Signing: Check entire chain for weak signatures

NuGet / Home

Repo for NuGet Client issues

Other

1.49k stars 250 forks source link

Signing: Check entire chain for weak signatures #7018

Open loic-sharma opened 6 years ago

loic-sharma commented 6 years ago

Security experts at threat modeling recommended that we check all certificates in the chain for weak signatures (excluding the trusted root certificate).

Work item that tracks server-side validation: https://github.com/NuGet/Engineering/issues/1430

/cc @dtivel /cc @PatoBeltran

heng-liu commented 3 years ago

Need to write an azure function to check how many packages on nuget.org will pass the validation in building certificate chain without excluding the root. Then decide if it's feasible to implement it.