Skip to content

Mention public signing in Strong Name docs #45914

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gewarren merged 3 commits into from
Apr 24, 2025
Merged

Mention public signing in Strong Name docs #45914

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
454d43a
Mention public signing in Strong Name docs
ericstj Apr 24, 2025
844fc6e
Update link for public sign to docs instead of repo md
ericstj Apr 24, 2025
bbfaf3e
Apply suggestions from code review
ericstj Apr 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions docs/standard/library-guidance/strong-naming.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,11 +43,13 @@ You should strong name your open-source .NET libraries if their targets include

✔️ CONSIDER strong naming your library's assemblies.

✔️ CONSIDER adding the strong naming key to your source control system.
✔️ CONSIDER adding the strong naming key pair (public + private) to your source control system.

> A publicly available key lets developers modify and recompile your library source code with the same key.
> A publicly available key pair lets developers modify and recompile your library source code with the same key.
>
> You shouldn't make the strong naming key public if it has been used in the past to give special permissions in [partial-trust scenarios](/previous-versions/dotnet/framework/code-access-security/using-libraries-from-partially-trusted-code). Otherwise, you might compromise existing environments.
> You shouldn't make the strong naming key pair public if it has been used in the past to give special permissions in [partial-trust scenarios](/previous-versions/dotnet/framework/code-access-security/using-libraries-from-partially-trusted-code). Otherwise, you might compromise existing environments.
>
> If you can't check in the public + private key pair, then check in the public key and use [public signing](../../csharp/language-reference/compiler-options/security.md#publicsign) for regular builds. Public signing still allows developers to recompile and use your library in most scenarios.

> [!IMPORTANT]
> When the identity of the publisher of the code is desired, [Authenticode](/windows-hardware/drivers/install/authenticode) and [NuGet Package Signing](/nuget/create-packages/sign-a-package) are recommended. Code Access Security (CAS) should not be used as a security mitigation.
Expand Down