When publishing official releases of open source .NET projects, should I use one signing key for all libraries, or one key per library?
I have a few open source libraries on CodePlex, and I intend to publish more when I have them at a stable and useful state.
I add a development signing key to the projects repository so that anyone can build and use those libraries from source, but for the official release, I use a different key, one that I do not publish.
Question is this:
Should I
- Use a common key for all official releases I make of all my libraries? ie. library A and B would both be signed by the same private key, even though the libraries have nothing in common except the author (me)
- Use a unique key for all libraries, ie. library A has its own key and library B has a different key
I'm looking for definite reasons 开发者_JS百科to do one or the other. If you have an opinion but not a hard reason for why that is, please leave a comment and I'll see if I should migrate it to Programmers.SE instead.
If you have many signatures people will doubt your identity.
The key belongs to the publisher, not to any project/binary.
the libraries have nothing in common except the author
Which is the deciding factor to use 1 key.
But that is the basic principle. If you want to express: This Project1.DLL is published by the Project1-Team you could use a key per library. That would not add any value, but might be practical when you start to co-operate on projects with different sets of people.
精彩评论