1.1.0

🔏 Why this release

NuGet package signing only protects the download. NuGet checks the package signature when it restores a package, then unzips the files. Windows never sees that signature. Windows features such as Smart App Control, and Visual Studio, look at the signature on each DLL. SafeSign only signed the .nupkg, so users saw a signed package with unsigned DLLs inside, and the DLLs could be blocked.

From 1.1.0, signing a .nupkg also Authenticode signs the unsigned .dll and .exe files inside it first. The package signature then covers the signed files. This matches how the .NET Foundation sign tool handles packages. Files that already carry a signature, such as third-party binaries, are left untouched. Use --skip-package-contents to sign only the package.

🗞️ What's Changed

🚀 Features

• 2822858 feat(nuget): sign DLLs and EXEs inside packages (#7) @glennawatson

📦 Dependencies

• Refit, Refit.HttpClientFactory and Refit.Testing updated to 16.4.0, and TUnit to 1.76.0 (included in #7)

📥 Artifacts

Signed NuGet packages (also published to nuget.org):

• SafeSign.1.1.0.nupkg
• SafeSign.Formats.1.1.0.nupkg
• SafeSign.Providers.1.1.0.nupkg
• SafeSign.Signing.1.1.0.nupkg

Signed Windows Native AOT apps:

• safesign-1.1.0-win-x64.zip
• safesign-1.1.0-win-arm64.zip

Linux and macOS Native AOT apps:

• safesign-1.1.0-linux-x64.tar.gz
• safesign-1.1.0-linux-arm64.tar.gz
• safesign-1.1.0-osx-x64.tar.gz
• safesign-1.1.0-osx-arm64.tar.gz

🔗 Full Changelog: v1.0.0...v1.1.0

🙌 Contributions

💖 Thanks to all the contributors: @glennawatson

1.0.0

🗞️ What's Changed

💥 Breaking Changes

• d3b983a perf!: optimize format serialization @glennawatson

🐛 Fixes

• 0fcc361 fix: add zip64 signature to appx @glennawatson
• d08c7d2 fix(cli): catch IOException and FormatException in SignRunner @glennawatson
• 5f9bcfa fix(certum): disable HttpClient auto-redirect so CAS login preserves Set-Cookie headers @glennawatson
• 81e637f fix: invalid nuget package signing fix @glennawatson
• 586ed6f fix(certum): fix CAS redirect cookies, TOTP timing, intermediate CA chain, and macOS PKCS#12 flags @glennawatson

🧹 General Changes

• bb6d241 ci(sonar): disable csharpsquid:S5542 via sonarExtraBeginArgs @glennawatson
• 96d9f42 build: fix NU5104 on pack, use IsTargetFrameworkCompatible, and clean up build props @glennawatson
• cbdb454 chore: use LF line endings @glennawatson
• 7841b13 chore(deps): add Renovate configuration @glennawatson
• 147c331 ci: use standard actions-common workflows and actions @glennawatson

📝 Documentation

• c41408a docs: update security policy for SafeSign @glennawatson

📦 Dependencies

• 46e405b chore(deps): pin glennawatson/actions-common action to 7f20142 (#1) renovate[bot]
• ade9a82 chore(deps): bump github actions (#3) renovate[bot]

📌 Other

• fc38c9a Fetch Certum intermediate CA via X.509 AIA and reach 100% provider test coverage @glennawatson
• 5b7cceb Initial commit: SafeSign cross-platform code signing CLI and libraries @glennawatson

🔗 Full Changelog: https://github.com/glennawatson/SafeSign/commits/1.0.0

🙌 Contributions

💖 Thanks to all the contributors: @glennawatson

🤖 Automated services that contributed: renovate[bot]