I have an open source C# project, Succint<T>, for which I wish to create a strongly typed assembly version. I plan on making the key file for this public, by adding it to the GitHub repository, in order to keep the whole thing open source.The obvious consequence of this is that someone else could modify the code in a malicious way, sign it with that key file, and naive users who think that a signed assembly somehow implies security could be tricked into using it.Whilst I'd not wish that to happen to anyone, my concern is that the affected user might try to hold me responsible. So my question is, does the MIT licence wording absolve me of responsibility in such an eventuality?
Does the MIT open source licence cover making the key file, for a strongly typed assembly, public?
mit
I'd add instructions for somebody else to cook up their own key, and sign (and verify) with that. Also publish somewhere you have total control the key to check the signature. The signing key should not be distributed in any way, as that just would void any protection the signed by the original developer could provide.