search

Tyrrrz / CliWrap

Library for running command-line processes
MIT License
4.39k stars 268 forks source link

Sign assembly #101

Closed LoremFooBar closed 3 years ago

LoremFooBar commented 3 years ago

Sign assembly so it can be referenced from strong-named assembly

Closes #86

Tyrrrz commented 3 years ago

Hi, thanks for the PR! Can you link me to some doc where I can read about signing. Will normal (not strong-named) assemblies still be able to reference the package?

LoremFooBar commented 3 years ago
  1. Documentation can be found here: https://docs.microsoft.com/en-us/dotnet/standard/assembly/strong-named. Note that despite what's written there about .NET Core, the limitation of not being able to reference non-signed assembly from a signed assembly still exists.
  2. Getting the assembly signed with Jetbrains Rider was as easy as checking a checkbox and naming the key file. I suppose the process is similar with VS.
  3. All assemblies should be able to reference the assembly after it has been signed - to my understanding this PR is not a breaking change. I tested an unsigned project referencing the signed package - build was successful without warnings.
Tyrrrz commented 3 years ago

@lazyboy1 awesome! So does the CD process need any changes? Or will dotnet pack and dotnet nuget push just work?

https://github.com/Tyrrrz/CliWrap/blob/ebe1d82b9c2611feec760566e0cc9f412eb67bef/.github/workflows/CD.yml#L21-L25

LoremFooBar commented 3 years ago

As change only affects the build process, pack command worked for me without any changes needed.

What I would test is updating a package from current version to strong-named version. You can do that after you publish a strong-named version. I am not familiar with NuGet.org, but maybe you can publish a private version for testing purposes. If not, you could probably try setting up a local feed.

BTW, I just found this guide specifically for library authors, which really clarifies what you should and shouldn't do.

Tyrrrz commented 3 years ago

@lazyboy1 yeah, I also found that article, but unfortunately it doesn't answer some of the questions I have. It seems you are right, I will have to use a private feed to test it.

Thank you for the pr!