c# - Should i StrongName / Strong-Sign an OSS dll? -


i have number of open source projects have nuget packages available.

recently, asked strong-sign 1 of these oss nuget packages (well, dll in package, more concise).

so - questions:

  1. if strong-sign it, can other dll's not strong signed, use it?
  2. do/should commit .snk file public repository? if yes, wouldn't defeat purpose of having 'secretly' signed?

cheers!

it's interesting set of questions.

if strong-sign it, can other dll's not strong signed, use it?

i believe answer yes. strong signing means create "chain of trust". can use signed dll's without signing consuming dll.

do/should commit .snk file public repository? if yes, wouldn't defeat purpose of having 'secretly' signed?

yes. if publish .snk file defeat purpose of strong signing (for part) because can sign dll. people want consume publicly available source project should take responsibility signing own uses. if have customer wants or distribute project in binary form can sign keep private key (snk) private.


Comments

Popular posts from this blog

java.util.scanner - How to read and add only numbers to array from a text file -

rewrite - Trouble with Wordpress multiple custom querystrings -

php - Accessing static methods using newly created $obj or using class Name -