MaxMind.Db 2.1.1 Strong name signature could not be verified

Question

MaxMind.Db 2.1.1 Strong name signature could not be verified

jmojiwat opened this issue 8 years ago · comments

After updating to MaxMind.GeoIP2 2.7 and MaxMind.Db 2.1.1 in my ASP.NET MVC 5 application, I get the following error:

Could not load file or assembly MaxMind.Db' or one of its dependencies. Strong name signature could not be verified. The assembly may have been tampered with, or it was delay signed but not fully signed with the correct private key

The error went away when I downgraded to MaxMind.GeoIP2 2.6 and MaxMind.Db 2.0.0.

Andrian Bulat commented 8 years ago

+1

Gregory Oschwald · Answer 1 · Mon Aug 08 2016 21:54:07 GMT+0800 (China Standard Time)

Thanks for reporting this. I haven't been able to reproduce it with .NET Core builds, but I'll try it with a standard .NET 4.6 build in VS. Are the assemblies you are generating signed themselves or does this happen when generating unsigned assemblies as well?

Andrian Bulat · Answer 2 · Mon Aug 08 2016 22:15:42 GMT+0800 (China Standard Time)

I have it on .net 4.6 for unsigned assemblies.
And it occurs when building in Release mode.

Gregory Oschwald · Answer 3 · Mon Aug 08 2016 22:25:38 GMT+0800 (China Standard Time)

I just tried creating a new .NET 4.5 project in VS 2015. The resulting assembly works regardless of whether it is signed or not. Does this only happen in your existing project or does it happen in new projects too? If you can reproduce this in a new project, would it be possible for you to send me the test project with the issue?

Andrian Bulat · Answer 4 · Mon Aug 08 2016 22:42:23 GMT+0800 (China Standard Time)

You're right, normal build works. For me fails asp net compiler.

I attached an empty WebProject with a publish profile to file system -> c:\temp\1

Open the solution
Nuget restore
Right click on project -> Publish

Fails with:
ASPNETCOMPILER(0,0): Error ASPCONFIG: Could not load file or assembly 'MaxMind.Db, Version=2.0.0.0, Culture=neutral, PublicKeyToken=66afa4cc5ae853ac' or one of its dependencies. Strong name signature could not be verified. The assembly may have been tampered with, or it was delay signed but not fully signed with the correct private key. (Exception from HRESULT: 0x80131045)

WebApplication4.zip

Gregory Oschwald · Answer 5 · Mon Aug 08 2016 23:23:42 GMT+0800 (China Standard Time)

Thanks! I am able to reproduce it with your project.

Gregory Oschwald · Answer 6 · Tue Aug 09 2016 01:03:26 GMT+0800 (China Standard Time)

This should be fixed. The underlying cause seems to be that the bad release was done on Linux and the .NET Core CLI tools did not properly sign the binaries there. I believe this is related to https://github.com/dotnet/cli/issues/720