Skip to content

Add support for delay-signing with a public only keyfile#513

Closed
ryknuth wants to merge 2 commits into
jbevain:masterfrom
ryknuth:master
Closed

Add support for delay-signing with a public only keyfile#513
ryknuth wants to merge 2 commits into
jbevain:masterfrom
ryknuth:master

Conversation

@ryknuth

@ryknuth ryknuth commented Apr 28, 2018

Copy link
Copy Markdown

Problem:
Mono.Cecil attempts to strong sign an assembly with a StrongNameKeyPair that only contains a public key. This throws an exception as a private key is required to complete the sign. However, it should be supported to place the public key into the AssemblyName without signing the assembly.

Fix:
Allow clients to pass in the public key. Clients should determine if they have a proper StrongNameKeyPair that includes the private key. If not, pass along the keyfile to be used as the public key. In the case of using the public key bytes, do not attempt to sign the assembly and do not mark it as signed.

ryknuth added 2 commits April 28, 2018 08:34
Problem:
Mono.Cecil attempts to strong sign an assembly with a StrongNameKeyPair that only contains a public key. This throws an exception as a private key is required to complete the sign. However, it should be supported to place the public key into the AssemblyName without signing the assembly.

Fix:
Allow clients to pass in the public key.  This should be passed in alongside a StrongNameKeyPair.  If the strong name fails to calculate a PublicKey and throws the ArgumentException, set the PublicKeyBytes to the assembly instead. Furthermore, do not attempt to sign/strong name the assembly in this scenario.
@SimonCropp

Copy link
Copy Markdown
Contributor

@jbevain thoughts on this one?

@jbevain

jbevain commented May 16, 2018

Copy link
Copy Markdown
Owner

Yes yes yes. Just rename PublicKeyBytes to PublicKey and this is good to go. Thanks for the contribution!

@jbevain

jbevain commented May 16, 2018

Copy link
Copy Markdown
Owner

Also a test would be nice.

@jbevain

jbevain commented Jun 8, 2018

Copy link
Copy Markdown
Owner

Reviewing this, why not simply setting the PublicKey of the assembly name before writing?

@jbevain

jbevain commented Jul 30, 2018

Copy link
Copy Markdown
Owner

@SimonCropp I don't see why this is needed and why you can't create a delay signed without having this new parameter. As far as I can tell, you can create an AssemblyDefinition with the proper flags and the proper public key, and it will be considered delay signed.

@SimonCropp

Copy link
Copy Markdown
Contributor

@jbevain i will defer to @ryknuth on that. since he said it was required

@ryknuth

ryknuth commented Aug 15, 2018

Copy link
Copy Markdown
Author

@jbevain and @SimonCropp Isn't that what I'm doing? I'm passing in the PublicKey to be set into the AssemblyDefinition that is used to write the assembly. There's already the StrongNameKeyPair for signing with a private key. If we want to allow delay signing, we should allow people to pass in the public key bytes.

@jbevain

jbevain commented Aug 15, 2018

Copy link
Copy Markdown
Owner

@ryknuth yeah but you can already set the PublicKey on the assembly definition:

assembly.Name.PublicKey = publicKey;

Without having to add a new API to the WriterParameters.

@ryknuth

ryknuth commented Aug 15, 2018

Copy link
Copy Markdown
Author

I see, let me paste some code here to ensure I understand. The change would be completely in Fody.

        var parameters = new WriterParameters
            {
#if NET46
                StrongNameKeyPair = StrongNameKeyPair,
#endif
                WriteSymbols = debugWriterProvider != null,
                SymbolWriterProvider = debugWriterProvider,
            };

      ModuleDefinition.Assembly.Name.PublicKey = KeyFileBytes;
      ModuleDefinition.Write(AssemblyFilePath, parameters);

The added line is this:
ModuleDefinition.Assembly.Name.PublicKey = KeyFileBytes;

Am I understanding correctly?

@jbevain

jbevain commented Aug 15, 2018

Copy link
Copy Markdown
Owner

I think it looks correct. You might have to turn on a flag as well on the Module:

module.Attributes |= ModuleAttributes.StrongNameSigned;

But I'm not 100% sure.

@ryknuth

ryknuth commented Aug 15, 2018

Copy link
Copy Markdown
Author

With delay signing, we shouldn't set StrongNameSigned if I recall correctly since it actually isn't signed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants