Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added strong-name signing. #45

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

Added strong-name signing. #45

wants to merge 1 commit into from

Conversation

WKleinschmit
Copy link

Signed assemblies can only load other signed assemblies. On the other hand, unsigned assemblies can load either.
Since EasyHttp is intended to be used in other projects it should be signed in order to be universally usable.

@bazzilic
Copy link

Having the private key (.snk file) in a public repo defies the whole idea of signing the assembly.

@WKleinschmit
Copy link
Author

So does the fact that anyone can just create their own key at any time.

Don't confuse "Strong-Name" signing with "Authenticode" signing.
The former isn't a security measure but just a means to provide some more "uniqueness". Maybe it was intended otherwise by Microsoft originally but that never really work out.

It's only the latter that anyone (including Microsoft) will ever look at for security reasons.

And regarding that of course you're right. I'd never put an actual Authenticode key on a public repository.
But, since my original issue (#44) went unanswered, I had to do something. And you are still fee to move the key somewhere else.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants