Mqttnet: Strong Named Assemblies

[PatrickKunz]

I really like the async API of the MQTT client :)

Any strong named assemblies planned?

[chkr1011]

Hi, at the moment this is not planned. My doubts are how to share a certificate for building in GitHub. I can also create a self signed one but this is only a workaround.

What is your use case for a strong name? Does your project only accept assemblies with a strong name?

[PatrickKunz]

Yes, we have a signed project and this accepts only signed nugets. But it's not a big issue. We have compiled and signed it for our case.

[GieltjE]

I highly recommend reviewing this issue, although sharing the certificate on github is strongly discouraged.

1. This builds a trust between releases, if someone were to hack your nuget account and release a rogue update this could be detected by third parties
2. Building an app with full strong name verification now fails as MQTTnet.dll references MQTTnet.Core.dll with no strong name signature making secure release chains impossible without manually compiled and signed libraries.

This point two prohibits anyone with a somewhat serious security intent from using this library without custom compilation. Given that this project is activly maintained and really usefull and that the addition of a strong name signature doesn't break anything I highly recommend adding one (just be sure to back it up somewhere safe).

[GieltjE]

@chkr1011 If you choose not to start signing the libraries are we allowed to publish our own packages to nuget in order to help those who require signed assemblies?

[chkr1011]

Hi,
at the moment there is no plan to add a strong name. I understand your point but I have to organize the certificate etc. first and avoid pushing it to the repo etc. So some things to plan.

But in the meantime you can upload it with a strong name. You can also use the image etc. from the official nuget package if you don't change the code in any way. Also the links should point to this repository. Then it is OK for me.

After you uploaded it I can add a reference to the README and also to the Wiki if you agree.

I recommend to start with the upcoming version 2.5.3. Starting with that version no external libraries are used because we had several issues using them.

Best regards
Christian

[GieltjE]

@chkr1011 you don't have to organise a certificate, I think you are mixing up code signing with strong name signing.

The first one requires a paid certificate and usually anual renewal, the latter requires just a few mouse clicks and no renewal what so ever. (Just open the project properties --> Signing --> Sign the assembly and create one, keep a good backup and don't upload it to the repository).

[chkr1011]

I will have a look. If it that easy I can surely do it 😄

[GieltjE]

@chkr1011 any progress on this issue?

[chkr1011]

@GieltjE Version 2.6 should have a strong name. Please let me know if it does not.

[GieltjE]

My sincere apologies, I missed the latest release and a sincere thank you for implementing it.

[chkr1011]

No problem 😄 But does it also work for you? I don't have this use case...

Best regards
Christian

[GieltjE]

Works like a charm 💯 , it's not rocket science, helps build a chain of trust but you would be surprised how many projects refuse to implement it.

[chkr1011]

OK. Yes it was no rocket science 😄