Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Activate Strong-Name Signing #239

Open
wants to merge 2 commits into
base: dev
Choose a base branch
from
Open

Conversation

cptjazz
Copy link
Contributor

@cptjazz cptjazz commented Feb 22, 2020

This PR adds a signing key and activates strong-name signing over all projects.
Closes #225

(The diff is flawed due to whitespace changes. The real action happens at lines 40 – 43.)

@sean-gilliam
Copy link
Member

We should probably generate the key ourselves on the build server or ask the .NET Foundation to give us a key.
If it's like other crypto keys, then it seems wrong accepting an outside PR for a signing key. No offense.

Thoughts @akkadotnet/core @akkadotnet/contributors

@cptjazz
Copy link
Contributor Author

cptjazz commented Feb 24, 2020

None taken.
I'm not sure what your concern is. It should not make a difference where it was created, does it?
Or is it about having the key present in the repository here? The MS guidelines state:

CONSIDER adding the strong naming key to your source control system.
A publicly available key lets developers modify and recompile your library source code with the same key.

@Aaronontheweb
Copy link
Member

I think @sean-gilliam is thinking of Authenticode signing, which works similarly to SSL - key has to be kept private to prevent impersonation.

@Aaronontheweb
Copy link
Member

Strong naming doesn't work that way though, since it's not actually a security mechanism - just a fingerprinting mechanism for strongly identifying a specific name and version of an assembly

@sean-gilliam
Copy link
Member

Ah gotcha. Yea I was mixing it up. Sorry guys.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Strong-name Assemblies
3 participants