Updated AssemblyStrongNameRule to verify public key tokens

Author: ajaybhargavb

src/NuGetPackageVerifier/CompositeRules/AdxVerificationCompositeRule.cs

@@ -20,6 +20,7 @@ public class AdxVerificationCompositeRule : IPackageVerifierRule
             new AssemblyHasProductAttributeRule(),
             new AssemblyHasServicingAttributeRule(),
             new AssemblyHasVersionAttributesRule(),
+            new AssemblyStrongNameRule(),
             new SatellitePackageRule(),
             new StrictSemanticVersionValidationRule(),
         };

src/NuGetPackageVerifier/CompositeRules/DefaultCompositeRule.cs

@@ -21,6 +21,7 @@ public class DefaultCompositeRule : IPackageVerifierRule
             new AssemblyHasProductAttributeRule(),
             new AssemblyHasServicingAttributeRule(),
             new AssemblyHasVersionAttributesRule(),
+            new AssemblyStrongNameRule(),
             new SatellitePackageRule(),
             new StrictSemanticVersionValidationRule(),
         };

src/NuGetPackageVerifier/CompositeRules/NonAdxVerificationCompositeRule.cs

@@ -12,7 +12,6 @@ public class NonAdxVerificationCompositeRule : IPackageVerifierRule
     {
         IPackageVerifierRule[] _rules = new IPackageVerifierRule[]
         {
-            new AssemblyStrongNameRule(),
             new AuthenticodeSigningRule(),
         };
 

src/NuGetPackageVerifier/PackageIssueFactory.cs

@@ -95,6 +95,11 @@ public static PackageVerifierIssue AssemblyNotStrongNameSigned(string assemblyPa
             return new PackageVerifierIssue("SIGN_STRONGNAME", assemblyPath, string.Format("The managed assembly '{0}' in this package is either not signed or is delay signed. HRESULT=0x{1:X}", assemblyPath, hResult), MyPackageIssueLevel.Error);
         }
 
+        public static PackageVerifierIssue AssemblyHasWrongPublicKeyToken(string assemblyPath, string expectedToken)
+        {
+            return new PackageVerifierIssue("WRONG_PUBLICKEYTOKEN", assemblyPath, string.Format("The managed assembly '{0}' in this package does not have the expected public key token ({1}).", assemblyPath, expectedToken), MyPackageIssueLevel.Error);
+        }
+
         public static PackageVerifierIssue NotSemanticVersion(SemanticVersion version)
         {
             return new PackageVerifierIssue("VERSION_NOTSEMANTIC",

src/NuGetPackageVerifier/Rules/AssemblyStrongNameRule.cs

@@ -4,6 +4,7 @@
 using System;
 using System.Collections.Generic;
 using System.IO;
+using System.Reflection;
 using System.Runtime.CompilerServices;
 using System.Runtime.InteropServices;
 using NuGet.Packaging;
@@ -13,6 +14,8 @@ namespace NuGetPackageVerifier.Rules
 {
     public class AssemblyStrongNameRule : IPackageVerifierRule
     {
+        private static string _publicKeyToken = "ADB9793829DDAE60";
+
         public IEnumerable<PackageVerifierIssue> Validate(
             FileInfo nupkgFile,
             IPackageMetadata package,
@@ -31,6 +34,7 @@ public IEnumerable<PackageVerifierIssue> Validate(
 
                         var isManagedCode = false;
                         var isStrongNameSigned = false;
+                        var hasCorrectPublicKeyToken = false;
                         var hresult = 0;
 
                         try
@@ -54,6 +58,13 @@ public IEnumerable<PackageVerifierIssue> Validate(
                                 {
                                     isStrongNameSigned = true;
                                 }
+
+                                var testAssembly = AssemblyName.GetAssemblyName(assemblyPath);
+                                var tokenHexString = BitConverter.ToString(testAssembly.GetPublicKeyToken()).Replace("-", "");
+                                if (_publicKeyToken.Equals(tokenHexString))
+                                {
+                                    hasCorrectPublicKeyToken = true;
+                                }
                             }
                         }
                         catch (Exception ex)
@@ -68,10 +79,16 @@ public IEnumerable<PackageVerifierIssue> Validate(
                                 File.Delete(assemblyPath);
                             }
                         }
+
                         if (isManagedCode && !isStrongNameSigned)
                         {
                             yield return PackageIssueFactory.AssemblyNotStrongNameSigned(currentFile, hresult);
                         }
+
+                        if (isManagedCode && !hasCorrectPublicKeyToken)
+                        {
+                            yield return PackageIssueFactory.AssemblyHasWrongPublicKeyToken(currentFile, _publicKeyToken);
+                        }
                     }
                 }
             }