Should we move off MD5 to be FIPS compliant? about costura

[distantcam]

I don't see why not, if people need FIPS compliance.

Another thing I was thinking about with the hashing, why not bake the hash into the loader with Costura, instead of inserting code to generate it each time?

[SimonCropp]

bake the hash into the loader

that is an even better idea. I actually dont care about FIPs at compile time. It is more a run time concern. if we can remove the need for it at run time that is perfect

[distantcam]

0.4.2 now has a baked in hash based on the bits of the embedded Costura resources.

This can cause multiple assemblies to have the same hash, if they have the same embedded resources. To avoid conflicts when saving the assemblies to disk that part of the code has a mutex protecting it across processes.

I also took the opportunity to clean up the template code and move common stuff into a shared class. Everything gets put into one class by Costura.

[richardmatsu]

When @SimonCropp referenced this issue from an NServiceBus issue, I didn't know at the time that NSB was using Fody/Costura. I've discovered that the version shipping with NSB 4.0.4 is not compliant. The package info is:

<package id="Fody" version="1.13.8.0" targetFramework="net40" />

Does the version above include the commit referenced here? If not, what version should NSB be using?

Thanks