FusionCache icon indicating copy to clipboard operation
FusionCache copied to clipboard

Published 20 hours ago • verified publisher icon ZiggyCreatures

Strong named assembly

Open apierini opened this issue 7 months ago • 4 comments

Hi to all,

it seems that assembly ZiggyCreatures.FusionCache is not strong signed. Is it possibile to strong sign it?

Thanks Andrea

apierini avatar Mar 21 '25 10:03 apierini

Tagging @jodydonetti for visibility. We also need this for our project. Here is a reference doc from microsoft on how to sign an assembly. Ideally, this should be applied to all nuget pacakges.

Could you take a look at this please ?

Regards,

Guillaume

guillaumeserale avatar Apr 02 '25 12:04 guillaumeserale

Hi @apierini (sorry for the delay, I was away for more than a week!) and @guillaumeserale , I'm thinking about thisfor some time now.

Can you please share what are your needs for this?

As pointed out in your link:

Although .NET Core supports strong-named assemblies, and all assemblies in the .NET Core library are signed, the majority of third-party assemblies do not need strong names

Also, following a link there, we can see that:

For the most part, the majority of applications do not need strong-names. Strong-names are left over from previous eras

Having said this, I was recently reading "The case for strong naming .NET assemblies" (here) where the author highlight some good points about strong naming.

But, also, as said in all the linked pages above and in particular here, there are some issues with doing it: particulary I'm looking at "Virality" which would limit which packages I can then reference, which is honestly worrying me.

Care to share any thoughts on this, experiences and your needs?

Thanks!

jodydonetti avatar Apr 02 '25 16:04 jodydonetti

Hi @jodydonetti,

our application is a desktop application and strong naming is used to prevent tampering for security reason. If you want to be compatible with applications like our you need to strong sign your assemblies. I don't see any downsides as strong signing is just a matter of putting a flag in Visual Studio and, as far as I know, every library vendor is doing it to keep broadest possible compatibility.

By the way, I tried to strong sign FusionCache from source and it works fine.

Andrea

apierini avatar Apr 04 '25 09:04 apierini

Hi @apierini thanks for sharing, let me think more about this and will update you.

jodydonetti avatar Apr 04 '25 11:04 jodydonetti