FluentAssertions package is not Authenticode signed

[bichuga]

Description

FluentAssertions package is not Authenticode signed

Complete minimal example reproducing the issue

Our compliance requirement to use this package to prevent supply-chain attacks is that it is Strong Name and Authenticode signed. StrongName proves it was not tampered, and Authenticode proves who produced the binary.

Actual behavior:

FluentAssertions binaries are StrongName signed but not authenticode signed.

sn.exe -vf "...\fluentassertions.5.6.0.nupkg\lib\net45\FluentAssertions.dll"
Microsoft (R) .NET Framework Strong Name Utility  Version 4.0.30319.0
Copyright (c) Microsoft Corporation.  All rights reserved.

Assembly '...\fluentassertions.5.6.0.nupkg\lib\net45\FluentAssertions.dll' is valid

However it is not authenticode signed. chktrust -v <binary> pops a dialog saying the publisher cannot be verified. Can also right click the binary and check signature to see there is none.

Versions

• Which version of Fluent Assertions are you using? 5.6.0
• Which .NET runtime and version are you targeting? E.g. .NET framework 4.6.1 or .NET Core 2.0. All

[Evangelink]

@jnyrup I am not an expert in signing but according to this blog-post it seems quite easy to do. As far as I understand, you will need to update your build configuration to pass more arguments to the signing part:

signtool sign /v /ph /fd sha256 `
/f {certificate-path}.pfx `
/p {certificate-password} `
/t http://timestamp.verisign.com/scripts/timstamp.dll {dlls-to-sign}

[dennisdoomen]

I think the biggest problem is to get a certificate. The ones we use at work are pretty expensive.

[eNeRGy164]

Maybe you can sign code with the support of the dot net foundation? https://dotnetfoundation.org/about

[Evangelink]

You should be able to create a .pfx file out of the ssl or .crt certificate you use for the website.

[eNeRGy164]

Normally SSL certificates for websites don't have code signing switched on in their profile, and can't be used for that purpose.

[dennisdoomen]

Correct. And I don't own that certificate. CloudFare is the one doing the SSL encryption.

[dennisdoomen]

Where would we get such a certificate?

[eNeRGy164]

https://dotnetfoundation.org/projects/benefits :)