dotnet / sign

Code Signing CLI tool supporting Authenticode, NuGet, VSIX, and ClickOnce
MIT License
477 stars 90 forks source link

Sign CLI doesn't support ClickOnce RFC 3161 timestamping #630

Closed dtivel closed 1 year ago

dtivel commented 1 year ago

This project uses a copy of mansign2.cs from .NET Reference Source. However, the latest version is in the dotnet/msbuild repository.

Crucially, the .NET Reference Source version performs only legacy Authenticode timestamping, while the dotnet/msbuild version first attempts RFC 3161 timestamping before falling back to legacy Authenticode timestamping.

This change never made it back into .NET Reference Source.

CC @clairernovotny