Repository navigation
🔏 Why this release
NuGet package signing only protects the download. NuGet checks the package signature when it restores a package, then unzips the files. Windows never sees that signature. Windows features such as Smart App Control, and Visual Studio, look at the signature on each DLL. SafeSign only signed the .nupkg, so users saw a signed package with unsigned DLLs inside, and the DLLs could be blocked.
From 1.1.0, signing a .nupkg also Authenticode signs the unsigned .dll and .exe files inside it first. The package signature then covers the signed files. This matches how the .NET Foundation sign tool handles packages. Files that already carry a signature, such as third-party binaries, are left untouched. Use --skip-package-contents to sign only the package.
🗞️ What's Changed
🚀 Features
- 2822858 feat(nuget): sign DLLs and EXEs inside packages (#7) @glennawatson
📦 Dependencies
- Refit, Refit.HttpClientFactory and Refit.Testing updated to 16.4.0, and TUnit to 1.76.0 (included in #7)
📥 Artifacts
Signed NuGet packages (also published to nuget.org):
- SafeSign.1.1.0.nupkg
- SafeSign.Formats.1.1.0.nupkg
- SafeSign.Providers.1.1.0.nupkg
- SafeSign.Signing.1.1.0.nupkg
Signed Windows Native AOT apps:
- safesign-1.1.0-win-x64.zip
- safesign-1.1.0-win-arm64.zip
Linux and macOS Native AOT apps:
- safesign-1.1.0-linux-x64.tar.gz
- safesign-1.1.0-linux-arm64.tar.gz
- safesign-1.1.0-osx-x64.tar.gz
- safesign-1.1.0-osx-arm64.tar.gz
🔗 Full Changelog: v1.0.0...v1.1.0
🙌 Contributions
💖 Thanks to all the contributors: @glennawatson
