fluentassertions / fluentassertions/fluentassertions

FluentAssertions package is not Authenticode signed

Open
#993 8 comments 0 reactions 0 assignees View on GitHub
requires-investigation
Dominant language
C#
Stars
3.8k
Forks
720
Avg merge
1d 1h
Merged PRs (30d)
29

Description

### Description

FluentAssertions package is not Authenticode signed

### Complete minimal example reproducing the issue

Our compliance requirement to use this package to prevent supply-chain attacks is that it is Strong Name and Authenticode signed. StrongName proves it was not tampered, and Authenticode proves who produced the binary.

### Actual behavior:
FluentAssertions binaries are StrongName signed but not authenticode signed.

```
sn.exe -vf "...\fluentassertions.5.6.0.nupkg\lib\net45\FluentAssertions.dll"
Microsoft (R) .NET Framework Strong Name Utility Version 4.0.30319.0
Copyright (c) Microsoft Corporation. All rights reserved.

Assembly '...\fluentassertions.5.6.0.nupkg\lib\net45\FluentAssertions.dll' is valid
```

However it is not authenticode signed.
`chktrust -v `
pops a dialog saying the publisher cannot be verified. Can also right click the binary and check signature to see there is none.

### Versions

* Which version of Fluent Assertions are you using?
5.6.0
* Which .NET runtime and version are you targeting? E.g. .NET framework 4.6.1 or .NET Core 2.0.
All

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.