fluentassertions / fluentassertions/fluentassertions
FluentAssertions package is not Authenticode signed
- Dominant language
- C#
- Stars
- 3.8k
- Forks
- 720
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 29
Description
### Description
FluentAssertions package is not Authenticode signed
### Complete minimal example reproducing the issue
Our compliance requirement to use this package to prevent supply-chain attacks is that it is Strong Name and Authenticode signed. StrongName proves it was not tampered, and Authenticode proves who produced the binary.
### Actual behavior:
FluentAssertions binaries are StrongName signed but not authenticode signed.
```
sn.exe -vf "...\fluentassertions.5.6.0.nupkg\lib\net45\FluentAssertions.dll"
Microsoft (R) .NET Framework Strong Name Utility Version 4.0.30319.0
Copyright (c) Microsoft Corporation. All rights reserved.
Assembly '...\fluentassertions.5.6.0.nupkg\lib\net45\FluentAssertions.dll' is valid
```
However it is not authenticode signed.
`chktrust -v `
pops a dialog saying the publisher cannot be verified. Can also right click the binary and check signature to see there is none.
### Versions
* Which version of Fluent Assertions are you using?
5.6.0
* Which .NET runtime and version are you targeting? E.g. .NET framework 4.6.1 or .NET Core 2.0.
All
Contributor guide
Assessment
This issue has not been assessed yet.