Open digocesar opened 2 years ago
I'm not sure if this comes even back to the original package... but anyway.
As an OSS maintainer and contributor to multiple C# projects, I want to point out the following:
The need for strongly-named assemblies is disputable, and they bring difficulties which I myself also do not like to handle (keep the sign key separate). There however is a need from other strong named assemblies which need to have this as a dependency, this is not possible if the dependency is not strongly named.
But other projects use them and I acknowledge the need from these others being dependent on my nugets, I handle this with my projects similar to what other projects do, we sign the library but keep the key simply in the repository. This reduces the chance that when I no longer can maintain the project, the whole eco-system might be struck like there was some time with log4net.
It is really only a small action, create a signing key and enable assembly signing. Example here: https://github.com/dapplo/Dapplo.Windows/blob/master/src/Directory.Build.props#L19
This repo is just a kind of mirror, and I have no affiliation with the Nuget package owner, I recommend that you follow up on this topic with the original author. https://forum.zer7.com/topic/10108/
All assemblies in my project are signed. But when I try to use Nuget's HidSharp component the application is giving the error below at runtime.
Is there a way to publish this library with strong-name or is there a reason not to?