You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Just a heads up, the private key for the strong name signing is now added to the repository (a6765bb, 1963983
), as per MSDN's recommendation for open source projects. Strong name signing is not a tool for security or authenticity.
NOTE: I was not able to convert the .pfx certificate to a .snk file, which is required for the VS2017 build tools (PR #261), so I went ahead and created a brand new key. This may cause problems if you have other signed nugets that depend on Units.NET. If anyone knows how to do this conversion, let me know and I can revert to using that key instead.
Anyone can build their own modified version of Units.NET without having to recompile any dependencies on Units.NET
The downside:
Anyone can build a malicious version of the library and attempt to publish it through nuget.org or other channels. This risk, however, is no greater than that of unsigned libraries and I refer to point above and the MSDN recommendation.
If anyone has strong opinions on this I'm open to debate it, but note I am kind of already decided on this and the key is already published now, so it would have to be persuasive arguments to revert things.
The text was updated successfully, but these errors were encountered:
Just a heads up, the private key for the strong name signing is now added to the repository (
a6765bb, 1963983), as per MSDN's recommendation for open source projects. Strong name signing is not a tool for security or authenticity.
NOTE: I was not able to convert the.pfx
certificate to a.snk
file, which is required for the VS2017 build tools (PR #261), so I went ahead and created a brand new key. This may cause problems if you have other signed nugets that depend on Units.NET. If anyone knows how to do this conversion, let me know and I can revert to using that key instead.I found a way here: https://stackoverflow.com/a/11461474/134761
New commit: 1963983
The upside:
The downside:
https://github.com/dotnet/corefx/blob/master/Documentation/project-docs/strong-name-signing.md
If anyone has strong opinions on this I'm open to debate it, but note I am kind of already decided on this and the key is already published now, so it would have to be persuasive arguments to revert things.
The text was updated successfully, but these errors were encountered: