[Request] Digitally sign .NET versions of binaries

[Davsterl]

Why
To meet corporate compliance reqs, Can we digitally sign the Github.Copilot.SDK.dll binaries included in the npm releases?

[github-actions]

Thank you for opening this issue!

I've labeled this as an enhancement for the .NET SDK with a security tag, as code signing is a security-related compliance requirement.

This is a valid request for digitally signing the GitHub.Copilot.SDK.dll binaries. The team will review this to determine feasibility and prioritize accordingly.

AI generated by Issue Triage Agent

[SteveSandersonMS]

@Davsterl Do you mean you would like the NuGet package to be signed? Presuambly not the NPM package since that doesn't include any .NET assemblies.

[SteveSandersonMS]

@Davsterl Also can you clarify whether strong naming is sufficient for your scenario, or do you actually need code signing? Strong naming is cheap; we can do that quickly. Code signing is way more heaviweight and might take us a while to handle.

[Davsterl]

Ideally it would be authenticode signed. However if the cost is high for you, we can sign it with an internal cert for now. That might be the best trade off in the short term.

[SteveSandersonMS]

Thanks. I'll keep this on the backlog but we won't be in a position to do authenticode signing for now.

[scottaddie]

Strong name signing was completed in #1778