GIS Converter - Signing

Question

I need to sign the app.

1. What is signing ?
2. Which apps I need to sign ? GisConvert.ConsoleApp , also GisConvert.WpfApp and GisConvert.TestsApp ?
3. What option of signing I have ?
4. What is the best practice?
5. Does signing is one time?
6. Do I need update it all times?
7. Can you sign with best option all the needed projects?
8. Can you give videos, how do you do it, for each project?
9. Where i see the code of signing in .csproj of the project?
10. I send you in private the code?

Thanks,

Answer 1

Hi @Dani_S , sorry for late response, I will show you more detail instruction below:

Step 1: Create a strong-name key (.snk)

Option A: Using Visual Studio

• Right-click Solution -> Properties -> Signing
• Click New…
• Name it (for example): GitConverter.snk
• Leave password empty (recommended unless required)

Save (it will be added to your solution)

Option B: Command line (alternative)

sn -k GitConverter.snk(Requires Developer Command Prompt)

Step 2: Enable signing in each project

• Right-click project -> Properties
• Go to Signing
• Check Sign the assembly
• Select GitConverter.snk
• Save
• Repeat for the rest projects.

Step 3: After build, verify:

• sn -vf ConsoleApp.dll
• sn -vf WpfApp.dll
• Expected result: Assembly ... is valid

Note:

• Don't commit .snk to public repos
• Use one .snk file
• You don't have to open the snk file.

Answer 2

1. Signing the App: Signing an app is a process that involves applying a digital signature to the app package. This signature verifies the identity of the publisher and ensures that the app has not been tampered with since it was signed.
2. What is Signing?: Signing is a cryptographic operation that verifies the contents and publisher of an app. It is essential for security and trust, especially when distributing apps.
3. Which Apps to Sign?: You need to sign all your apps that you plan to distribute. In your case, this includes GisConvert.ConsoleApp, GisConvert.WpfApp, and GisConvert.TestsApp.
4. Options for Signing: You can sign your app using tools like SignTool, which is part of the Windows SDK. You will need a valid code signing certificate, typically in .pfx format.
5. Best Practices: It is best practice to use a code signing certificate from a trusted certificate authority. Ensure that the subject name of the certificate matches the publisher name in your app's manifest.
6. Is Signing One-Time?: Signing is not necessarily a one-time process. You may need to re-sign your app if you make changes to it or if the certificate expires.
7. Do I Need to Update It All Times?: You need to update the signing certificate if it expires or if you change the app significantly.
8. Can You Sign All Projects?: You can sign all the needed projects using the same code signing certificate as long as it meets the requirements.
9. Videos for Signing: I cannot provide videos, but you can find many tutorials online that demonstrate how to sign apps using SignTool.
10. Code of Signing in .csproj: The signing configuration is typically found in the .csproj file under the <PropertyGroup> section, where you can specify the signing options.
11. Sending Code in Private: I cannot assist with reviewing code or private messages.

For more detailed information on signing app packages, you can refer to the following resources.

Answer 3

Hello @Dani_S ,

What is Signing?

Signing in C# projects means adding a cryptographic signature to assemblies or manifests to ensure authenticity, integrity, and unique identity.

Which apps I need to sign ? GisConvert.ConsoleApp , also GisConvert.WpfApp and GisConvert.TestsApp ?

• GisConverter.ConsoleApp - Yes
• GisConverter.WpfApp - Yes
• GisConverter.TestsApp - (optional)

What option of signing I have ?

1. Strong-Name Signing - Gives your assemblies a unique identity within .NET. Uses a .snk key file.
2. Authenticode Signing - Signs executables with a digital certificate so Windows trusts them. Prevents "Unknown Publisher" warnings.

What is the best practice?

1. Apply strong-name signing to all projects using the same .snk file
2. Apply Authenticode signing only to the final .exe files users run
3. Always use timestamping when Authenticode signing
4. Purchase an EV certificate if building trust quickly is important

Where i see the code of signing in .csproj of the project?

This is an example generated by Copilot:

<PropertyGroup>
  <SignAssembly>true</SignAssembly>
  <AssemblyOriginatorKeyFile>YourKey.snk</AssemblyOriginatorKeyFile>
</PropertyGroup>

Does signing is one time? Do I need update it all times?

• Strong-name: Yes, one-time setup
• Authenticode: Certificate expires annually and must be renewed

Can you sign with best option all the needed projects? Can you give videos, how do you do it, for each project?

Due to Code of conduct, I can't, but you can follow the document below for more detail:

• Strong-name signing documentation
• Sign files with SignTool