Authenticode Signing for Published NuGet Binaries

[spatters-epic]

Request

Hello!

It would be wonderful if the .dlls published in the NuGet packages, like Duende.IdentityModel.dll and Duende.IdentityModel.OidcClient.dll, were signed with Authenticode (practically, code signing via signtool).

Microsoft Documentation
Signtool Command Line Utility

Output of Signtool Today

signtool today reports no signatures on binaries like Duende.IdentityModel.OidcClient.dll when unpacked from the .nupkg archive.

signtool verify /v /pa .\net10.0\Duende.IdentityModel.OidcClient.dll

Verifying: .\net10.0\Duende.IdentityModel.OidcClient.dll
SignTool Error: No signature found.

Number of files successfully Verified: 0
Number of warnings: 0
Number of errors: 1

More Context

I recognize this is extra work for an OSS project, so it is firmly a feature request. However, I do think there might be some concrete benefits to consumers of these libraries, so I wanted to raise it for consideration. For organizations that use or deploy libraries as individual files, the absence of Authenticode signatures on the .dll files themselves can cause them to be blocked or flagged.

[maartenba]

As we distribute via NuGet, we consider signing at that level to be the way forward. It's also cross-platform (Authenticode is not). More about our NuGet signing practices: https://docs.duendesoftware.com/general/security-best-practices/#package-signing

If you do need to distribute as separate DLLs, we recommend adding a signature issued for/by the organization for internal signature validation.