[GH-ISSUE #23] InternalsVisibleTo is not updated if friend assembly not present #19

New issue

Closed

opened 2026-02-25 21:30:28 +03:00 by kerem · 1 comment

kerem commented

2026-02-25 21:30:28 +03:00

Owner

Originally created by @gravufo on GitHub (Jun 27, 2016).
Original GitHub issue: https://github.com/brutaldev/StrongNameSigner/issues/23

I am trying to sign the Akka NuGet Package by using Signature.Core which in turn uses your tool.

The problem is that when I try to use the signed NuGet package, it fails with the following error:
Unhandled Exception: System.MethodAccessException: [D:\AkkaTest\Akka test\Akka test\bin\Debug\Akka.dll] Strong-name signed assemblies must specify a public key in their InternalsVisibleTo declarations.

This is due to the fact that Akka.dll contains InternalsVisibleTo references to other Akka dlls which are not present in that NuGet package.

Reading the code of your tools made me realize that you only update that field if the friend assembly is present and (in newer versions of your tool, which Signature.Core does not use yet) delete it otherwise.

Wouldn't it be safer to assume/guess that the friend reference will have the same public key as the dll we are currently signing? Since we are signing this dll, we are probably going to sign the other ones anyway. It just so happens that in a NuGet environment, the references aren't in the same package.

Thanks

Originally created by @gravufo on GitHub (Jun 27, 2016). Original GitHub issue: https://github.com/brutaldev/StrongNameSigner/issues/23 I am trying to sign the [Akka NuGet Package](https://www.nuget.org/packages/Akka) by using [Signature.Core](https://github.com/MyGet/webhooks-sign-package) which in turn uses your tool. The problem is that when I try to use the signed NuGet package, it fails with the following error: `Unhandled Exception: System.MethodAccessException: [D:\AkkaTest\Akka test\Akka test\bin\Debug\Akka.dll] Strong-name signed assemblies must specify a public key in their InternalsVisibleTo declarations.` This is due to the fact that Akka.dll contains InternalsVisibleTo references to other Akka dlls which are not present in that NuGet package. Reading the code of your tools made me realize that you only update that field if the friend assembly is present and (in newer versions of your tool, which Signature.Core does not use yet) delete it otherwise. Wouldn't it be safer to assume/guess that the friend reference will have the same public key as the dll we are currently signing? Since we are signing this dll, we are probably going to sign the other ones anyway. It just so happens that in a NuGet environment, the references aren't in the same package. Thanks

kerem

2026-02-25 21:30:28 +03:00

closed this issue
added the
wontfix
label

kerem commented

2026-02-25 21:30:29 +03:00

Author

Owner

@brutaldev commented on GitHub (Jun 27, 2016):

Please refer to the section on dealing with dependencies.

Not going to make any assumptions on the public keys of friend assemblies, this will create create even more confusing behavior when the keys do not in fact match. You will need to include paths to all other reference assemblies so that everything can be correctly fixed. Signature.Core should also consider updating to the latest tool version. The correct functionality here is to remove the friend reference and not corrupt the assembly.

@brutaldev commented on GitHub (Jun 27, 2016): Please refer to the section on [dealing with dependencies](https://github.com/brutaldev/StrongNameSigner#dealing-with-dependencies). Not going to make any assumptions on the public keys of friend assemblies, this will create create even more confusing behavior when the keys do not in fact match. You will need to include paths to all other reference assemblies so that everything can be correctly fixed. `Signature.Core` should also consider updating to the latest tool version. The correct functionality here is to remove the friend reference and not corrupt the assembly.