned = new List<string>
             {
@@ -1988,7 +1988,7 @@ public void CheckPowershellSigning()
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>();
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -2012,7 +2012,7 @@ public void VerifyNupkgIntegrity()
 
             ValidateFileSignInfos(itemsToSign,
                                   new Dictionary<string, List<SignInfo>>(),
-                                  new Dictionary<ExplicitCertificateKey, string>(),
+                                  new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>(),
                                   s_fileExtensionSignInfo,
                                   new[] { "File 'IncorrectlySignedPackage.1.0.0.nupkg' Certificate='NuGet'" });
         }
@@ -2031,7 +2031,7 @@ public void SignNupkgWithUnsignedContents()
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>();
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -2059,7 +2059,7 @@ public void SignMsiEngine()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -2108,7 +2108,7 @@ public void SignBundleDoubleNested()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -2160,7 +2160,7 @@ public void MsiWithWixpack()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfoWithCollisionId, new[]
             {
@@ -2227,7 +2227,7 @@ public void MPackFile()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -2262,7 +2262,7 @@ public void VsixPackage_DuplicateVsixAfter()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfoWithCollisionId, new[]
             {
@@ -2323,7 +2323,7 @@ public void VsixPackage_WithSpaces()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfoWithCollisionId, new[]
             {
@@ -2384,7 +2384,7 @@ public void VsixPackage_DuplicateVsixBefore()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -2442,7 +2442,7 @@ public void VsixPackage_DuplicateVsixBeforeAndAfter()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfoWithCollisionId, new[]
             {
@@ -2502,7 +2502,7 @@ public void VsixPackageWithRelationships()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -2536,9 +2536,9 @@ public void ZeroLengthFilesShouldNotBeSigned()
             // Default signing information
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>();
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>()
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>()
             {
-                { new ExplicitCertificateKey("ZeroLengthPythonFile.py"), "3PartySHA2" }
+                { new ExplicitSignInfoKey("ZeroLengthPythonFile.py"), new FileSignInfoEntry("3PartySHA2") }
             };
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, Array.Empty<string>());
         }
@@ -2561,7 +2561,7 @@ public void CheckFileExtensionSignInfo()
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>();
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfoWithCollisionId, new[]
             {
@@ -2647,7 +2647,7 @@ public void FilesAreUniqueByName()
                 new ItemToSign(GetResourcePath("SameFiles2.zip"), "123"),
             };
 
-            ValidateFileSignInfos(itemsToSign, new Dictionary<string, List<SignInfo>>(), new Dictionary<ExplicitCertificateKey, string>(), s_fileExtensionSignInfoWithCollisionId, new[]
+            ValidateFileSignInfos(itemsToSign, new Dictionary<string, List<SignInfo>>(), new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>(), s_fileExtensionSignInfoWithCollisionId, new[]
             {
                 "File 'Simple1.exe' TargetFramework='.NETCoreApp,Version=v2.1' Certificate='Microsoft400'",
                 "File 'Simple2.exe' TargetFramework='.NETCoreApp,Version=v2.1' Certificate='Microsoft400'",
@@ -2821,7 +2821,7 @@ public void ValidateAppendingCertificate()
                 { "31bf3856ad364e35", new List<SignInfo>{ new SignInfo(certificate: dualCertName, strongName: null) } }
             };
 
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -2854,7 +2854,7 @@ public void ValidateCertNotAppendedWithNonMatchingCollisionId()
                 { "31bf3856ad364e35", new List<SignInfo>{ new SignInfo(certificate: dualCertName, strongName: null) } }
             };
 
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new string[] { }, additionalCertificateInfo: additionalCertInfo);
         }
@@ -2875,7 +2875,7 @@ public void PackageWithZipFile()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfoWithCollisionId, new[]
             {
@@ -2907,7 +2907,7 @@ public void NestedZipFile()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>();
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
             {
@@ -2958,26 +2958,26 @@ public void SpecificFileSignInfos()
             };
 
             // Overriding information
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>()
-            {
-                { new ExplicitCertificateKey("test.jar", collisionPriorityId: "123"), "JARCertificate" },
-                { new ExplicitCertificateKey("test.ps1", collisionPriorityId: "123"), "PS1Certificate" },
-                { new ExplicitCertificateKey("test.psd1", collisionPriorityId: "123"), "PSD1Certificate" },
-                { new ExplicitCertificateKey("test.psm1", collisionPriorityId: "123"), "PSM1Certificate" },
-                { new ExplicitCertificateKey("test.psc1", collisionPriorityId: "123"), "PSC1Certificate" },
-                { new ExplicitCertificateKey("test.dylib", collisionPriorityId: "123"), "DYLIBCertificate" },
-                { new ExplicitCertificateKey("EmptyPKT.dll", collisionPriorityId: "123"), "DLLCertificate" },
-                { new ExplicitCertificateKey("test.vsix", collisionPriorityId: "123"), "VSIXCertificate" },
-                { new ExplicitCertificateKey("PackageWithRelationships.vsix", collisionPriorityId: "123"), "VSIXCertificate2" },
-                { new ExplicitCertificateKey("Simple.dll", collisionPriorityId: "123"), "DLLCertificate2" },
-                { new ExplicitCertificateKey("Simple.nupkg", collisionPriorityId: "123"), "NUPKGCertificate" },
-                { new ExplicitCertificateKey("Simple.symbols.nupkg", collisionPriorityId: "123"), "NUPKGCertificate2" },
-                { new ExplicitCertificateKey("ProjectOne.dll", "581d91ccdfc4ea9c", ".NETFramework,Version=v4.6.1", "123"), "DLLCertificate3" },
-                { new ExplicitCertificateKey("ProjectOne.dll", "581d91ccdfc4ea9c", ".NETStandard,Version=v2.0", "123"), "DLLCertificate4" },
-                { new ExplicitCertificateKey("ProjectOne.dll", "581d91ccdfc4ea9c", ".NETCoreApp,Version=v2.0", "123"), "DLLCertificate5" },
-                { new ExplicitCertificateKey("filewithoutextension", collisionPriorityId: "123"), "MacDeveloperHarden" },
-                { new ExplicitCertificateKey("SPCNoPKT.dll", collisionPriorityId: "123"), "None" },
-                { new ExplicitCertificateKey("Simple.exe", collisionPriorityId: "1234"), "MacDeveloperHardenWithNotarization" },
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>()
+            {
+                { new ExplicitSignInfoKey("test.jar", collisionPriorityId: "123"), new FileSignInfoEntry("JARCertificate") },
+                { new ExplicitSignInfoKey("test.ps1", collisionPriorityId: "123"), new FileSignInfoEntry("PS1Certificate") },
+                { new ExplicitSignInfoKey("test.psd1", collisionPriorityId: "123"), new FileSignInfoEntry("PSD1Certificate") },
+                { new ExplicitSignInfoKey("test.psm1", collisionPriorityId: "123"), new FileSignInfoEntry("PSM1Certificate") },
+                { new ExplicitSignInfoKey("test.psc1", collisionPriorityId: "123"), new FileSignInfoEntry("PSC1Certificate") },
+                { new ExplicitSignInfoKey("test.dylib", collisionPriorityId: "123"), new FileSignInfoEntry("DYLIBCertificate") },
+                { new ExplicitSignInfoKey("EmptyPKT.dll", collisionPriorityId: "123"), new FileSignInfoEntry("DLLCertificate") },
+                { new ExplicitSignInfoKey("test.vsix", collisionPriorityId: "123"), new FileSignInfoEntry("VSIXCertificate") },
+                { new ExplicitSignInfoKey("PackageWithRelationships.vsix", collisionPriorityId: "123"), new FileSignInfoEntry("VSIXCertificate2") },
+                { new ExplicitSignInfoKey("Simple.dll", collisionPriorityId: "123"), new FileSignInfoEntry("DLLCertificate2") },
+                { new ExplicitSignInfoKey("Simple.nupkg", collisionPriorityId: "123"), new FileSignInfoEntry("NUPKGCertificate") },
+                { new ExplicitSignInfoKey("Simple.symbols.nupkg", collisionPriorityId: "123"), new FileSignInfoEntry("NUPKGCertificate2") },
+                { new ExplicitSignInfoKey("ProjectOne.dll", "581d91ccdfc4ea9c", ".NETFramework,Version=v4.6.1", "123"), new FileSignInfoEntry("DLLCertificate3") },
+                { new ExplicitSignInfoKey("ProjectOne.dll", "581d91ccdfc4ea9c", ".NETStandard,Version=v2.0", "123"), new FileSignInfoEntry("DLLCertificate4") },
+                { new ExplicitSignInfoKey("ProjectOne.dll", "581d91ccdfc4ea9c", ".NETCoreApp,Version=v2.0", "123"), new FileSignInfoEntry("DLLCertificate5") },
+                { new ExplicitSignInfoKey("filewithoutextension", collisionPriorityId: "123"), new FileSignInfoEntry("MacDeveloperHarden") },
+                { new ExplicitSignInfoKey("SPCNoPKT.dll", collisionPriorityId: "123"), new FileSignInfoEntry("None") },
+                { new ExplicitSignInfoKey("Simple.exe", collisionPriorityId: "1234"), new FileSignInfoEntry("MacDeveloperHardenWithNotarization") },
             };
 
             // Set up the cert to allow for signing and notarization.
@@ -3041,11 +3041,11 @@ public void ExecutableTypeFileSignInfos()
             var strongNameSignInfo = new Dictionary<string, List<SignInfo>>();
 
             // File-specific signing information with ExecutableType
-            var fileSignInfo = new Dictionary<ExplicitCertificateKey, string>()
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>()
             {
-                { new ExplicitCertificateKey("windows-exe.exe", executableType: ExecutableType.PE, collisionPriorityId: "123"), "WindowsCertificate" },
-                { new ExplicitCertificateKey("linux-elf", executableType: ExecutableType.ELF, collisionPriorityId: "123"), "LinuxCertificate" },
-                { new ExplicitCertificateKey("macos-macho", executableType: ExecutableType.MachO, collisionPriorityId: "123"), "MacDeveloperHarden" },
+                { new ExplicitSignInfoKey("windows-exe.exe", executableType: ExecutableType.PE, collisionPriorityId: "123"), new FileSignInfoEntry("WindowsCertificate") },
+                { new ExplicitSignInfoKey("linux-elf", executableType: ExecutableType.ELF, collisionPriorityId: "123"), new FileSignInfoEntry("LinuxCertificate") },
+                { new ExplicitSignInfoKey("macos-macho", executableType: ExecutableType.MachO, collisionPriorityId: "123"), new FileSignInfoEntry("MacDeveloperHarden") },
             };
 
             ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfo, new[]
@@ -3125,7 +3125,7 @@ public void MissingCertificateName(string extension)
             new Configuration(_tmpDir,
                 itemsToSign,
                 new Dictionary<string, List<SignInfo>>(),
-                new Dictionary<ExplicitCertificateKey, string>(),
+                new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>(),
                 new Dictionary<string, List<SignInfo>>(),
                 new(),
                 null,
@@ -3176,7 +3176,7 @@ public void MissingCertificateNameButExtensionIsIgnored(string extension)
             new Configuration(_tmpDir,
                 itemsToSign,
                 new Dictionary<string, List<SignInfo>>(),
-                new Dictionary<ExplicitCertificateKey, string>(),
+                new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>(),
                 extensionSignInfo,
                 new(),
                 null,
@@ -3200,15 +3200,14 @@ public void CrossGeneratedLibraryWithoutPKT()
             ValidateFileSignInfos(
                 itemsToSign, 
                 new Dictionary<string, List<SignInfo>>(), 
-                new Dictionary<ExplicitCertificateKey, 
-                string>(), 
+                new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>(), 
                 s_fileExtensionSignInfoWithCollisionId, 
                 new string[0]);
 
             ValidateGeneratedProject(
                 itemsToSign, 
                 new Dictionary<string, List<SignInfo>>(), 
-                new Dictionary<ExplicitCertificateKey, string>(), 
+                new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>(), 
                 s_fileExtensionSignInfoWithCollisionId, 
                 new string[0]);
         }
@@ -3559,5 +3558,82 @@ public void TestSignShouldNotValidateNuGetSignatures()
             var testSignResult = testSignTool.VerifySignedNuGet(nupkgPath);
             testSignResult.Should().Be(SigningStatus.Signed, "TestSign mode should return Signed without validation");
         }
+
+        [Fact]
+        public void ContainerSigningWithDoNotUnpackViaFileSignInfo()
+        {
+            // Test DoNotUnpack for both top-level and nested containers
+            // Uses NestedContainer.1.0.0.nupkg which contains ContainerOne.1.0.0.nupkg
+            var itemsToSign = new List<ItemToSign>()
+            {
+                new ItemToSign(GetResourcePath("NestedContainer.1.0.0.nupkg"), collisionPriorityId: "123")
+            };
+
+            var strongNameSignInfo = new Dictionary<string, List<SignInfo>>()
+            {
+                { "581d91ccdfc4ea9c", new List<SignInfo> {new SignInfo(certificate: "3PartySHA2", strongName: "ArcadeStrongTest", collisionPriorityId: "123") } }
+            };
+
+            // Test 1: Set DoNotUnpack=true on top-level container without certificate (uses default from extension)
+            // Result: Only the top-level container is signed, nested container is not extracted
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>()
+            {
+                { new ExplicitSignInfoKey("NestedContainer.1.0.0.nupkg", collisionPriorityId: "123"), new FileSignInfoEntry(doNotUnpack: true) }
+            };
+
+            ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfoWithCollisionId, new[]
+            {
+                "File 'NestedContainer.1.0.0.nupkg' Certificate='NuGet'",
+            });
+
+            // Test 2: Set DoNotUnpack=true on nested container with explicit certificate, but allow top-level to unpack
+            // Result: Top-level is unpacked and its contents signed, but nested container is signed without unpacking
+            fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>()
+            {
+                { new ExplicitSignInfoKey("ContainerOne.1.0.0.nupkg", collisionPriorityId: "123"), new FileSignInfoEntry("NuGet", doNotUnpack: true) }
+            };
+
+            ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, s_fileExtensionSignInfoWithCollisionId, new[]
+            {
+                "File 'NativeLibrary.dll' Certificate='Microsoft400'",
+                "File 'ProjectOne.dll' TargetFramework='.NETFramework,Version=v4.6.1' Certificate='3PartySHA2' StrongName='ArcadeStrongTest'",
+                "File 'ContainerTwo.dll' TargetFramework='.NETCoreApp,Version=v2.0' Certificate='3PartySHA2' StrongName='ArcadeStrongTest'",
+                "File 'ProjectOne.dll' TargetFramework='.NETCoreApp,Version=v2.0' Certificate='3PartySHA2' StrongName='ArcadeStrongTest'",
+                "File 'ProjectOne.dll' TargetFramework='.NETCoreApp,Version=v2.1' Certificate='3PartySHA2' StrongName='ArcadeStrongTest'",
+                "File 'ProjectOne.dll' TargetFramework='.NETStandard,Version=v2.0' Certificate='3PartySHA2' StrongName='ArcadeStrongTest'",
+                "File 'ContainerOne.1.0.0.nupkg' Certificate='NuGet'",
+                "File 'NestedContainer.1.0.0.nupkg' Certificate='NuGet'",
+            });
+        }
+
+        [Fact]
+        public void ContainerSigningWithDoNotUnpackViaFileExtensionSignInfo()
+        {
+            // Test DoNotUnpack for both top-level and nested containers
+            var itemsToSign = new List<ItemToSign>()
+            {
+                new ItemToSign(GetResourcePath("NestedContainer.1.0.0.nupkg"), collisionPriorityId: "123")
+            };
+
+            var strongNameSignInfo = new Dictionary<string, List<SignInfo>>()
+            {
+                { "581d91ccdfc4ea9c", new List<SignInfo> {new SignInfo(certificate: "3PartySHA2", strongName: "ArcadeStrongTest", collisionPriorityId: "123") } }
+            };
+
+            var fileSignInfo = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
+
+            // Configure DoNotUnpack via FileExtensionSignInfo for all .nupkg files
+            // Result: Only the top-level container is signed because DoNotUnpack=true prevents extraction
+            var extensionSignInfoWithDoNotUnpack = new Dictionary<string, List<SignInfo>>()
+            {
+                { ".nupkg", new List<SignInfo>{ new SignInfo("NuGet", collisionPriorityId: "123", doNotUnpack: true) } },
+                { ".dll", new List<SignInfo>{ new SignInfo("Microsoft400", collisionPriorityId: "123") } },
+            };
+
+            ValidateFileSignInfos(itemsToSign, strongNameSignInfo, fileSignInfo, extensionSignInfoWithDoNotUnpack, new[]
+            {
+                "File 'NestedContainer.1.0.0.nupkg' Certificate='NuGet'",
+            });
+        }
     }
 }
diff --git a/src/arcade/src/Microsoft.DotNet.SignTool/src/BatchSignUtil.cs b/src/arcade/src/Microsoft.DotNet.SignTool/src/BatchSignUtil.cs
index ecd63cf0009b..b3500c39d969 100644
--- a/src/arcade/src/Microsoft.DotNet.SignTool/src/BatchSignUtil.cs
+++ b/src/arcade/src/Microsoft.DotNet.SignTool/src/BatchSignUtil.cs
@@ -281,8 +281,18 @@ void repackContainer(FileSignInfo file)
             {
                 if (file.IsUnpackableContainer())
                 {
-                    _log.LogMessage($"Repacking container: '{file.FileName}'");
-                    _batchData.ZipDataMap[file.FileContentKey].Repack(_log, _signTool.TempDir, _signTool.Wix3ToolsPath, _signTool.WixToolsPath, _signTool.TarToolPath, _signTool.PkgToolPath);
+                    if (_batchData.ZipDataMap.TryGetValue(file.FileContentKey, out var zipData))
+                    {
+                        _log.LogMessage($"Repacking container: '{file.FileName}'");
+                        zipData.Repack(_log, _signTool.TempDir, _signTool.Wix3ToolsPath, _signTool.WixToolsPath, _signTool.TarToolPath, _signTool.PkgToolPath);
+                    }
+                    else
+                    {
+                        if (!file.SignInfo.DoNotUnpack)
+                        {
+                            _log.LogError($"No zip data found for file '{file.FullPath}' to repack.");
+                        }
+                    }
                 }
                 else
                 {
@@ -294,9 +304,8 @@ void repackContainer(FileSignInfo file)
             // signed, don't need signing, and are repacked.
             bool isReady(FileSignInfo file)
             {
-                if (file.IsUnpackableContainer())
+                if (_batchData.ZipDataMap.TryGetValue(file.FileContentKey, out var zipData))
                 {
-                    var zipData = _batchData.ZipDataMap[file.FileContentKey];
                     return zipData.NestedParts.Values.All(x => (!x.FileSignInfo.SignInfo.ShouldSign ||
                         trackedSet.Contains(x.FileSignInfo.FileContentKey)) && !toRepackSet.Contains(x.FileSignInfo.FullPath)
                         );
@@ -664,10 +673,8 @@ private void VerifyAfterSign(TaskLoggingHelper log, FileSignInfo file)
                 }
             }
 
-            if (file.IsUnpackableContainer())
+            if (_batchData.ZipDataMap.TryGetValue(file.FileContentKey, out var zipData))
             {
-                var zipData = _batchData.ZipDataMap[file.FileContentKey];
-
                 foreach (var nestedPart in zipData.NestedParts.Values)
                 {
                     VerifyAfterSign(log, nestedPart.FileSignInfo);
diff --git a/src/arcade/src/Microsoft.DotNet.SignTool/src/Configuration.cs b/src/arcade/src/Microsoft.DotNet.SignTool/src/Configuration.cs
index 074a9528ae0a..df7f373d9428 100644
--- a/src/arcade/src/Microsoft.DotNet.SignTool/src/Configuration.cs
+++ b/src/arcade/src/Microsoft.DotNet.SignTool/src/Configuration.cs
@@ -34,11 +34,11 @@ internal class Configuration
         private readonly string _pathToContainerUnpackingDirectory;
 
         /// <summary>
-        /// This enable the overriding of the default certificate for a given file+token+target_framework.
-        /// It also contains a SignToolConstants.IgnoreFileCertificateSentinel flag in the certificate name in case the file does not need to be signed
-        /// for that 
+        /// This enables the overriding of the default certificate for a given file+token+target_framework.
+        /// It also contains a SignToolConstants.IgnoreFileCertificateSentinel flag in the certificate name in case the file does not need to be signed.
+        /// Additionally, this can specify DoNotUnpack behavior for files without requiring a certificate to be specified.
         /// </summary>
-        private readonly Dictionary<ExplicitCertificateKey, string> _fileSignInfo;
+        private readonly Dictionary<ExplicitSignInfoKey, FileSignInfoEntry> _fileSignInfo;
 
         /// <summary>
         /// Used to look for signing information when we have the PublicKeyToken of a file.
@@ -54,9 +54,9 @@ internal class Configuration
         private List<WixPackInfo> _wixPacks;
 
         /// <summary>
-        /// Mapping of ".ext" to certificate. Files that have an extension on this map
-        /// will be signed using the specified certificate. Input list might contain
-        /// duplicate entries
+        /// Mapping of ".ext" to signing information including certificate and DoNotUnpack flag. 
+        /// Files that have an extension on this map will be signed using the specified certificate 
+        /// and/or have DoNotUnpack behavior applied. Input list might contain duplicate entries.
         /// </summary>
         private readonly Dictionary<string, List<SignInfo>> _fileExtensionSignInfo;
 
@@ -111,7 +111,7 @@ public Configuration(
             string tempDir,
             List<ItemToSign> itemsToSign,
             Dictionary<string, List<SignInfo>> strongNameInfo,
-            Dictionary<ExplicitCertificateKey, string> fileSignInfo,
+            Dictionary<ExplicitSignInfoKey, FileSignInfoEntry> fileSignInfo,
             Dictionary<string, List<SignInfo>> extensionSignInfo,
             Dictionary<string, List<AdditionalCertificateInformation>> additionalCertificateInformation,
             HashSet<string> itemsToSkip3rdPartyCheck,
@@ -237,39 +237,47 @@ private FileSignInfo TrackFile(PathWithHash file, PathWithHash parentContainer,
 
             if (fileSignInfo.IsUnpackableContainer())
             {
-                if (fileSignInfo.IsUnpackableWixContainer())
+                if (fileSignInfo.SignInfo.DoNotUnpack)
                 {
-                    _log.LogMessage($"Trying to gather data for wix container {fileSignInfo.FullPath}");
-                    if (TryBuildWixData(fileSignInfo, out var msiData))
-                    {
-                        _zipDataMap[fileSignInfo.FileContentKey] = msiData;
-                    }
-                    else
-                    {
-                        _log.LogError($"Failed to build wix data for {fileSignInfo.FullPath}");
-                    }
+                    _log.LogMessage(MessageImportance.Normal, "Skipping container unpacking for '{0}' due to DoNotUnpack flag", file.FullPath);
                 }
                 else
                 {
-                    if (TryBuildZipData(fileSignInfo, out var zipData))
+                    if (fileSignInfo.IsUnpackableWixContainer())
                     {
-                        _zipDataMap[fileSignInfo.FileContentKey] = zipData;
+                        _log.LogMessage($"Trying to gather data for wix container {fileSignInfo.FullPath}");
+                        if (TryBuildWixData(fileSignInfo, out var msiData))
+                        {
+                            _zipDataMap[fileSignInfo.FileContentKey] = msiData;
+                        }
+                        else
+                        {
+                            _log.LogError($"Failed to build wix data for {fileSignInfo.FullPath}");
+                        }
                     }
                     else
                     {
-                        _log.LogError($"Failed to build zip data for {fileSignInfo.FullPath}");
+                        if (TryBuildZipData(fileSignInfo, out var builtZipData))
+                        {
+                            _zipDataMap[fileSignInfo.FileContentKey] = builtZipData;
+                        }
+                        else
+                        {
+                            _log.LogError($"Failed to build zip data for {fileSignInfo.FullPath}");
+                        }
                     }
                 }
             }
+
             _log.LogMessage(MessageImportance.Low, $"Caching file {fileSignInfo.FileContentKey.FileName} {fileSignInfo.FileContentKey.StringHash}");
             _filesByContentKey.Add(fileSignInfo.FileContentKey, fileSignInfo);
 
             bool hasSignableParts = false;
-            if (fileSignInfo.IsUnpackableContainer())
+            if (_zipDataMap.TryGetValue(fileSignInfo.FileContentKey, out var cachedZipData))
             {
                 // Only sign containers if the file itself is unsigned, or 
                 // an item in the container is unsigned.
-                hasSignableParts = _zipDataMap[fileSignInfo.FileContentKey].NestedParts.Values.Any(b => b.FileSignInfo.SignInfo.ShouldSign || b.FileSignInfo.HasSignableParts);
+                hasSignableParts = cachedZipData.NestedParts.Values.Any(b => b.FileSignInfo.SignInfo.ShouldSign || (b.FileSignInfo.HasSignableParts && !b.FileSignInfo.SignInfo.DoNotUnpack));
                 if (hasSignableParts)
                 {
                     // If the file has contents that need to be signed, then re-evaluate the signing info
@@ -306,7 +314,7 @@ private FileSignInfo ExtractSignInfo(
             string wixContentFilePath)
         {
             var extension = Path.GetExtension(file.FileName);
-            string explicitCertificateName = null;
+            FileSignInfoEntry explicitFileSignInfoEntry = null;
             var fileSpec = string.Empty;
             var isAlreadyAuthenticodeSigned = false;
             var isAlreadyStrongNamed = false;
@@ -426,12 +434,12 @@ private FileSignInfo ExtractSignInfo(
 
                 // Check if we have more specific sign info:
                 matchedNameTokenFramework = _fileSignInfo.TryGetValue(
-                    new ExplicitCertificateKey(file.FileName, peInfo.PublicKeyToken, peInfo.TargetFramework, _hashToCollisionIdMap[signedFileContentKey]),
-                    out explicitCertificateName);
+                    new ExplicitSignInfoKey(file.FileName, peInfo.PublicKeyToken, peInfo.TargetFramework, _hashToCollisionIdMap[signedFileContentKey]),
+                    out explicitFileSignInfoEntry);
                 
                 matchedNameToken = !matchedNameTokenFramework && _fileSignInfo.TryGetValue(
-                    new ExplicitCertificateKey(file.FileName, peInfo.PublicKeyToken, collisionPriorityId: _hashToCollisionIdMap[signedFileContentKey]),
-                    out explicitCertificateName);
+                    new ExplicitSignInfoKey(file.FileName, peInfo.PublicKeyToken, collisionPriorityId: _hashToCollisionIdMap[signedFileContentKey]),
+                    out explicitFileSignInfoEntry);
 
                 fileSpec = matchedNameTokenFramework ? $" (PublicKeyToken = {peInfo.PublicKeyToken}, Framework = {peInfo.TargetFramework})" :
                         matchedNameToken ? $" (PublicKeyToken = {peInfo.PublicKeyToken})" : string.Empty;
@@ -462,17 +470,17 @@ private FileSignInfo ExtractSignInfo(
             }
 
             // We didn't find any specific information for PE files using PKT + TargetFramework
-            if (explicitCertificateName == null)
+            if (explicitFileSignInfoEntry == null)
             {
                 // First try with ExecutableType
-                var matchedNameAndExecutableType = _fileSignInfo.TryGetValue(new ExplicitCertificateKey(file.FileName,
-                    collisionPriorityId: _hashToCollisionIdMap[signedFileContentKey], executableType: executableType), out explicitCertificateName);
+                var matchedNameAndExecutableType = _fileSignInfo.TryGetValue(new ExplicitSignInfoKey(file.FileName,
+                    collisionPriorityId: _hashToCollisionIdMap[signedFileContentKey], executableType: executableType), out explicitFileSignInfoEntry);
                 
                 // If no match with ExecutableType, try without it for backward compatibility
                 if (!matchedNameAndExecutableType)
                 {
-                    matchedName = _fileSignInfo.TryGetValue(new ExplicitCertificateKey(file.FileName,
-                        collisionPriorityId: _hashToCollisionIdMap[signedFileContentKey]), out explicitCertificateName);
+                    matchedName = _fileSignInfo.TryGetValue(new ExplicitSignInfoKey(file.FileName,
+                        collisionPriorityId: _hashToCollisionIdMap[signedFileContentKey]), out explicitFileSignInfoEntry);
                 }
                 else
                 {
@@ -480,11 +488,21 @@ private FileSignInfo ExtractSignInfo(
                 }
             }
 
+            // Extract explicit certificate name and DoNotUnpack flag from FileSignInfoEntry
+            string explicitCertificateName = explicitFileSignInfoEntry?.CertificateName;
+            
+            // Determine DoNotUnpack value:
+            // - If FileSignInfo is present, use its DoNotUnpack value (takes precedence)
+            // - Otherwise, use the DoNotUnpack from FileExtensionSignInfo (via signInfo)
+            bool doNotUnpack = explicitFileSignInfoEntry != null 
+                ? explicitFileSignInfoEntry.DoNotUnpack 
+                : signInfo.DoNotUnpack;
+
             // If has overriding info, is it for ignoring the file?
             if (SignToolConstants.IgnoreFileCertificateSentinel.Equals(explicitCertificateName, StringComparison.OrdinalIgnoreCase))
             {
                 _log.LogMessage(MessageImportance.Low, $"File configured to not be signed: {file.FullPath}{fileSpec}");
-                return new FileSignInfo(file, SignInfo.Ignore);
+                return new FileSignInfo(file, SignInfo.Ignore.WithDoNotUnpack(doNotUnpack));
             }
 
             // Do we have an explicit certificate after all?
@@ -493,6 +511,12 @@ private FileSignInfo ExtractSignInfo(
                 signInfo = signInfo.WithCertificateName(explicitCertificateName, _hashToCollisionIdMap[signedFileContentKey]);
                 hasSignInfo = true;
             }
+            
+            // Apply DoNotUnpack from FileSignInfo if present (takes precedence over extension-based DoNotUnpack)
+            if (explicitFileSignInfoEntry != null)
+            {
+                signInfo = signInfo.WithDoNotUnpack(explicitFileSignInfoEntry.DoNotUnpack);
+            }
 
             if (hasSignInfo)
             {
@@ -517,7 +541,7 @@ private FileSignInfo ExtractSignInfo(
                     _log.LogWarning($"Skipping file '{file.FullPath}' because .js files are no longer signed by default. " +
                         "To disable this warning, please explicitly define the FileExtensionSignInfo for the .js extension " +
                         "or set the MSBuild property 'NoSignJS' to 'true'.");
-                    return new FileSignInfo(file, SignInfo.Ignore, wixContentFilePath: wixContentFilePath);
+                    return new FileSignInfo(file, SignInfo.Ignore.WithDoNotUnpack(doNotUnpack), wixContentFilePath: wixContentFilePath);
                 }
 
                 // If the file is already signed and we are not allowed to dual sign, and we are not doing a mac notarization operation,
@@ -556,7 +580,7 @@ private FileSignInfo ExtractSignInfo(
                 _log.LogMessage(MessageImportance.Low, $"Ignoring non-signable file: {file.FullPath}");
             }
 
-            return new FileSignInfo(file, SignInfo.Ignore, wixContentFilePath: wixContentFilePath);
+            return new FileSignInfo(file, SignInfo.Ignore.WithDoNotUnpack(doNotUnpack), wixContentFilePath: wixContentFilePath);
 
             bool IsSigned(PathWithHash file, SigningStatus signingStatus)
             {
@@ -798,7 +822,7 @@ private bool TryBuildZipData(FileSignInfo zipFileSignInfo, out ZipData zipData,
             }
             else
             {
-                Debug.Assert(zipFileSignInfo.IsUnpackableContainer());
+                Debug.Assert(zipFileSignInfo.IsUnpackableContainer() && !zipFileSignInfo.SignInfo.DoNotUnpack);
             }
 
             try
diff --git a/src/arcade/src/Microsoft.DotNet.SignTool/src/ExplicitCertificateKey.cs b/src/arcade/src/Microsoft.DotNet.SignTool/src/ExplicitSignInfoKey.cs
similarity index 60%
rename from src/arcade/src/Microsoft.DotNet.SignTool/src/ExplicitCertificateKey.cs
rename to src/arcade/src/Microsoft.DotNet.SignTool/src/ExplicitSignInfoKey.cs
index 14f4531cbcfa..66cf9e8ad9cd 100644
--- a/src/arcade/src/Microsoft.DotNet.SignTool/src/ExplicitCertificateKey.cs
+++ b/src/arcade/src/Microsoft.DotNet.SignTool/src/ExplicitSignInfoKey.cs
@@ -6,7 +6,12 @@
 
 namespace Microsoft.DotNet.SignTool
 {
-    internal readonly struct ExplicitCertificateKey : IEquatable<ExplicitCertificateKey>
+    /// <summary>
+    /// Key used to identify file-specific signing information in FileSignInfo.
+    /// Represents the entity being signed (file name, path, attributes) rather than just certificate correlation.
+    /// Can be used to specify signing properties like DoNotUnpack independently of certificates.
+    /// </summary>
+    internal readonly struct ExplicitSignInfoKey : IEquatable<ExplicitSignInfoKey>
     {
         public readonly string FileName;
         public readonly string PublicKeyToken;
@@ -14,7 +19,7 @@ namespace Microsoft.DotNet.SignTool
         public readonly string CollisionPriorityId;
         public readonly ExecutableType ExecutableType;
 
-        public ExplicitCertificateKey(string fileName, string publicKeyToken = null, string targetFramework = null, string collisionPriorityId = null, ExecutableType executableType = ExecutableType.None)
+        public ExplicitSignInfoKey(string fileName, string publicKeyToken = null, string targetFramework = null, string collisionPriorityId = null, ExecutableType executableType = ExecutableType.None)
         {
             Debug.Assert(fileName != null);
 
@@ -26,22 +31,22 @@ public ExplicitCertificateKey(string fileName, string publicKeyToken = null, str
         }
 
         public override bool Equals(object obj)
-            => obj is ExplicitCertificateKey key && Equals(key);
+            => obj is ExplicitSignInfoKey key && Equals(key);
 
         public override int GetHashCode()
             => Hash.Combine(Hash.Combine(FileName.GetHashCode(), PublicKeyToken.GetHashCode()), Hash.Combine(TargetFramework.GetHashCode(), ExecutableType.GetHashCode()));
 
-        bool IEquatable<ExplicitCertificateKey>.Equals(ExplicitCertificateKey other)
+        bool IEquatable<ExplicitSignInfoKey>.Equals(ExplicitSignInfoKey other)
             => FileName == other.FileName && 
             CollisionPriorityId == other.CollisionPriorityId &&
             string.Equals(PublicKeyToken, other.PublicKeyToken, StringComparison.OrdinalIgnoreCase) && 
             TargetFramework == other.TargetFramework &&
             ExecutableType == other.ExecutableType;
 
-        public static bool operator ==(ExplicitCertificateKey key1, ExplicitCertificateKey key2) 
+        public static bool operator ==(ExplicitSignInfoKey key1, ExplicitSignInfoKey key2) 
             => key1.Equals(key2);
 
-        public static bool operator !=(ExplicitCertificateKey key1, ExplicitCertificateKey key2)
+        public static bool operator !=(ExplicitSignInfoKey key1, ExplicitSignInfoKey key2)
             => !(key1 == key2);
     }
 }
diff --git a/src/arcade/src/Microsoft.DotNet.SignTool/src/FileSignInfo.cs b/src/arcade/src/Microsoft.DotNet.SignTool/src/FileSignInfo.cs
index 47062c119c69..efe8825d81f7 100644
--- a/src/arcade/src/Microsoft.DotNet.SignTool/src/FileSignInfo.cs
+++ b/src/arcade/src/Microsoft.DotNet.SignTool/src/FileSignInfo.cs
@@ -127,7 +127,7 @@ internal bool IsUnpackableContainer() => IsZip() ||
 
         internal bool HasSignableParts { get; }
 
-        internal bool ShouldRepack => HasSignableParts;
+        internal bool ShouldRepack => HasSignableParts && !SignInfo.DoNotUnpack;
 
         internal bool ShouldTrack => SignInfo.ShouldSign || ShouldRepack;
 
@@ -150,7 +150,8 @@ public override string ToString()
                (TargetFramework != null ? $" TargetFramework='{TargetFramework}'" : "") +
                (SignInfo.ShouldSign ? $" Certificate='{SignInfo.Certificate}'" : "") +
                (SignInfo.ShouldStrongName ? $" StrongName='{SignInfo.StrongName}'" : "") +
-               (SignInfo.ShouldNotarize ? $" NotarizationAppName='{SignInfo.NotarizationAppName}'" : "");
+               (SignInfo.ShouldNotarize ? $" NotarizationAppName='{SignInfo.NotarizationAppName}'" : "") +
+               (HasSignableParts && SignInfo.DoNotUnpack ? " DoNotUnpack='true'" : "");
 
         internal FileSignInfo WithSignableParts()
             => new FileSignInfo(File, SignInfo.WithIsAlreadySigned(false), TargetFramework, WixContentFilePath, true);
diff --git a/src/arcade/src/Microsoft.DotNet.SignTool/src/FileSignInfoEntry.cs b/src/arcade/src/Microsoft.DotNet.SignTool/src/FileSignInfoEntry.cs
new file mode 100644
index 000000000000..7b0baef84e5b
--- /dev/null
+++ b/src/arcade/src/Microsoft.DotNet.SignTool/src/FileSignInfoEntry.cs
@@ -0,0 +1,21 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Microsoft.DotNet.SignTool
+{
+    /// <summary>
+    /// Represents file signing information including certificate name and DoNotUnpack flag.
+    /// Certificate name can be null if only DoNotUnpack behavior needs to be specified.
+    /// </summary>
+    internal class FileSignInfoEntry
+    {
+        public string CertificateName { get; }
+        public bool DoNotUnpack { get; }
+
+        public FileSignInfoEntry(string certificateName = null, bool doNotUnpack = false)
+        {
+            CertificateName = certificateName;
+            DoNotUnpack = doNotUnpack;
+        }
+    }
+}
diff --git a/src/arcade/src/Microsoft.DotNet.SignTool/src/SignInfo.cs b/src/arcade/src/Microsoft.DotNet.SignTool/src/SignInfo.cs
index 2f618337432a..6b9d0cf73e02 100644
--- a/src/arcade/src/Microsoft.DotNet.SignTool/src/SignInfo.cs
+++ b/src/arcade/src/Microsoft.DotNet.SignTool/src/SignInfo.cs
@@ -59,6 +59,12 @@ internal readonly struct SignInfo
         /// </summary>
         internal string CollisionPriorityId { get; }
 
+        /// <summary>
+        /// True if this container should not be unpacked during signing.
+        /// When set, only the container itself is signed without extracting and signing nested contents.
+        /// </summary>
+        internal bool DoNotUnpack { get; }
+
         public bool ShouldLocallyStrongNameSign => ShouldStrongName && StrongName.EndsWith(".snk", StringComparison.OrdinalIgnoreCase);
 
         public bool ShouldSign => !IsAlreadySigned && !ShouldIgnore;
@@ -67,7 +73,7 @@ internal readonly struct SignInfo
 
         public bool ShouldNotarize => !string.IsNullOrEmpty(NotarizationAppName) && !ShouldIgnore;
 
-        private SignInfo(string certificate, string strongName, string notarizationAppName, string collisionPriorityId, bool shouldIgnore, bool isAlreadySigned, bool isAlreadyStrongNamed, bool generatesDetachedSignature = false)
+        private SignInfo(string certificate, string strongName, string notarizationAppName, string collisionPriorityId, bool shouldIgnore, bool isAlreadySigned, bool isAlreadyStrongNamed, bool generatesDetachedSignature = false, bool doNotUnpack = false)
         {
             ShouldIgnore = shouldIgnore;
             IsAlreadySigned = isAlreadySigned;
@@ -77,36 +83,40 @@ private SignInfo(string certificate, string strongName, string notarizationAppNa
             IsAlreadyStrongNamed = isAlreadyStrongNamed;
             NotarizationAppName = notarizationAppName;
             GeneratesDetachedSignature = generatesDetachedSignature;
+            DoNotUnpack = doNotUnpack;
         }
 
-        private SignInfo(bool ignoreThisFile, bool alreadySigned, bool isAlreadyStrongNamed, bool generatesDetachedSignature = false)
-            : this(certificate: null, strongName: null, notarizationAppName: null, collisionPriorityId: null, ignoreThisFile, alreadySigned, isAlreadyStrongNamed, generatesDetachedSignature)
+        private SignInfo(bool ignoreThisFile, bool alreadySigned, bool isAlreadyStrongNamed, bool generatesDetachedSignature = false, bool doNotUnpack = false)
+            : this(certificate: null, strongName: null, notarizationAppName: null, collisionPriorityId: null, ignoreThisFile, alreadySigned, isAlreadyStrongNamed, generatesDetachedSignature, doNotUnpack)
         {
         }
 
-        internal SignInfo(string certificate, string strongName = null, string notarization = null, string collisionPriorityId = null)
-            : this(certificate, strongName, notarization, collisionPriorityId, shouldIgnore: false, isAlreadySigned: false, isAlreadyStrongNamed: false)
+        internal SignInfo(string certificate, string strongName = null, string notarization = null, string collisionPriorityId = null, bool doNotUnpack = false)
+            : this(certificate, strongName, notarization, collisionPriorityId, shouldIgnore: false, isAlreadySigned: false, isAlreadyStrongNamed: false, generatesDetachedSignature: false, doNotUnpack: doNotUnpack)
         {
         }
 
         internal SignInfo WithCertificateName(string value, string collisionPriorityId)
-            => new SignInfo(value, StrongName, NotarizationAppName, collisionPriorityId, false, false, IsAlreadyStrongNamed, GeneratesDetachedSignature);
+            => new SignInfo(value, StrongName, NotarizationAppName, collisionPriorityId, false, false, IsAlreadyStrongNamed, GeneratesDetachedSignature, DoNotUnpack);
 
         internal SignInfo WithNotarization(string appName, string collisionPriorityId)
-            => new SignInfo(Certificate, StrongName, appName, collisionPriorityId, false, false, IsAlreadyStrongNamed, GeneratesDetachedSignature);
+            => new SignInfo(Certificate, StrongName, appName, collisionPriorityId, false, false, IsAlreadyStrongNamed, GeneratesDetachedSignature, DoNotUnpack);
 
         internal SignInfo WithCollisionPriorityId(string collisionPriorityId)
-            => new SignInfo(Certificate, StrongName, NotarizationAppName, collisionPriorityId, ShouldIgnore, IsAlreadySigned, IsAlreadyStrongNamed, GeneratesDetachedSignature);
+            => new SignInfo(Certificate, StrongName, NotarizationAppName, collisionPriorityId, ShouldIgnore, IsAlreadySigned, IsAlreadyStrongNamed, GeneratesDetachedSignature, DoNotUnpack);
 
         internal SignInfo WithIsAlreadySigned(bool value = false)
             => Certificate != null ? 
-              new SignInfo(Certificate, StrongName, NotarizationAppName, CollisionPriorityId, value, value, IsAlreadyStrongNamed, GeneratesDetachedSignature) :
-              new SignInfo(Certificate, StrongName, NotarizationAppName, CollisionPriorityId, true, value, IsAlreadyStrongNamed, GeneratesDetachedSignature);
+              new SignInfo(Certificate, StrongName, NotarizationAppName, CollisionPriorityId, value, value, IsAlreadyStrongNamed, GeneratesDetachedSignature, DoNotUnpack) :
+              new SignInfo(Certificate, StrongName, NotarizationAppName, CollisionPriorityId, true, value, IsAlreadyStrongNamed, GeneratesDetachedSignature, DoNotUnpack);
 
         internal SignInfo WithIsAlreadyStrongNamed(bool value = false) =>
-              new SignInfo(Certificate, StrongName, NotarizationAppName, CollisionPriorityId, ShouldIgnore, IsAlreadySigned, value, GeneratesDetachedSignature);
+              new SignInfo(Certificate, StrongName, NotarizationAppName, CollisionPriorityId, ShouldIgnore, IsAlreadySigned, value, GeneratesDetachedSignature, DoNotUnpack);
 
         internal SignInfo WithDetachedSignature(string certificate)
-            => new SignInfo(certificate, StrongName, NotarizationAppName, CollisionPriorityId, false, false, IsAlreadyStrongNamed, true);
+            => new SignInfo(certificate, StrongName, NotarizationAppName, CollisionPriorityId, false, false, IsAlreadyStrongNamed, true, DoNotUnpack);
+
+        internal SignInfo WithDoNotUnpack(bool doNotUnpack)
+            => new SignInfo(Certificate, StrongName, NotarizationAppName, CollisionPriorityId, ShouldIgnore, IsAlreadySigned, IsAlreadyStrongNamed, GeneratesDetachedSignature, doNotUnpack);
     }
 }
diff --git a/src/arcade/src/Microsoft.DotNet.SignTool/src/SignTool.cs b/src/arcade/src/Microsoft.DotNet.SignTool/src/SignTool.cs
index 6b88e6d156bc..b22fc815ef97 100644
--- a/src/arcade/src/Microsoft.DotNet.SignTool/src/SignTool.cs
+++ b/src/arcade/src/Microsoft.DotNet.SignTool/src/SignTool.cs
@@ -208,7 +208,7 @@ private void CompleteDetachedSignatures(List<FileSignInfo> detachedSignatureFile
             foreach (var fileInfo in detachedSignatureFiles)
             {
                 // Copy the signed content to .sig file
-                File.Copy(fileInfo.FullPath, fileInfo.DetachedSignatureFullPath);
+                File.Copy(fileInfo.FullPath, fileInfo.DetachedSignatureFullPath, overwrite: true);
                 _log.LogMessage($"Created detached signature file: {fileInfo.DetachedSignatureFullPath}");
 
                 // Restore the original file
diff --git a/src/arcade/src/Microsoft.DotNet.SignTool/src/SignToolConstants.cs b/src/arcade/src/Microsoft.DotNet.SignTool/src/SignToolConstants.cs
index f0b8b879869b..a3be92ae9329 100644
--- a/src/arcade/src/Microsoft.DotNet.SignTool/src/SignToolConstants.cs
+++ b/src/arcade/src/Microsoft.DotNet.SignTool/src/SignToolConstants.cs
@@ -136,6 +136,12 @@ internal static class SignToolConstants
         /// </summary>
         public const string CollisionPriorityId = "CollisionPriorityId";
         
+        /// <summary>
+        /// Attribute to indicate that a container should be signed without unpacking.
+        /// When set to true, only the top-level container is signed and nested contents are not extracted or signed.
+        /// </summary>
+        public const string DoNotUnpack = "DoNotUnpack";
+        
         /// <summary>
         /// Notarization operation microbuild ID. Microbuild does not currently support the friendly name, MacNotarize
         /// </summary>
diff --git a/src/arcade/src/Microsoft.DotNet.SignTool/src/SignToolTask.cs b/src/arcade/src/Microsoft.DotNet.SignTool/src/SignToolTask.cs
index 8350a285c223..a5d2cea441a2 100644
--- a/src/arcade/src/Microsoft.DotNet.SignTool/src/SignToolTask.cs
+++ b/src/arcade/src/Microsoft.DotNet.SignTool/src/SignToolTask.cs
@@ -447,6 +447,8 @@ private Dictionary<string, List<SignInfo>> ParseFileExtensionSignInfo()
                     var extension = item.ItemSpec;
                     var certificate = item.GetMetadata("CertificateName");
                     var collisionPriorityId = item.GetMetadata(SignToolConstants.CollisionPriorityId);
+                    var doNotUnpackStr = item.GetMetadata(SignToolConstants.DoNotUnpack);
+                    bool.TryParse(doNotUnpackStr, out bool doNotUnpack);
 
                     // Some supported extensions have multiple dots. Special case these so that we don't throw an error below.
                     if (!extension.Equals(Path.GetExtension(extension)) && !specialExtensions.Contains(extension))
@@ -455,15 +457,16 @@ private Dictionary<string, List<SignInfo>> ParseFileExtensionSignInfo()
                         continue;
                     }
 
-                    if (string.IsNullOrWhiteSpace(certificate))
+                    // Certificate is only required when DoNotUnpack is not set
+                    if (!doNotUnpack && string.IsNullOrWhiteSpace(certificate))
                     {
-                        Log.LogError($"CertificateName metadata of {nameof(FileExtensionSignInfo)} is invalid: '{certificate}'");
+                        Log.LogError($"CertificateName metadata of {nameof(FileExtensionSignInfo)} is required when DoNotUnpack is not set: '{extension}'");
                         continue;
                     }
 
                     SignInfo signInfo = certificate.Equals(SignToolConstants.IgnoreFileCertificateSentinel, StringComparison.InvariantCultureIgnoreCase) ?
-                        SignInfo.Ignore.WithCollisionPriorityId(collisionPriorityId) :
-                        new SignInfo(certificate, collisionPriorityId: collisionPriorityId);
+                        SignInfo.Ignore.WithCollisionPriorityId(collisionPriorityId).WithDoNotUnpack(doNotUnpack) :
+                        new SignInfo(certificate, collisionPriorityId: collisionPriorityId, doNotUnpack: doNotUnpack);
 
                     if (map.ContainsKey(extension))
                     {
@@ -539,9 +542,9 @@ private Dictionary<string, List<SignInfo>> ParseStrongNameSignInfo()
             return map;
         }
 
-        private Dictionary<ExplicitCertificateKey, string> ParseFileSignInfo()
+        private Dictionary<ExplicitSignInfoKey, FileSignInfoEntry> ParseFileSignInfo()
         {
-            var map = new Dictionary<ExplicitCertificateKey, string>();
+            var map = new Dictionary<ExplicitSignInfoKey, FileSignInfoEntry>();
 
             if (FileSignInfo != null)
             {
@@ -553,6 +556,8 @@ private Dictionary<ExplicitCertificateKey, string> ParseFileSignInfo()
                     var certificateName = item.GetMetadata("CertificateName");
                     var collisionPriorityId = item.GetMetadata(SignToolConstants.CollisionPriorityId);
                     var executableTypeMetadata = item.GetMetadata("ExecutableType");
+                    var doNotUnpackStr = item.GetMetadata(SignToolConstants.DoNotUnpack);
+                    bool.TryParse(doNotUnpackStr, out bool doNotUnpack);
 
                     if (fileName.IndexOfAny(new[] { '/', '\\' }) >= 0)
                     {
@@ -566,9 +571,10 @@ private Dictionary<ExplicitCertificateKey, string> ParseFileSignInfo()
                         continue;
                     }
 
-                    if (string.IsNullOrWhiteSpace(certificateName))
+                    // Certificate is only required when DoNotUnpack is not set
+                    if (!doNotUnpack && string.IsNullOrWhiteSpace(certificateName))
                     {
-                        Log.LogError($"CertificateName metadata of {nameof(FileSignInfo)} is invalid: '{certificateName}'");
+                        Log.LogError($"CertificateName metadata of {nameof(FileSignInfo)} is required when DoNotUnpack is not set: '{fileName}'");
                         continue;
                     }
 
@@ -585,14 +591,14 @@ private Dictionary<ExplicitCertificateKey, string> ParseFileSignInfo()
                         continue;
                     }
 
-                    var key = new ExplicitCertificateKey(fileName, publicKeyToken, targetFramework, collisionPriorityId, executableType);
-                    if (map.TryGetValue(key, out var existingCert))
+                    var key = new ExplicitSignInfoKey(fileName, publicKeyToken, targetFramework, collisionPriorityId, executableType);
+                    if (map.TryGetValue(key, out var existingEntry))
                     {
-                        Log.LogError($"Duplicate entries in {nameof(FileSignInfo)} with the same key ('{fileName}', '{publicKeyToken}', '{targetFramework}', '{executableTypeMetadata}'): '{existingCert}', '{certificateName}'.");
+                        Log.LogError($"Duplicate entries in {nameof(FileSignInfo)} with the same key ('{fileName}', '{publicKeyToken}', '{targetFramework}', '{executableTypeMetadata}'): '{existingEntry.CertificateName}', '{certificateName}'.");
                         continue;
                     }
 
-                    map.Add(key, certificateName);
+                    map.Add(key, new FileSignInfoEntry(certificateName, doNotUnpack));
                 }
             }
 
diff --git a/src/arcade/src/SignCheck/Microsoft.SignCheck/SignCheckResources.Designer.cs b/src/arcade/src/SignCheck/Microsoft.SignCheck/SignCheckResources.Designer.cs
index 8040edc9ce00..f30968262185 100644
--- a/src/arcade/src/SignCheck/Microsoft.SignCheck/SignCheckResources.Designer.cs
+++ b/src/arcade/src/SignCheck/Microsoft.SignCheck/SignCheckResources.Designer.cs
@@ -374,6 +374,15 @@ internal static string DiagSectionHeader {
                 return ResourceManager.GetString("DiagSectionHeader", resourceCulture);
             }
         }
+
+        /// <summary>
+        ///   Looks up a localized string similar to Skipping archive extraction on {0}.
+        /// </summary>
+        internal static string DiagSkippingArchiveExtraction {
+            get {
+                return ResourceManager.GetString("DiagSkippingArchiveExtraction", resourceCulture);
+            }
+        }
         
         /// <summary>
         ///   Looks up a localized string similar to Skipping strong name signature check..
diff --git a/src/arcade/src/SignCheck/Microsoft.SignCheck/SignCheckResources.resx b/src/arcade/src/SignCheck/Microsoft.SignCheck/SignCheckResources.resx
index 5c51ca85f7ba..97eec695bd20 100644
--- a/src/arcade/src/SignCheck/Microsoft.SignCheck/SignCheckResources.resx
+++ b/src/arcade/src/SignCheck/Microsoft.SignCheck/SignCheckResources.resx
@@ -222,6 +222,9 @@
   <data name="DiagSectionHeader" xml:space="preserve">
     <value>Found section header '{0}'.</value>
   </data>
+  <data name="DiagSkippingArchiveExtraction" xml:space="preserve">
+    <value>Skipping archive extraction on {0}.</value>
+  </data>
   <data name="DiagSkippingStrongName" xml:space="preserve">
     <value>Skipping strong name signature check.</value>
   </data>
diff --git a/src/arcade/src/SignCheck/Microsoft.SignCheck/Verification/ArchiveVerifier.cs b/src/arcade/src/SignCheck/Microsoft.SignCheck/Verification/ArchiveVerifier.cs
index a78318e0ba7f..bb64a96d20a5 100644
--- a/src/arcade/src/SignCheck/Microsoft.SignCheck/Verification/ArchiveVerifier.cs
+++ b/src/arcade/src/SignCheck/Microsoft.SignCheck/Verification/ArchiveVerifier.cs
@@ -79,6 +79,18 @@ protected void VerifyContent(SignatureVerificationResult svr)
         {
             if (VerifyRecursive)
             {
+                svr.IsDoNotUnpack = Exclusions.IsDoNotUnpack(
+                    svr.FullPath,
+                    Path.GetDirectoryName(svr.FullPath) ?? SignCheckResources.NA,
+                    svr.VirtualPath,
+                    svr.VirtualPath);
+
+                if (svr.IsDoNotUnpack)
+                {
+                    Log.WriteMessage(LogVerbosity.Detailed, SignCheckResources.DiagSkippingArchiveExtraction, svr.FullPath);
+                    return;
+                }
+
                 string tempPath = svr.TempPath;
                 CreateDirectory(tempPath);
                 Log.WriteMessage(LogVerbosity.Diagnostic, SignCheckResources.DiagExtractingFileContents, tempPath);
diff --git a/src/arcade/src/SignCheck/Microsoft.SignCheck/Verification/Exclusions.cs b/src/arcade/src/SignCheck/Microsoft.SignCheck/Verification/Exclusions.cs
index 793a005769c9..27bbdb72426c 100644
--- a/src/arcade/src/SignCheck/Microsoft.SignCheck/Verification/Exclusions.cs
+++ b/src/arcade/src/SignCheck/Microsoft.SignCheck/Verification/Exclusions.cs
@@ -22,6 +22,7 @@ public class Exclusions
         private const string DoNotSign = "DO-NOT-SIGN";
         private const string General = "GENERAL";
         private const string IgnoreStrongName = "IGNORE-STRONG-NAME";
+        private const string DoNotUnpack = "DO-NOT-UNPACK";
 
         public int Count
         {
@@ -113,7 +114,7 @@ private bool IsExcluded(string path, string parent, string virtualPath, string c
         /// <returns></returns>
         public bool IsExcluded(string path, string parent, string virtualPath, string containerPath)
         {
-            IEnumerable<Exclusion> exclusions = _exclusions.Where(e => !e.Comment.Contains(IgnoreStrongName));
+            IEnumerable<Exclusion> exclusions = _exclusions.Where(e => !e.Comment.Contains(IgnoreStrongName) && !e.Comment.Contains(DoNotUnpack));
             return IsExcluded(path, parent, virtualPath, containerPath, General, exclusions);
         }
 
@@ -138,6 +139,14 @@ public bool IsIgnoreStrongName(string path, string parent, string virtualPath, s
             return (noStrongNameExclusions.Count() > 0) && (IsExcluded(path, parent, virtualPath, containerPath, IgnoreStrongName, noStrongNameExclusions));
         }
 
+        public bool IsDoNotUnpack(string path, string parent, string virtualPath, string containerPath)
+        {
+            // Get all the exclusions with DO-NOT-UNPACK markers and check only against those
+            IEnumerable<Exclusion> doNotUnpackExclusions = _exclusions.Where(e => e.Comment.Contains(DoNotUnpack));
+
+            return (doNotUnpackExclusions.Count() > 0) && (IsExcluded(path, parent, virtualPath, containerPath, DoNotUnpack, doNotUnpackExclusions));
+        }
+
         /// <summary>
         /// Returns true if any <see cref="Exclusion.FilePatterns"/> matches the value of
         /// <paramref name="path"/>, <paramref name="containerPath"/> or <paramref name="virtualPath"/>.
diff --git a/src/arcade/src/SignCheck/Microsoft.SignCheck/Verification/SignatureVerificationResult.cs b/src/arcade/src/SignCheck/Microsoft.SignCheck/Verification/SignatureVerificationResult.cs
index b0d392895bba..177d19bd5d6f 100644
--- a/src/arcade/src/SignCheck/Microsoft.SignCheck/Verification/SignatureVerificationResult.cs
+++ b/src/arcade/src/SignCheck/Microsoft.SignCheck/Verification/SignatureVerificationResult.cs
@@ -88,6 +88,15 @@ public bool IsIgnoreStrongName
             set;
         }
 
+        /// <summary>
+        /// True if this file was marked as DO-NOT-UNPACK.
+        /// </summary>
+        public bool IsDoNotUnpack
+        {
+            get;
+            set;
+        }
+
         /// <summary>
         /// True if the file was excluded from verification, false otherwise.
         /// </summary>
diff --git a/src/arcade/src/SignCheck/SignCheckTask/src/SignCheck.cs b/src/arcade/src/SignCheck/SignCheckTask/src/SignCheck.cs
index 4ebb5a69a352..581989b380dc 100644
--- a/src/arcade/src/SignCheck/SignCheckTask/src/SignCheck.cs
+++ b/src/arcade/src/SignCheck/SignCheckTask/src/SignCheck.cs
@@ -106,6 +106,12 @@ public int TotalSkippedFiles
             set;
         }
 
+        public int TotalDoNotUnpackFiles
+        {
+            get;
+            set;
+        }
+
         public int TotalExcludedFiles
         {
             get;
@@ -299,7 +305,7 @@ private List<string> GetInputFilesFromOptions()
 
         private void ProcessExclusions(string exclusionsFile)
         {
-            Log.WriteMessage(LogVerbosity.Diagnostic, SignCheckResources.scProcessExclusions);
+            Log.WriteMessage(LogVerbosity.Diagnostic, SignCheckResources.scProcessExclusions, exclusionsFile);
             Exclusions = new Exclusions(exclusionsFile);
         }
 
@@ -339,6 +345,11 @@ private void ProcessResults(IEnumerable<SignatureVerificationResult> results, in
                     outcome = "SkippedExcluded";
                 }
 
+                if (result.IsDoNotUnpack)
+                {
+                    TotalDoNotUnpackFiles++;
+                }
+
                 // Regardless of the file status reporting settings, a container file like an MSI or NuGet package
                 // is always reported to keep the file hierarchy in the log readable.
                 if (((result.IsSkipped) && ((FileStatus & FileStatus.SkippedFiles) != 0)) ||
@@ -443,7 +454,7 @@ public int Run()
                     TimeSpan totalTime = endTime - startTime;
                     Log.WriteMessage(LogVerbosity.Minimum, String.Format(SignCheckResources.scTime, totalTime));
                     Log.WriteMessage(LogVerbosity.Minimum, String.Format(SignCheckResources.scStats,
-                        TotalFiles, TotalSignedFiles, TotalUnsignedFiles, TotalSkippedFiles, TotalExcludedFiles, TotalSkippedExcludedFiles));
+                        TotalFiles, TotalSignedFiles, TotalUnsignedFiles, TotalSkippedFiles, TotalExcludedFiles, TotalSkippedExcludedFiles, TotalDoNotUnpackFiles));
                 }
                 else
                 {
diff --git a/src/arcade/src/SignCheck/SignCheckTask/src/SignCheckResources.Designer.cs b/src/arcade/src/SignCheck/SignCheckTask/src/SignCheckResources.Designer.cs
index 47a626d8acc8..7f289a87532e 100644
--- a/src/arcade/src/SignCheck/SignCheckTask/src/SignCheckResources.Designer.cs
+++ b/src/arcade/src/SignCheck/SignCheckTask/src/SignCheckResources.Designer.cs
@@ -169,7 +169,7 @@ internal static string scSignIssuesFound {
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to Total Files: {0}, Signed: {1}, Unsigned: {2}, Skipped: {3}, Excluded: {4}, Skipped &amp; Excluded: {5}.
+        ///   Looks up a localized string similar to Total Files: {0}, Signed: {1}, Unsigned: {2}, Skipped: {3}, Excluded: {4}, Skipped &amp; Excluded: {5}, Not Unpacked: {6}.
         /// </summary>
         internal static string scStats {
             get {
diff --git a/src/arcade/src/SignCheck/SignCheckTask/src/SignCheckResources.resx b/src/arcade/src/SignCheck/SignCheckTask/src/SignCheckResources.resx
index 4197533f16c4..cc89974aef77 100644
--- a/src/arcade/src/SignCheck/SignCheckTask/src/SignCheckResources.resx
+++ b/src/arcade/src/SignCheck/SignCheckTask/src/SignCheckResources.resx
@@ -154,7 +154,7 @@
     <value>Signing issues found</value>
   </data>
   <data name="scStats" xml:space="preserve">
-    <value>Total Files: {0}, Signed: {1}, Unsigned: {2}, Skipped: {3}, Excluded: {4}, Skipped &amp; Excluded: {5}</value>
+    <value>Total Files: {0}, Signed: {1}, Unsigned: {2}, Skipped: {3}, Excluded: {4}, Skipped &amp; Excluded: {5}, Not Unpacked: {6}</value>
   </data>
   <data name="scSummary" xml:space="preserve">
     <value />
diff --git a/src/source-manifest.json b/src/source-manifest.json
index 9457f005b588..492a73beddf1 100644
--- a/src/source-manifest.json
+++ b/src/source-manifest.json
@@ -1,10 +1,10 @@
 {
   "repositories": [
     {
-      "barId": 294297,
+      "barId": 300694,
       "path": "arcade",
       "remoteUri": "https://github.com/dotnet/arcade",
-      "commitSha": "9f286ddee40065ea225611cb43ab0415e48994c2"
+      "commitSha": "58d75363f4b03e408aa2502e0db546173be722d4"
     },
     {
       "barId": 288647,
@@ -13,22 +13,22 @@
       "commitSha": "73f1fdca8d9fb191297a7e687790b804f4e78ef5"
     },
     {
-      "barId": 300473,
+      "barId": 293499,
       "path": "fsharp",
       "remoteUri": "https://github.com/dotnet/fsharp",
-      "commitSha": "1870673a6f057bbcf0357e5daf5ae3e650a02aa7"
+      "commitSha": "89d788641914c5d0b87fddfa11f4df0b5cfaa73d"
     },
     {
-      "barId": 296292,
+      "barId": 293177,
       "path": "msbuild",
       "remoteUri": "https://github.com/dotnet/msbuild",
-      "commitSha": "0a5497348104fda248fb9613fffe9394708a7435"
+      "commitSha": "228caa11ad0046ccb599530abd9aba4e1979b5e9"
     },
     {
-      "barId": 295751,
+      "barId": 288424,
       "path": "nuget-client",
-      "remoteUri": "https://github.com/nuget/nuget.client",
-      "commitSha": "a99b70cf718ff7842466a7eaeefa99b471cad517"
+      "remoteUri": "https://github.com/NuGet/NuGet.Client",
+      "commitSha": "bf048eb714eb6b1912ba868edca4c7cfec454841"
     },
     {
       "barId": 289279,
@@ -37,10 +37,10 @@
       "commitSha": "191feab170b690f6a4923072d1b6f6e00272d8a7"
     },
     {
-      "barId": 296041,
+      "barId": 293418,
       "path": "roslyn",
       "remoteUri": "https://github.com/dotnet/roslyn",
-      "commitSha": "9147db3e7773e57bee0ac7cd9f4da701558569ba"
+      "commitSha": "2333221c0564852ee5ceac9c622a0b14e864d76e"
     },
     {
       "barId": 291014,
@@ -49,16 +49,16 @@
       "commitSha": "f29ac531ec59b79ff12335835ae4a69cde51156a"
     },
     {
-      "barId": 299360,
+      "barId": 291910,
       "path": "sdk",
       "remoteUri": "https://github.com/dotnet/sdk",
-      "commitSha": "d30c5b546521cdad7ed907d60857f81a4116806f"
+      "commitSha": "f779efc8c61a92528741de0210e46b47b8e71601"
     },
     {
-      "barId": 296473,
+      "barId": 293338,
       "path": "source-build-reference-packages",
       "remoteUri": "https://github.com/dotnet/source-build-reference-packages",
-      "commitSha": "ad86fd75a9bf8400b4156c70d984c4d997995472"
+      "commitSha": "b73c3ef0856c34ccd8a50a1c8c2151cab1f469e0"
     },
     {
       "barId": 292299,
@@ -67,16 +67,16 @@
       "commitSha": "b9386293548b43c7c6cd294c1fc14a5c4d16a15f"
     },
     {
-      "barId": 299478,
+      "barId": 291391,
       "path": "templating",
       "remoteUri": "https://github.com/dotnet/templating",
-      "commitSha": "bfc7d4dd05edfb284a7b7743f483fb5061500f2b"
+      "commitSha": "069bda6132d6ac2134cc9b26d651ccb825ff212d"
     },
     {
-      "barId": 295978,
+      "barId": 291277,
       "path": "vstest",
       "remoteUri": "https://github.com/microsoft/vstest",
-      "commitSha": "41f7799afd5767945acc16071ab64fa984bca274"
+      "commitSha": "4524dcd1e91c0d09d6da6576952f8df05e666e9c"
     }
   ],
   "submodules": [