c# - Should i StrongName / Strong-Sign an OSS dll? -
i have number of open source projects have nuget packages available.
recently, asked strong-sign 1 of these oss nuget packages (well, dll in package, more concise).
so - questions:
- if strong-sign it, can other dll's not strong signed, use it?
- do/should commit
.snk
file public repository? if yes, wouldn't defeat purpose of having 'secretly' signed?
cheers!
it's interesting set of questions.
if strong-sign it, can other dll's not strong signed, use it?
i believe answer yes. strong signing means create "chain of trust". can use signed dll's without signing consuming dll.
do/should commit
.snk
file public repository? if yes, wouldn't defeat purpose of having 'secretly' signed?
yes. if publish .snk file defeat purpose of strong signing (for part) because can sign dll. people want consume publicly available source project should take responsibility signing own uses. if have customer wants or distribute project in binary form can sign keep private key (snk) private.
Comments
Post a Comment