Besides signing the NuGet package, also sign the UnitsNet.dll? · Issue #1748 · angularsen/UnitsNet · GitHub
Skip to content

Besides signing the NuGet package, also sign the UnitsNet.dll? #1748

Open

Description

@dschuermans

Is your feature request related to a problem? Please describe.
Whilst the NuGet package itself is signed, the containing UnitsNet.dll is not

Windows Smart App Control relies on cloud based reputation and as long as the file-hash for the assembly doesn't change, the reputation stays.

As soon as the file hash changes, the reputation gets reset.

This could result in applications that rely on UnitsNet to no longer work when they'd upgrade, due to the new assembly not having enough reputation

Describe the solution you'd like
Also sign the actual UnitsNet.dll, since a signed DLL with a valid code signing certificate is automatically accepted by SAC

Describe alternatives you've considered
Signing the assembly ourself with our own certificate seems to be the widely accepted solution, but I'm not a fan of putting my stamp of approval on any third party assembly I don't control.
It would mean thoroughly vetting the source code of the specific version we're using and repeating that process whenever we upgrade

Additional context
Not running into an issue with UnitsNet at this moment, just tracking down all NuGet packages we use and see if they're able to sign their assemblies as well

EDIT
Because UnitsNet is strongly named, would that mean it's always the same hash as well? 🤔
That could explain why nobody is complaining 😅

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions