Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PublicSign does not work when supplied with a full private key #17451

Open
vcsjones opened this issue Jul 26, 2024 · 1 comment
Open

PublicSign does not work when supplied with a full private key #17451

vcsjones opened this issue Jul 26, 2024 · 1 comment
Assignees
Labels
Area-ProjectsAndBuild MSBuild tasks, project files, framework resolution Bug Impact-Low (Internal MS Team use only) Describes an issue with limited impact on existing code.
Milestone

Comments

@vcsjones
Copy link
Member

vcsjones commented Jul 26, 2024

The --publicsign+ (Or PublicSign project property) option used for public-signing projects does not work when the supplied strong name key is a full public/private key pair.

Steps to reproduce.

  1. Generate a strong name key pair (sn -k mykeypair.snk)

  2. Create a project that looks like this

    <Project Sdk="Microsoft.NET.Sdk">
    
      <PropertyGroup>
        <OutputType>Exe</OutputType>
        <TargetFramework>net8.0</TargetFramework>
        <RootNamespace>fsharp_scratch</RootNamespace>
        <SignAssembly>True</SignAssembly>
        <AssemblyOriginatorKeyFile>mykeypair.snk</AssemblyOriginatorKeyFile>
        <PublicSign>true</PublicSign>
      </PropertyGroup>
    
      <ItemGroup>
        <Compile Include="Program.fs" />
      </ItemGroup>
    
    </Project>

Attempt to build this project will result in

A problem occurred writing the binary 'obj\Debug\net8.0\refint\fsharp-scratch.dll': A call to StrongNameSignatureSize failed (Invalid Public Key blob)

Note that public does work correctly if you supply it with just the public key.

  1. Extract the public key using sn -p mypairpair.snk publickey.snk
  2. Change the AssemblyOriginatorKeyFile to publickey.snk
  3. Observe that that public signing works.

In theory public signing, even with the full public/private key pair should still work because the public key is a a subset of the private key.

The C# / Roslyn toolset is able to use the full private key when used with publicsign


As for the use case of why this is useful, this was reported by Red Hat / @omajid. They are trying to utilize PublicSign in their build process because full-signing does not work. Full signing does not work there because strong naming requires using the RSA+SHA1 signature algorithm, and that signature algorithm does not work on their systems because it is deprecated.

More background on the issue is available at dotnet/runtime#105486

@tmds
Copy link
Member

tmds commented Jan 9, 2025

When this is fixed, we can undo dotnet/arcade#15380.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Area-ProjectsAndBuild MSBuild tasks, project files, framework resolution Bug Impact-Low (Internal MS Team use only) Describes an issue with limited impact on existing code.
Projects
Status: New
Development

No branches or pull requests

4 participants