Is it recommended to use the Serilog.snk key for contrib packages?

[0xced]

Checking a few packages, we can find all possible outcomes:

• Packages which are not strong named
• Packages using the Serilog.snk key (24c2f752a8e58a10)
• Package(s) using another key

SerilogContribStrongNames.csproj

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net7.0</TargetFramework>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Serilog.Enrichers.Sensitive" Version="1.7.2" />
    <PackageReference Include="Serilog.Formatting.Log4Net" Version="1.0.2" />
    <PackageReference Include="Serilog.Logfmt" Version="1.0.3" />
    <PackageReference Include="Serilog.Sinks.AmazonS3" Version="1.3.0" />
    <PackageReference Include="Serilog.Sinks.ApplicationInsights" Version="4.0.0" />
    <PackageReference Include="Serilog.Sinks.Elasticsearch" Version="9.0.0" />
    <PackageReference Include="Serilog.Sinks.Graylog" Version="2.3.0" />
    <PackageReference Include="Serilog.Sinks.Notepad" Version="3.0.0" />
  </ItemGroup>

</Project>

Program.cs

using System;
using System.Collections.Generic;
using System.Reflection;

new List<Assembly>
{
    typeof(Serilog.LoggerConfiguration).Assembly,
    typeof(Serilog.Enrichers.Sensitive.ExtensionMethods).Assembly,
    typeof(Serilog.Formatting.Log4Net.Log4NetTextFormatter).Assembly,
    typeof(Serilog.Logfmt.LogfmtFormatter).Assembly,
    typeof(Serilog.LoggerConfigurationAmazonS3Extensions).Assembly,
    typeof(Serilog.LoggerConfigurationApplicationInsightsExtensions).Assembly,
    typeof(Serilog.LoggerConfigurationElasticsearchExtensions).Assembly,
    typeof(Serilog.NotepadLoggerConfigurationExtensions).Assembly,
    typeof(Serilog.Sinks.Graylog.GraylogSink).Assembly,
}.ForEach(e => Console.WriteLine(e.GetName()));

And here is the result:

Serilog, Version=2.0.0.0, Culture=neutral, PublicKeyToken=24c2f752a8e58a10
Serilog.Enrichers.Sensitive, Version=1.7.2.0, Culture=neutral, PublicKeyToken=null
Serilog.Formatting.Log4Net, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
Serilog.Logfmt, Version=1.0.3.0, Culture=neutral, PublicKeyToken=null
Serilog.Sinks.AmazonS3, Version=1.3.0.0, Culture=neutral, PublicKeyToken=null
Serilog.Sinks.ApplicationInsights, Version=4.0.0.0, Culture=neutral, PublicKeyToken=24c2f752a8e58a10
Serilog.Sinks.Elasticsearch, Version=9.0.0.0, Culture=neutral, PublicKeyToken=24c2f752a8e58a10
Serilog.Sinks.Notepad, Version=3.0.0.0, Culture=neutral, PublicKeyToken=24c2f752a8e58a10
Serilog.Sinks.Graylog, Version=2.3.0.0, Culture=neutral, PublicKeyToken=1011d850eeda7898

I'm considering adding a strong name key to Serilog.Formatting.Log4Net.

Does it matter which strong name key contrib packages are using?

[0xced]

Well, after reading a bit about strong naming I think it's not worth the hassle of adding strong naming to Serilog.Formatting.Log4Net since it's completely ignored on .NET Core and .NET 5+. So it would only matter for .NET Framework which is slowly becoming obsolete.

• https://github.com/dotnet/docs/issues/22412

  I'll close the issue as evidently the docs are correct, as much as this behavior amazes me.

• https://github.com/meziantou/Meziantou.Framework/issues/487

  For .NET Core and .NET 5+, strong-named assemblies do not provide material benefits. The runtime never validates the strong-name signature, nor does it use the strong-name for assembly binding.

• https://twitter.com/terrajobst/status/1575597806144094208

  I'm debating whether it's worth the hassle trying to remove strong naming from .NET 8

• https://learn.microsoft.com/en-us/dotnet/standard/library-guidance/strong-naming#create-strong-named-net-libraries

  ❌ DO NOT add, remove, or change the strong naming key

The question about reusing the Serilog.snk key (vs using another one) still remains for someone who would publish a new Serilog contrib package targeting .NET Framework (or .NET Standard).