From c152f5f3ac8f2737c513e315a355d75f8eb6fe60 Mon Sep 17 00:00:00 2001 From: Victor Irzak Date: Mon, 14 Sep 2026 07:18:31 -0400 Subject: [PATCH] Explain registering the signing certificate on nuget.org nuget.org rejects a signed package whose certificate is not registered on the account, and will not take the rejected version again. 1.0.23 was lost that way, so the note says to register each new Trusted Signing certificate before the first release signed with it, and where to find the certificate. Generated with Claude Code --- AGENTS.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 3832658..995d9ea 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -59,6 +59,8 @@ The packages land in `artifacts/package/release`. The tests compile the core fro CI (`.github/workflows/build.yml`) builds and tests on Ubuntu and Windows, packs, and builds the consumers. Running the workflow by hand on `master` signs the packages, pushes them to nuget.org and publishes a GitHub release. +nuget.org rejects a signed package unless the certificate it was signed with is registered on the account (Account settings > Certificates), and a version it rejects cannot be pushed again: the fix is to register the certificate and publish the next version. Trusted Signing issues a new certificate every few days, so each new one has to be registered before the first release signed with it. The certificate is in the `.signature.p7s` inside each signed package, which the `packages-signed` artifact of the run holds. + ## Conventions - Default branch `master`; topic branches and PRs for anything reviewable.