Nuget distrib of bc completely fucked up

[bcgit]

Nuget distrib of bc completely fucked up

[ZigMeowNyan]

It is really difficult to tell which packages are official packages and which are maintained by unrelated people. There's actually two unanswered questions on the mailing list (One from 4 months ago and another from 10 months ago) about people being confused about which packages to use, or package differences. None of the BouncyCastle package owners for what I think is the main Nuget package are on the website's contributor list. There might be more queries, but the mailing list search function was broken. There are people reporting here and on the JIRA page.

I spent over half an hour combing through pages, searching issues and hunting to finally make the connection via @peterdettman on the JIRA tracker, which lead me to this mirror, before I could feel vaguely confident that the package was vaguely blessed by core contributors.

Near as I can tell, there's also the Portable.BouncyCastle library being maintained by Oren who seems to make significant efforts to keep BouncyCastle usable for newer xplat deployments.

It would be very much appreciated if you'd put a page up on your site telling people which Nuget packages are approved, and worked with all the various forked package authors to try and clean up the single-function packages. Additionally, it would be useful if you updated some of the older sections of the site, or at least marked them as unmaintained sections and guided people towards the areas that receive attention. It's a shame how difficult it is to find the right package for a cryptography library. People should know which, if any, of the builds are from trusted personnel. Especially given the historical importance of this one, and how often it ends up being a dependency.

[clairernovotny]

For anyone interested, Portable.BouncyCastle 1.8.1.2 is now on NuGet. No real changes; it's a fresh port of master using the VS 2017 cross-compile project types.

The binaries are also Authenticode signed with my name on them.

The main difference over the prior package is that it now includes a net4 version in addition to the portable versions, so it can replace any existing desktop usage.

[Sojaner]

I second this, even version 1.7.0 and 1.8.1 are both on the same NuGet package but using 2 different public keys. That makes it impossible to reference libraries using the older assembly.

[clairernovotny]

FWIW, I'm updating the build pipeline for Portable.BouncyCastle to gear up for an updated release. It's still up-to-date with the bc-git master.

It will target the following platforms:

• net4
• netstandard1.0
• netstandard1.3
• portable-net4+sl5+wp8+win8+wpa81

This should make it work everywhere. It has the same public key as the current BC dist and is easily replaced with it.

That said, I'm also going to be signing my binaries with an Authenticode cert containing my name, staring with this coming update.

I've re-forked my repo so it shows up as a link to this one; my original repo predates the GitHub fork despite it being a clone from the same original repo:

https://github.com/onovotny/bc-csharp

[FrankSzendzielarz]

I second this too. I guess I am going to have to have a local build of this stuff as the nuget packages are either behind or unmaintained.

[clairernovotny]

@FrankSzendzielarz My packages are up to date. Please use the Portable.BouncyCastle for now. It's a drop-in replacement if you need more than just .NET support.

[FrankSzendzielarz]

@onovotny Nazdar :-) Is that correct? Last I looked on NuGet the update was 6 months ago and I saw some recent updates I wanted in the main build (particularly ConcatenationKdfGenerator). I might be misreading/misunderstanding which version of what is where so if you could let me know how up to date your packages are and from where I should get them?

[clairernovotny]

@FrankSzendzielarz In general, I was following BC's releases, though I can easily push out an update if there's relevant updates post the 1.8.1.3 version.

[FrankSzendzielarz]

@onovotny One second, I might be misreading, please can you check this and see if you have it in your lib? 86a7490#diff-60cdc397256fad26647be3d61b6c1e23

Basically I want the stuff to support the Ethereum NIST SP 56 (section 5.8.1) stuff so I don't have to port their GoLang stuff.

[clairernovotny]

Looking at the commit graph, it's not there yet, but I can release an update in the next couple hours that has it. It'll be 1.8.1.4.

[FrankSzendzielarz]

@onovotny Wow. That would be fantastic! There's a cold (original) Budweiser waiting for you when you need it. Let me know!

[clairernovotny]

@FrankSzendzielarz Just uploaded, should be visible in the next 10-15 min https://www.nuget.org/packages/Portable.BouncyCastle/1.8.1.4

[FrankSzendzielarz]

@onovotny Top Class. You saved me a ton of time. Many thanks for that. Like I said, if you are my way stop by and the lagers are on me.