Authenticode signing and released Aspose assemblies

Aspose.Total Product Family
1
Hi,

One of our customers report some performance issues at loading time with our web site (using .net framework 3.5 and ASPOSE TOTAL .Net)
And we found that it was due to authenticode signing in Aspose assemblies (and the fact there were no internet connection on the server). Eventually, we workaround this with the "generatePublisherEvidence" parameter in aspnet.config, as already mention in this thread.

But, I noticed that you provide 1 of your assemblies without authenticode signing : Aspose.Words.dll. All the rest is signed with authenticode.

Is it possible to provide a version without authenticode signing for all of you assemblies ? Now and in the future ?

Thanks,

Patrick

2

Hi,


I would like to address your issue/ requirements from Aspose.Cells perspective.

Well, we may provide the Aspose.Cells assemblies without authenticode on demand for the users as we do not include it into our official release of the product (MSI Installer and Dlls version etc. which is also included into Aspose.Total for .NET package). I have logged a ticket with an id “CELLSNET-42291” for your issue/requirements. Hopefully, we may attach the zip file here containing the unsigned Aspose.Cells assemblies soon.

Thank you.
3
Thanks for your answer. Unfortunately, providing only Aspose.Cells.dll without authenticode is near to useless for us.
First, we need this for all DLLs. Currently our "bin" folder contains :
- Aspose.Cells.dll
- Aspose.Diagram.dll
- Aspose.Email.dll
- Aspose.Pdf.dll
- Aspose.Slides.dll
- Aspose.Tasks.dll
- Aspose.Words.dll
So, the authenticode will continue to delay the first load of our product web site.

Second, a one-shot release of these no-authenticode dlls is not the best as we may probably have to upgrade them with future versions. We'll need to ask for them again, which is possible of course, but annoying and time-consuming for you as for us.
I would prefer that you integrate this in your build/release process, although I can understand this could be quite a big deal.

In any case, we could deal with the workaround mentioned in my first post, but it would be a lot easier not to have to : currently, our client deployed our product mainly on servers without internet connection...

By the way, I'm not sure I really understand the use of this authenticode from your perspective, could you explain ? Strong-name signing is not enough ?

Kind regards,

Patrick
4

Hi Patrick,


Thank you for contacting support. I would like to address your issue from Aspose.Diagram API perspective.

Normally, we provide the Aspose.Diagram libraries without authenticode on demand as my colleague has stated in the above reply. I have logged a task to provide Aspose.Diagram libraries without authenticode. This task has been logged under ticket id DIAGRAMNET-50011 in our issue tracking system. Furthermore, our development team will look into the matter to upgrade to future versions. I have also added your comments against the ticket id DIAGRAMNET-50011. As soon as any information is shared by them, I will be more than happy to share that with you.

5

Hi Patrick,


Thanks for contacting support.

I am sorry to inform that currently we do not offer Aspose.Pdf for .NET product binaries without Authenticode signing. However I have logged this requirement in our issue tracking system as PDFNEWNET-36306. We
will further look into the details of this problem and will keep you updated on
the status of correction. Please be patient and spare us little time. We are
sorry for this inconvenience.

<o:p></o:p>

6

Hi Patrick,


Thanks for raising this with us. You ask a question about why we digitally sign our DLLs - it’s fairly common practice for leading component and software vendors as it helps validate that our binaries are original and free from any threats or modifications inserted by 3rd parties. For many customers it will be a requirement due to their security policies and server environments and it’s unusual for it to be an issue.

The approach you describe to disable the checking of the signature is the correct approach if you do not wish the code signature to be checked and should be simple to implement. Please let us know if you run into difficulties with that.

As we’ve had only very few requests about this topic, and .NET provides a simple way to disable signature checking when it is not needed, it’s unlikely we would provide more of our products with an unsigned binary as standard at this stage.
7

Hi,


Please try our latest version/fix: Aspose.Cells for .NET v7.7.2:
http://www.aspose.com/community/files/51/.net-components/aspose.cells-for-.net/entry525748.aspx

In the new release archive of Aspose.Cells for .NET v7.7.2, now we also provide assemblies without authenticode signed similar to Aspose.Words for .NET.

Let us know if we can be of any further help.

Thank you.

8

Hi Patrick,


Thank you for being patient. We have a good news for you that the issue id DIAGRAMNET-50011 has now been resolved. If there is no issue in the QA phase, then this fix will be included in the next version of Aspose.Diagram for .NET 5.7.0. We’ll inform you via this forum thread as soon as the new release is published.

9

The issues you have found earlier (filed as DIAGRAMNET-50011) have been fixed in Aspose.Diagram for .NET 5.7.0.

This message was posted using Notification2Forum from Downloads module by Aspose Notifier.