WalkerCodeRanger/semver

Create nuget package with strong name

Closed this issue · 10 comments

Hi.

Thanks for semver.
In my project require to use a signed assembly, could you please release a strong named nuget package?

Thanks
Anton

Sam13 commented

+1

I'm not a fan of strong naming. @grishchenkoa You can always use Strongnamer: https://github.com/dsplaisted/strongnamer

Sam13 commented

@thoemmi Thanks for the hint, didn't knew StrongNamer.

I'm not familiar with the pros and cons of strong naming. If someone could point me to a blog post or other resource and to examples of what other packages do, I'd appreciate it.

In issue #22 the example of dapper was given. Apparently, they publish two versions of the package:
https://www.nuget.org/packages/Dapper/
https://www.nuget.org/packages/Dapper.StrongName/

@WalkerCodeRanger Microsoft now has official guidance on strong naming. More specifically for open-source:

You should strong name your open-source .NET libraries. Strong naming an assembly ensures the most people can use it, and strict assembly loading only affects .NET Framework.

✔️ CONSIDER strong naming your library's assemblies.

✔️ CONSIDER adding the strong naming key to your source control system.

Excerpt of the "Build great libraries" video on Channel9, which goes over this guidance:
Build great libraries

This has been implemented on the strong-name branch. However, according to MS guidelines adding a strong name is a breaking change. So this will have to be done as part of the 3.0.0 release.

@WalkerCodeRanger since there is current development on version 3.0 (?) on "master" and the "release/3.0.0" branches, will the strong naming also make it's way from the "strong-name" branch into these development branches?

@christianduerselen at the moment, the master branch is still development for v2.3.0. It will hopefully be released soon, and then release/3.0.0 will be merged into master after v2.3.0 is released. Yes, addressing strong naming will be done for v3.0.0. It looks like the guidance is still for major OSS libraries to be strong named even though in some ways it matters less for .NET Core. I do not know how long it will be before v3 is released.

https://github.com/dotnet/runtime/blob/main/docs/project/strong-name-signing.md
https://learn.microsoft.com/en-us/dotnet/standard/assembly/create-use-strong-named

This has been fixed on master and will be included in v3.0.0