Published NuGets are not strongly-named assemblies
- Dominant language
- C#
- Stars
- 2.4k
- Forks
- 184
- PR merge metrics
- No merged PRs in 30d
Description
The current NuGet package for v1.0.5* is not built as a strongly-named assembly. This is prevents using it in an assembly that is required to be strongly-named/signed. This impacts me since my current project is used in the GAC.
After reading around, it looks like the optimal solution may be for whoever is uploading the binary of this package to strongly sign it locally before uploading it:
http://disq.us/p/oog81l
Microsoft themselves currently recommend:
> [If you are an open-source developer and you want the identity benefits of a strong-named assembly, consider checking in the private key associated with an assembly into your source control system.](https://docs.microsoft.com/en-us/dotnet/framework/app-domains/strong-named-assemblies)
Either of these should work since strongly-naming assemblies is about identity, *not* security. There are some workaround hacks I could do such as assembling from source or disassembling/reassembling to add my own signature locally. But it'd be much more convenient for other users to just fix the Nugets.
* I'm targeting this version because my project is currently stuck in .NET 4.5.1 while further versions of SmartEnum are requiring .NET 4.6.1+
Contributor guide
Assessment
This issue has not been assessed yet.