You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Besides signing the NuGet package, also sign the UnitsNet.dll? #1748
Is your feature request related to a problem? Please describe.
Whilst the NuGet package itself is signed, the containing UnitsNet.dll is not
Windows Smart App Control relies on cloud based reputation and as long as the file-hash for the assembly doesn't change, the reputation stays.
As soon as the file hash changes, the reputation gets reset.
This could result in applications that rely on UnitsNet to no longer work when they'd upgrade, due to the new assembly not having enough reputation
Describe the solution you'd like
Also sign the actual UnitsNet.dll, since a signed DLL with a valid code signing certificate is automatically accepted by SAC
Describe alternatives you've considered
Signing the assembly ourself with our own certificate seems to be the widely accepted solution, but I'm not a fan of putting my stamp of approval on any third party assembly I don't control.
It would mean thoroughly vetting the source code of the specific version we're using and repeating that process whenever we upgrade
Additional context
Not running into an issue with UnitsNet at this moment, just tracking down all NuGet packages we use and see if they're able to sign their assemblies as well
EDIT
Because UnitsNet is strongly named, would that mean it's always the same hash as well? 🤔
That could explain why nobody is complaining 😅
After investigating our issue with SAC these past couple of days, asking for open-source project to also invest in a code signing certificate isn't something feasible to ask
I was wrongfully under the impression you had a signing certificate due to the nuget package being signed, but later found out it's nuget themselves that sign the package if it's not signed 😅
Activity
dschuermans commentedon Oct 22, 2026
After investigating our issue with SAC these past couple of days, asking for open-source project to also invest in a code signing certificate isn't something feasible to ask
I was wrongfully under the impression you had a signing certificate due to the nuget package being signed, but later found out it's nuget themselves that sign the package if it's not signed 😅
We'll be signing the DLLs ourselves 👍