grpc 2.83 assemblies in nuget packages are not signed?

[jeroenjanssen-cpp]

What version of gRPC and what language are you using?

grpc (.reflection) nuget packages 2.83

What operating system (Linux, Windows,...) and version?

Windows

What runtime / compiler are you using (e.g. .NET Core SDK version dotnet --info)

dotnet 10

What did you do?

Upgraded from grpc nuget packages 2.80 to 2.83 in our Directory.Packages.Props

What did you expect to see?

Note: we have a custom build time check that verifies that all assemblies are signed.
This build time assembly signed check should have passed.

Manual verification of the nuget content for grpc.reflection.2.80.0\lib\netstandard2.0 shows:

What did you see instead?

Build time assembly check failed.

Manual verification of the nuget content for grpc.reflection.2.83.0\lib\netstandard2.0 shows:

[JamesNK]

cc @asheshvidyut

[asheshvidyut]

Hey @jeroenjanssen-cpp

Thanks for reporting this issue. Could you please help us with the command that you are using for the build time check?

[mohanvithursan]

@asheshvidyut I am colleague of @jeroenjanssen-cpp.

We read the authenticode signature using X509Certificate.CreateFromSignedFile() and validate the certificate chain using X509Chain.Build().
But does this matter if we can't even see a digital signature on the DLL..?