picrap / signreferences

Because open source causes CS1577 to strong naming fans.

SignReferences

Because open source sometimes causes CS1577 to anger strong naming fans.

How to use

Install the NuGet package on the project(s) where you need all references to be signed.
It can be installed from Visual Studio NuGet packager or from NuGet console using Install-Package SignReferences.

How it works

At build time, it simply checks for references, and signs in-place the ones who are unsigned. This works very well with NuGet packages but also for assemblies referenced directly.

Explicit .snk files can be specified, simply add a file named SignReferences.txt at the root of the project. This file contains lines in the form of:
<assemblyFileName>: <snkFile>
Wildcards are allowed, for example:
Stuff.*: stuff.snk
Other.*: other.snk
Assemblies not matching names provided in list will be signed with a default random-generated snk. Snk file names are relative to project root.

Shall I be happy?

Yes. Probably.

signreferences's Issues

SignReferences.txt - fallback in folder hierarchy

Hi,
congrats on your helpful package, I was just about to hack sth on my own before finding your package.

My use case: several of my projects include the same unsigned nuget package and I don't want to create multiple SignReferences.txt files.

Idea/Feature request:
Why not do it like nuget with the nuget.config file or git with .gitignore: Search for the file on all parent folders and merge the result? Packages used multiple times could be on a top level and specific packages on the project level.

Greetings from Haute-Savoie !

Sequence contains more than one matching element

Hello Pascal,

Could you be so kind to change the following code in you sources:
ProcessUtility
private static string FindApplicationPath(string fileName)
...
return path.Select(p => TryPath(p, fileName)).SingleOrDefault(p => p != null)
...
SingleOrDefault fails on some PC's. It's not that convenient to fix environment variables on all these PC-s. So, could you be so kind to change it to FirstOrDefault, thanks.

Kind Regards,
Vitaliy

signing fails after update of unsigned assembly

How to reproduce:

1. add unsigned assembly A to a project P
2. add SignReferences nuget package and configure signing keys
3. compile project P -> assembly gets signed
4. update assembly A (e.g. if A is from an own project -> recompile)
5. recompile project P
6. SignReferences no longer tries to sign A

I have tracked this down in the code of SignReferences to AssemblyReference.cs:SaveLoad. This fails if an assembly with the same strong name has been loaded already. Visual Studio seems to reuse msbuild processes between builds and they keep their AppDomain where the previous SignReferences call has loaded it. Work around: kill msbuild process or restart Visual Studio.
Just reusing that loaded old assembly does not help because that may have a different signing status than the new one.
I think one needs to create a new AppDomain per ProjectSigner instance and make AssemblyReference use it. Working with multiple AppDomains is not easy but I don't see another way.
Qu'est ce que t'en dis ? 🇫🇷

Specify .snk for specific references and default case

Allow the use of a file where .snk files are linked to specific assemblies.