Building Deterministic
Skater .NET Release Pipelines

1 Why Determinism Matters in Protected Releases

Most teams discover the cost of non-deterministic obfuscation only after a production incident. A crash dump arrives with fully scrambled method names; the developer who last ran the GUI is offline; the rename map that would have decoded the stack has already been overwritten by a later local build. The release is effectively unsupportable.

Determinism closes that loop. When the same source commit, the same MSBuild flags, and the same Skater XML profile always produce the identical protected binary and the identical rename map, every release becomes an accountable artifact. Support teams can retrieve the exact map months later; auditors can prove bit-for-bit provenance; hot-fixes can be re-built without introducing new symbol mappings.

2 Concrete Pipeline Recipe

The following patterns are battle-tested on Azure DevOps, GitHub Actions, and Jenkins agents running Windows. They assume Skater is already installed on the build agent (or restored from a tools cache) and that a strong-name key is injected as a secure file or secret.

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFramework>net8.0</TargetFramework>
    <Deterministic>true</Deterministic>
    <ContinuousIntegrationBuild Condition="'$(TF_BUILD)' == 'true'">true</ContinuousIntegrationBuild>
  </PropertyGroup>

  <!-- Post-build Skater protection for Release only -->
  <Target Name="SkaterProtect" AfterTargets="Build" Condition="'$(Configuration)' == 'Release'">
    <Exec Command=""$(SkaterPath)\Skater.exe" -XMLFILE:"$(ProjectDir)skater-profile.xml" -SOURCE:"$(TargetPath)" -OUTPUT:"$(TargetDir)Protected" -KEY:"$(StrongNameKeyPath)" -WRITELOG:"$(TargetDir)Protected\skater.log"" />
  </Target>
</Project>

# azure-pipelines.yml - deterministic Skater release
trigger:
  branches:
    include: [ main, release/* ]

pool:
  vmImage: 'windows-latest'

steps:
- task: DotNetCoreCLI@2
  displayName: 'Deterministic Release Build'
  inputs:
    command: 'build'
    projects: '**/*.csproj'
    arguments: '-c Release -p:Deterministic=true'

- task: DownloadSecureFile@1
  name: snk
  inputs:
    secureFile: 'release.snk'

- script: |
    "%ProgramFiles(x86)%\RustemSoft\Skater\Skater.exe" ^
      -XMLFILE:"$(Build.SourcesDirectory)\skater-profile.xml" ^
      -SOURCE:"$(Build.SourcesDirectory)\bin\Release\net8.0\MyApp.dll" ^
      -OUTPUT:"$(Build.ArtifactStagingDirectory)\Protected" ^
      -KEY:"$(snk.secureFilePath)" ^
      -WRITELOG:"$(Build.ArtifactStagingDirectory)\Protected\skater.log"
  displayName: 'Skater protect + re-sign'

- task: PublishBuildArtifacts@1
  inputs:
    PathtoPublish: '$(Build.ArtifactStagingDirectory)/Protected'
    ArtifactName: 'skater-protected-$(Build.BuildNumber)'

# Invoke-SkaterRelease.ps1
param(
    [string]$Assembly   = ".\bin\Release\net8.0\MyApp.dll",
    [string]$Profile    = ".\skater-profile.xml",
    [string]$OutDir     = ".\bin\Release\Protected",
    [string]$KeyPath    = $env:SKATER_SNK_PATH
)

New-Item -ItemType Directory -Force -Path $OutDir | Out-Null

$skater = "${env:ProgramFiles(x86)}\RustemSoft\Skater\Skater.exe"
& $skater -XMLFILE:$Profile -SOURCE:$Assembly -OUTPUT:$OutDir -KEY:$KeyPath -WRITELOG:(Join-Path $OutDir "skater.log")

if ($LASTEXITCODE -ne 0) { throw "Skater failed with exit code $LASTEXITCODE" }

$hash = (Get-FileHash (Join-Path $OutDir (Split-Path $Assembly -Leaf)) -Algorithm SHA256).Hash
Write-Host "Protected SHA-256: $hash" -ForegroundColor Green

3 Profile Discipline: Treat the XML as Infrastructure

Skater’s preferred automation model is “configure once in the GUI, then replay via XML.” That XML file becomes the single source of truth for every protection decision: which members are renamed, which naming method is used, whether strings are concealed, whether control-flow is applied, and so on.

4 Strong-Name Key Handling in CI

Obfuscation rewrites metadata; any prior strong-name signature is destroyed. Skater must therefore re-sign the assembly. The only safe place for the private key material is a secret store that injects the file at job start and guarantees its deletion at job end.

• Store the .snk / .pfx as a secure file or encrypted secret.
• Map it to a temporary path that is never checked into source control.
• Pass that path via the -KEY argument (or the corresponding XML setting).
• Verify the signature after protection with sn -v.
• Wipe the temporary key file in a finally / always block.

5 Rename-Map Archival Is Non-Optional

Skater emits an XML rename map that records every original name and its obfuscated counterpart. Without that exact map, a production stack trace is opaque noise. Treat the map with the same retention policy as the binary itself:

6 Verification Loop Before Promotion

Never promote a protected package until the following three checks pass on the CI agent:

7 Common Failure Modes and Fixes

8 Release Checklist

9 Frequently Asked Questions