Altinn / Altinn/app-lib-dotnet

Add signing for Nuget packages

Open
#521 1 comment 0 reactions 0 assignees View on GitHub
kind/feature-request org/digdir
Dominant language
C#
Stars
8
Forks
27
Avg merge
1h 21m
Merged PRs (30d)
7

Description

Currently, we're not signing [our nuget packages](https://www.nuget.org/profiles/altinn).

*Signed packages allows for content integrity verification checks which provides protection against content tampering. The package signature also serves as the single source of truth about the actual origin of the package and bolsters package authenticity for the consumer.*

https://docs.microsoft.com/nuget/create-packages/sign-a-package

Contributor guide

Open the contributing guide

Research direction

Start with the repository's NuGet package publishing setup and the linked NuGet package-signing documentation. Done means the packages published from the Altinn NuGet profile are signed and consumers can verify their integrity and origin.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
release, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.