Installation of the Azure Trusted Signing Tools is freezing the runner

[grzegorzkrukowski]

Description

The installation of the Azure Trusted Signing Client Tools is causing all our Windows Runners to freeze.
Both manual installation and winget installation:

- name: Install Microsoft Trusted Signing Client Tools
      shell: pwsh
      run: |
        Write-Host "Installing Microsoft Trusted Signing Client Tools..."
        $ProgressPreference = 'SilentlyContinue'
        Invoke-WebRequest -Uri "https://download.microsoft.com/download/6d9cb638-4d5f-438d-9f21-23f0f4405944/TrustedSigningClientTools.msi" -OutFile .\TrustedSigningClientTools.msi
        Start-Process msiexec.exe -Wait -ArgumentList '/I TrustedSigningClientTools.msi /quiet'
        Remove-Item .\TrustedSigningClientTools.msi
        Write-Host "Microsoft Trusted Signing Client Tools installed successfully"

- name: Install Microsoft Trusted Signing Client Tools
      if: inputs.mode == 'Release'
      shell: pwsh
      run: |
        Write-Host "Installing Microsoft Trusted Signing Client Tools..."
        winget install -e --id Microsoft.Azure.TrustedSigningClientTools --accept-source-agreements --accept-package-agreements --disable-interactivity

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 22.04
• Ubuntu 24.04
• Ubuntu Slim
• macOS 14
• macOS 14 Arm64
• macOS 15
• macOS 15 Arm64
• macOS 26 Arm64
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025

Image version and build link

Version: 20260105.167.1

Is it regression?

https://github.com/actions/runner-images/releases/tag/win22%2F20260105.167

Expected behavior

I would expect the installation of Azure Trusted Tools to work normally or throw an error

Actual behavior

Runner is freezing and reaching the defined workflow timeout.

Repro steps

Use one of the methods above and see the runer reaching the timeout

[erik-bershel]

Hey @grzegorzkrukowski! 👋

I don't think the problem is related to the image's contents - it's more likely that the installation process is displaying some kind of interactive window despite the specified options. But let's check just in case.

[grzegorzkrukowski]

Hey @grzegorzkrukowski! 👋

I don't think the problem is related to the image's contents - it's more likely that the installation process is displaying some kind of interactive window despite the specified options. But let's check just in case.

Thanks. We didn't change anything on our side and it was working yesterday on the older runner - so maybe some interactive window is showing due to runner changes that was not there before?

Weirdly enough - winget also stucks in forever running installation loop.

[haseebq]

+1 on this. Things were working before on our repo too but are now hung while downloading trusted installer. Also - we use AdvancedInstaller which tries to download the tools by itself too, and that is getting stuck as well.

[haseebq]

This might not be an issue with the runner - could be the Azure Trusted Signing Tools msi itself.

Last run that succeeded has identical runner to failing runs:

Runner Image Provisioner
  Hosted Compute Agent
  Version: 20251211.462
  Commit: 6cbad8c2bb55d58165063d031ccabf57e2d2db61
  Build Date: 2025-12-11T16:28:49Z
  Worker ID: unknown
Operating System
  Microsoft Windows Server 2022
  10.0.20348
  Datacenter
Runner Image
  Image: windows-2022
  Version: 20260112.2.1
  Included Software: https://github.com/actions/runner-images/blob/win22/20260112.2/images/windows/Windows2022-Readme.md
  Image Release: https://github.com/actions/runner-images/releases/tag/win22%2F20260112.2

Failing runs:

1.
Runner Image Provisioner
  Hosted Compute Agent
  Version: 20251211.462
  Commit: 6cbad8c2bb55d58165063d031ccabf57e2d2db61
  Build Date: 2025-12-11T16:28:49Z
  Worker ID: unknown
Operating System
  Microsoft Windows Server 2022
  10.0.20348
  Datacenter
Runner Image
  Image: windows-2022
  Version: 20260112.2.1
  Included Software: https://github.com/actions/runner-images/blob/win22/20260112.2/images/windows/Windows2022-Readme.md
  Image Release: https://github.com/actions/runner-images/releases/tag/win22%2F20260112.2

2.
Runner Image Provisioner
  Hosted Compute Agent
  Version: 20251211.462
  Commit: 6cbad8c2bb55d58165063d031ccabf57e2d2db61
  Build Date: 2025-12-11T16:28:49Z
  Worker ID: unknown
Operating System
  Microsoft Windows Server 2022
  10.0.20348
  Datacenter
Runner Image
  Image: windows-2022
  Version: 20260112.2.1
  Included Software: https://github.com/actions/runner-images/blob/win22/20260112.2/images/windows/Windows2022-Readme.md
  Image Release: https://github.com/actions/runner-images/releases/tag/win22%2F20260112.2

[haseebq]

The trusted installer msi was published back in Nov 2024. So I'm not sure what has changed. This worked as early as Jan 13th (a day ago).

[haseebq]

Looks like it's stopoped at dotnet install:

[JapNolt]

I'm having the same issue as @grzegorzkrukowski but on Azure Devops hosted runners. Happening with both manual installation and winget installation.

[haseebq]

I got past it by installing .NET 8 before installing Trusted Signing Tools:

      - name: Install .NET Runtime (Windows)
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.x'

[JapNolt]

Installing .Net 8 doesn't seem to help for me. I'm still having the same issue.

here's my runner info: