Sign nuget package

[mikegoatly]

The nuget package isn't currently signed - any assistance or guidance with that regard would be appreciated!

[rstm-sf]

Hello. Sorry, but this is a rudiment. It is advisable to avoid this as much as possible :)

[mikegoatly]

Hello. Sorry, but this is a rudiment. It is advisable to avoid this as much as possible :)

Interesting - I was aware that there may be issues/cost involved in getting a signing cert, but I hadn't thought it would be controversial beyond that! What's the reasoning behind your comment?

[Vespion]

From my understanding you have the duel issues of: Code Signing certificates are expensive and annoying to get; and the way that the NuGet client handles deciding what certificates are trusted and which aren't is a somewhat all or nothing approach.

Because of these 2 reasons most people don't sign packages, which means most people don't enforce package signing, so people don't bother signing them etc etc.

There's a pretty good article on this exact issue https://haacked.com/archive/2019/04/03/nuget-package-signing/

Now I'll be the first to admit that this article is a bit old (2019? It feels so long ago), but I've not heard of anything new on the package signing front for NuGet.