fluentassertions / fluentassertions/fluentassertions

FluentAssertions package is not Authenticode signed

未关闭
#993 8 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
requires-investigation
主要语言
C#
星标
3.8k
派生
720
平均合并
1 天 1 小时
30 天内合并 PR
29

描述

### Description

FluentAssertions package is not Authenticode signed

### Complete minimal example reproducing the issue

Our compliance requirement to use this package to prevent supply-chain attacks is that it is Strong Name and Authenticode signed. StrongName proves it was not tampered, and Authenticode proves who produced the binary.

### Actual behavior:
FluentAssertions binaries are StrongName signed but not authenticode signed.

```
sn.exe -vf "...\fluentassertions.5.6.0.nupkg\lib\net45\FluentAssertions.dll"
Microsoft (R) .NET Framework Strong Name Utility Version 4.0.30319.0
Copyright (c) Microsoft Corporation. All rights reserved.

Assembly '...\fluentassertions.5.6.0.nupkg\lib\net45\FluentAssertions.dll' is valid
```

However it is not authenticode signed.
`chktrust -v `
pops a dialog saying the publisher cannot be verified. Can also right click the binary and check signature to see there is none.

### Versions

* Which version of Fluent Assertions are you using?
5.6.0
* Which .NET runtime and version are you targeting? E.g. .NET framework 4.6.1 or .NET Core 2.0.
All

贡献指南

打开贡献指南

调研方向

该 issue 指出了 NuGet 包 FluentAssertions 5.6.0 及其 FluentAssertions.dll 二进制文件,但没有提及任何仓库文件、测试或签名入口。首先跟踪包的构建和发布方式,然后验证生成的二进制文件带有 Authenticode 签名,同时保留 strong-name signing。

由索引模型根据 Issue 内容生成。

评估

技术栈
csharp
领域
release, security
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
需要澄清
新手友好度
25/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。