Docs: Authenticode and .NET/MSBuild

[SamuelEnglard]

The link for using Authenticode is for signing Windows drivers/C++ code. Would be nice to have documentation for signing .NET code using and/or using MSBuild to do so. Maybe not in this section but in general.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 90b392eb-c8a1-147f-e3fb-35b8ec702d53
• Version Independent ID: ffd3b865-f141-3f92-473b-fbfb9d32913b
• Content: Strong naming and .NET libraries
• Content Source: docs/standard/library-guidance/strong-naming.md
• Product: dotnet
• GitHub Login: @JamesNK
• Microsoft Alias: mairaw

[JamesNK]

Docs team: do you know of an article that discusses Authenticode in the context of .NET? It would be nice to link to something more pertinent.

// @onovotny

[mairaw]

@JamesNK these are some that I found:

• https://docs.microsoft.com/visualstudio/deployment/clickonce-and-authenticode
• https://docs.microsoft.com/dotnet/framework/unmanaged-api/authenticode/

Not sure if any of these is what you're looking for?

[JamesNK]

Not really. There is a blog post that talk about Authenticode signing and .NET but it is completely out of date:

https://blogs.msdn.microsoft.com/shawnfa/2005/12/13/authenticode-and-assemblies/

I think it is a gap in the docs.

[mairaw]

Could be @JamesNK!

[svick]

Does anyone actually use Authenticode for .Net assemblies? Is it usable cross-platform?

If not, maybe it shouldn't be recommended here?

[clairernovotny]

Many people and organizations Authenticode .NET assemblies. It's the only way to guarantee provenance and ensure it wasn't tampered with.

The fact that most developers don't is likely due to the cost of the certs. We should be working to make it easier/cheaper, etc. The underlying tech is worthwhile.

Here's a cross plat version
https://linux.die.net/man/1/signcode

It can sign and validate signatures on any platform Mono supports.

[clairernovotny]

Next step is to get those Authenticode tools ported to .NET Core. Which will happen.

All the tools are in Mono here: https://github.com/mono/mono/tree/master/mcs/tools/security

[JamesNK]

The fact that most developers don't is likely due to the cost of the certs.

And it is never talked about to .NET devs, or well documented.