Assemblies are not Signed about monomod

[Amberg]

@pardeike Do you have a source for this statement?
I found exactly the opposite. 😄 Here Microsoft recommends to strong name open source libraries:
https://docs.microsoft.com/en-us/dotnet/standard/library-guidance/strong-naming#create-strong-named-net-libraries

Perhaps we are confusing things here. I am talking about strong naming the assemblies.
As far as I can tell, most open source projects are signed.

As example JSON:
// Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed
Mono.Cecil:
// Mono.Cecil, Version=0.11.4.0, Culture=neutral, PublicKeyToken=50cebf1cceb9d05e

But of course you can also sign the assemblies yourself. But that is a bit tedious.

[0x0ade]

Dang, I wanted to give a comment before having the issue closed 😅

Better documentation would certainly help as this is quite obscure knowledge right now, but: You should be able to declare a MonoModRules class that updates MonoModRule.Modder.WriterParameters in its static constructor. MonoMod exposes the Mono.Cecil writer parameters, which should allow you to set any information necessary for strong naming.

[Amberg]

Ah ok I think I see. Thank you for your hint.. I was just interested in the "MonoMod.RuntimeDetour" package to setup a lightweight Hook. Is this not possible with a signed project?

Is there a reason why the packages are not signed? There is a snk file in the Common project..

[0x0ade]

Ooooh, that's what you meant.

The main reason why MonoMod isn't signed is because it makes drop-in updates by users harder. The runtime seems to have much stricter versioning rules for signed .DLLs, I have yet to understand all the details though. I also remember there being more to it, but sadly not what exactly. I'll try digging up what I can remember 😅

[pardeike]

Microsoft itself recommends to not sign open source projects. Big corporations or users with signing needs will have to sign the packages themselves.

The main problem here is that signed artifacts are creating lots of problems for ordinary users that have no idea what it means or have no intend to sign their artifacts.