Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Strong name signing key file now published #262

Closed
angularsen opened this issue Jun 4, 2017 · 0 comments
Closed

Strong name signing key file now published #262

angularsen opened this issue Jun 4, 2017 · 0 comments

Comments

@angularsen
Copy link
Owner

angularsen commented Jun 4, 2017

Just a heads up, the private key for the strong name signing is now added to the repository (a6765bb, 1963983
), as per MSDN's recommendation for open source projects. Strong name signing is not a tool for security or authenticity.

NOTE: I was not able to convert the .pfx certificate to a .snk file, which is required for the VS2017 build tools (PR #261), so I went ahead and created a brand new key. This may cause problems if you have other signed nugets that depend on Units.NET. If anyone knows how to do this conversion, let me know and I can revert to using that key instead.

I found a way here: https://stackoverflow.com/a/11461474/134761
New commit: 1963983

The upside:

  • Easier to set up the automated build system
  • Anyone can build their own modified version of Units.NET without having to recompile any dependencies on Units.NET

The downside:

  • Anyone can build a malicious version of the library and attempt to publish it through nuget.org or other channels. This risk, however, is no greater than that of unsigned libraries and I refer to point above and the MSDN recommendation.

https://github.com/dotnet/corefx/blob/master/Documentation/project-docs/strong-name-signing.md

If anyone has strong opinions on this I'm open to debate it, but note I am kind of already decided on this and the key is already published now, so it would have to be persuasive arguments to revert things.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant