Nuget Package Not Signed

[de10101]

Nuget.org supports signing of packages to confirm the authorship.

https://docs.microsoft.com/en-us/nuget/reference/signed-packages-reference

The current release on nuget.org (3.12.0) is not signed with the Repository signature. This would be nice as an additional proof of source.

[jnm2]

We would need a code-signing (Authenticode) certificate to do this. If we sign the NuGet package, we should sign our binaries too. The certificate must be stored securely, accessible to a trusted server which does the signing and which cannot be tricked into signing builds of code that we have not reviewed. If anyone can effectively sign using the certificate, it's worse than having no signature because we are vouching for the signed binary with our name.

I set up our CI at my day job to sign my company's binaries, NuGet packages, and WiX installers, but I'm not familiar with the subtleties of managing a code-signing certificate in open-source projects. This is something that the .NET Foundation helps its member projects with. @rprouse, should we get in contact with someone there?

[rprouse]

This dovetails nicely with the plan to only release packages that are built from our CI/CD pipeline rather than me building and testing locally on my machine. Ideally, the Azure DevOps builds will sign any builds of the release branch and we can release directly from there with a release pipeline.

I've reached out to the .NET Foundation for information on getting a signing certificate and guidance on maintaining it.

[rprouse]

Oren Novotny is still handling signing certificates for the .NET Foundation. I'll reach out to him.

For reference, the Cake team uses Oren's signtool in their cake scripts, https://github.com/cake-build/cake/blob/9edba942fa2e9c0db16f3035ffb96db19e03561b/build.cake#L378-L430

[rprouse]

Oren's signing tool uses the .NET Foundation's signing service, so we just need to get setup on that, https://github.com/dotnet/SignService

[ChrisMaddock]

I'd be keen to sort this for the NUnit Console packages too - thanks for raising this @de10101!

[olegd-superoffice]

It looks like NUnit NuGet package is only signed by repository, but not by the author's code signing certificate. Would it be possible to implement the signing using .Net foundation certificate?
Here's output of dotnet nuget verify nunit.3.13.3.nupkg:

Verifying NUnit.3.13.3
Signature type: Repository
Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US
SHA256 hash: 5A2901D6ADA3D18260B9C6DFE2133C95D74B9EEF6AE0E5DC334C8454D1477DF4
Valid from: 16/02/2021 01:00:00 to 16/05/2024 01:59:59

and from dotnet nuget verify xunit.2.4.2.nupkg:

Verifying xunit.2.4.2
Signature type: Author
Subject Name: CN=xUnit.net (.NET Foundation), O=xUnit.net (.NET Foundation), L=Redmond, S=WA, C=US, SERIALNUMBER=603 389 068
SHA256 hash: 62EAAD4AAA8AF9ED0E08C03F78BECE95EC4A85AE87749E4D977D9D1E8A14BBB0
Valid from: 05/03/2021 01:00:00 to 02/06/2024 01:59:59
Signature type: Repository
Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US
SHA256 hash: 5A2901D6ADA3D18260B9C6DFE2133C95D74B9EEF6AE0E5DC334C8454D1477DF4
Valid from: 16/02/2021 01:00:00 to 16/05/2024 01:59:59

[SimonCropp]

@olegd-superoffice given nunit is never deployed to production, and only running on developers machines, what is the use case for code signing?

[olegd-superoffice]

@SimonCropp it is also running on build servers and I saw people using it to run smoke tests in production environments.
IIRC build servers attack vector was used in SolarWinds hack, for example. IMO security of developers machines is no less important than security of production servers.
I'm trying to configure NuGet client policy and NUnit is one of a few NuGet packages I need which is still not signed with author certificate.

[SimonCropp]

@olegd-superoffice so you only allow code signed packages to be used?

[olegd-superoffice]

@SimonCropp Yes, trying to implement trust policy as described here: https://devblogs.microsoft.com/nuget/lock-down-your-dependencies-using-configurable-trust-policies/

[SimonCropp]

@olegd-superoffice that must be challenging. the majority of packages I consume are not code signed

[olegd-superoffice]

@SimonCropp It is getting much better lately. All Google, Microsoft, Azure packages are signed, Json.Net and IdentityModel as well. And open source projects started catching up due to signing service provided by .Net foundation - XUnit, Portable.BouncyCastle, Humanizer, Coverlet etc.
But I strongly prefer NUnit over XUnit so I'd really like to see NUnit packages in this list!