fluentassertions / fluentassertions/fluentassertions
FluentAssertions package is not Authenticode signed
- 主要语言
- C#
- 星标
- 3.8k
- 派生
- 720
- 平均合并
- 1 天 1 小时
- 30 天内合并 PR
- 29
描述
### Description
FluentAssertions package is not Authenticode signed
### Complete minimal example reproducing the issue
Our compliance requirement to use this package to prevent supply-chain attacks is that it is Strong Name and Authenticode signed. StrongName proves it was not tampered, and Authenticode proves who produced the binary.
### Actual behavior:
FluentAssertions binaries are StrongName signed but not authenticode signed.
```
sn.exe -vf "...\fluentassertions.5.6.0.nupkg\lib\net45\FluentAssertions.dll"
Microsoft (R) .NET Framework Strong Name Utility Version 4.0.30319.0
Copyright (c) Microsoft Corporation. All rights reserved.
Assembly '...\fluentassertions.5.6.0.nupkg\lib\net45\FluentAssertions.dll' is valid
```
However it is not authenticode signed.
`chktrust -v `
pops a dialog saying the publisher cannot be verified. Can also right click the binary and check signature to see there is none.
### Versions
* Which version of Fluent Assertions are you using?
5.6.0
* Which .NET runtime and version are you targeting? E.g. .NET framework 4.6.1 or .NET Core 2.0.
All
贡献指南
调研方向
该 issue 指出了 NuGet 包 FluentAssertions 5.6.0 及其 FluentAssertions.dll 二进制文件,但没有提及任何仓库文件、测试或签名入口。首先跟踪包的构建和发布方式,然后验证生成的二进制文件带有 Authenticode 签名,同时保留 strong-name signing。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- csharp
- 领域
- release, security
- Issue 类型
- 缺陷
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 停滞
- 描述清晰度
- 需要澄清
- 新手友好度
- 25/100