ardalis / ardalis/SmartEnum

Published NuGets are not strongly-named assemblies

Open
#52 8 comments 3 reactions 1 assignee Claimed by @ardalis View on GitHub
Dominant language
C#
Stars
2.4k
Forks
184
PR merge metrics
No merged PRs in 30d

Description

The current NuGet package for v1.0.5* is not built as a strongly-named assembly. This is prevents using it in an assembly that is required to be strongly-named/signed. This impacts me since my current project is used in the GAC.

After reading around, it looks like the optimal solution may be for whoever is uploading the binary of this package to strongly sign it locally before uploading it:
http://disq.us/p/oog81l

Microsoft themselves currently recommend:
> [If you are an open-source developer and you want the identity benefits of a strong-named assembly, consider checking in the private key associated with an assembly into your source control system.](https://docs.microsoft.com/en-us/dotnet/framework/app-domains/strong-named-assemblies)

Either of these should work since strongly-naming assemblies is about identity, *not* security. There are some workaround hacks I could do such as assembling from source or disassembling/reassembling to add my own signature locally. But it'd be much more convenient for other users to just fix the Nugets.

* I'm targeting this version because my project is currently stuck in .NET 4.5.1 while further versions of SmartEnum are requiring .NET 4.6.1+

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.