ci: provision SDK code-signing roots in the disposable Wine prefix

.gitea/workflows/pr-push-build-and-test.yaml

@@ -73,6 +73,21 @@ jobs:
           echo "WIN_DOTNET_DIR=${WIN_DOTNET_DIR}" >> "${GITHUB_ENV}"
           "${WINE_BIN}" "${WIN_DOTNET_DIR}/dotnet.exe" --info
 
+      - name: Provision NuGet signature trust inside Wine
+        run: |
+          SDK_VERSION="$(dotnet --version)"
+          SDK_TRUST_ROOT="${DOTNET_ROOT}/sdk/${SDK_VERSION}/trustedroots"
+          dotnet publish scripts/wine-sdk-trust.cs \
+            -c Release \
+            -p:UseAppHost=false \
+            -p:PublishAot=false \
+            -o "${RUNNER_TEMP}/wine-sdk-trust" \
+            --nologo
+          "${WINE_BIN}" "${WIN_DOTNET_DIR}/dotnet.exe" \
+            "Z:${RUNNER_TEMP}/wine-sdk-trust/WineSdkTrust.dll" --import \
+            "Z:${SDK_TRUST_ROOT}/codesignctl.pem" \
+            "Z:${SDK_TRUST_ROOT}/timestampctl.pem"
+
       - name: Diagnose Windows SDK targeting-pack resolution
         run: |
           find "${WIN_DOTNET_DIR}/packs" -maxdepth 4 -name PackageOverrides.txt -print