Code Signing CLI tool supporting Authenticode, NuGet, VSIX, and ClickOnce
C-Rank Grade: A (Welcoming) - 66/100
External PR Merge Rate: 52%
Response Time: -
First Timer Success: 67%
dotnet/sign has a recorded first-timer success rate of 66.7%. Repositories ranked A typically provide actionable feedback during code reviews and actively nurture new community contributors.
Maintainers in dotnet/sign respond to incoming external pull requests in approximately 0.0 hours on average. Keeping PRs focused on single tasks and ensuring tests pass helps maintainers review faster.
The C-Rank™ system evaluates GitHub projects on a 0–100 scale using real data: PR merge rates, review turnaround time, active maintainer presence, and first-time contributor success. A score of 65.8 places dotnet/sign in the A tier.
The external contributor pull request merge rate for dotnet/sign is 52.4%, based on public PR activity from non-core contributors.
dotnet/sign currently has 3 active issue(s) tagged with beginner-friendly labels like "good first issue", "beginner", or "up-for-grabs".
Balanced & professional review environment in dotnet/sign. Maintains strict focus on technical quality and test standards.
Average Response Latency
Tracks hours until a maintainer leaves a review, comment, or PR response.
External Acceptance Rate
Percentage of community pull requests successfully merged into main.
First PR Conversion
Rate at which developers submitting their first repository PR succeed.
Show contributors that your repository actively reviews and merges external pull requests.
[](https://getmerged.abhishekco.de/dotnet/sign?utm_source=github&utm_medium=badge)
Historical health & responsiveness evolution
External PR acceptance
First PR success rate
50% receive response in
90% receive response in
Maintainer review activity heatmap & prime window prediction
Calculating local time...
Calculating local time...
Detected: UTC
Maintainers are most responsive around 19:00 UTC (19:00 UTC in your timezone). Recommended submission window is Monday - Wednesday from 19:00 to 23:00 UTC (19:00 - 23:00 UTC local).
Maintainer Strategy: Maintainer Sweet Spot: PRs under 150 lines merge in ~16 hours (65% approval). Large PRs (>500 lines) take ~115 hours (24% approval). Keep your diff compact for rapid review.
Is your feature request related to a problem? Please describe. We recently had a bug reported for a Blazor nuget package that was causing an integrity conflict and failure during development when that package was consumed (reference: IgniteUI/igniteui-blazor#267) Since by default, the sign tool treats NuGet packages as archives/containers and strives to apply code-siging practices to as many of the contents as possible, the problem is that for ASP.Net Core / Blazor-related NuGet packages that contain static web assets - .js files - the integrity of each file is recorded at build time in the Microsoft.AspNetCore.StaticWebAssets.props file. However, if using the sign tool's default options, the .js asset files get changed and in development mode, the SHAs of the signed .js files mismatches those of the pre-recorded SHAs of the files prior to signing. Describe the solution you'd like I can imagine that considering .js files to be static web assets or WSH scripts is out of scope of the sig
Currently, it appears there is no option to specify a certificate version when using key vault. AzureSignTool allows for this via -kvcv Add certificate version option (-kvcv) when using azure-key-vault
Is your feature request related to a problem? Please describe. Since dealing with .rdp files is getting more strict in terms of security, it would be helpful to be able to sign these files too. (https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/understanding-security-warnings) Describe the solution you'd like Be able to sign .rdp files too Describe alternatives you've considered There is a signing tool for RDP files, but this doesn't work with Trusted Signing or Key Vault. (https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rdpsign) Additional context 0.9.1-beta.26179.1+21990c8ec7ace15c7dcf334de241016627380ac0
Describe the bug If there is a content file containing octothorpe symbol (#) inside of an OPC package, sign CLI exits without any errors and outputs an invalid signed file. This seems to happen because this symbol denotes fragment URI component, which is not handled in any way when creating manifest references. I attempted to fix this issue by modifying cli code to URL encode the '#' symbol during signing process, however this approach did not work since System.IO.Packaging.PackageDigitalSignatureManager.VerifySignatures() does not perform URL-decoding while resolving OPC references. I wonder about how this symbol could be handled in OPC file formats in general. I know that at least a part of them simply do not allow this symbol. However, on the other hand - octothorpe is a completely valid symbol in Windows filesystem. Repro steps Create a vsix package, which includes a file named ab#c.txt with a test string inside. Sign the file using the sign cli (and see that it exits without any
Describe the bug When using sign code azure-key-vault: we have to provide a list of files, even when a --file-list parameter is provided when we provide a list of files, the --file-list parameter seems to be simply ignored the example in the docs folder specify both a '*' as the list of files an a --file-list there is no documentation about the relationship between these two parameters Repro steps sign-list.txt: myapp.exe my.*.dll dir: myapp.exe my.first.dll my.second.dll other.dll Only file-list not accepted: sign code azure-key-vault ` > -fl "D:\code\project1\sign-list.txt" ` > --base-directory "D:\code\project1\bin\Release\net10\" ` > --azure-key-vault-tenant-id "xxx" ` > --azure-key-vault-client-id "yyy" ` > --azure-key-vault-client-secret "zzz" ` > --azure-key-vault-url "https://xxx.vault.azure.net/" ` > --azure-key-vault-certificate "foo" ` > -d "My App" ` > -v Information ` Required argument missing for command: 'azure-key-vault'. wildcard results in all files signed (file-
Rate what actually matters after opening a pull request here.
Rate your first-hand PR experience (review speed, maintainer responsiveness, and onboarding ease) to help other contributors.
When evaluating whether to contribute to dotnet/sign, response velocity and maintainer engagement are crucial. GetMerged continuously tracks pull request trajectories, first-comment latency, and code review rounds to help developers avoid submitting pull requests to backlogged repositories.
Currently, maintainers of dotnet/sign acknowledge new external contributions in approximately -. Out of all submitted pull requests from non-core authors in the last 180-day window, 52.4% were successfully merged into the primary branch.
dotnet/sign has a recorded first-timer success rate of 66.7%. Repositories ranked Welcoming typically provide actionable feedback during code reviews and actively nurture new community contributors.
The initial maintainer response time averages ~-. Keeping PRs scoped to single concerns and ensuring CI checks succeed will optimize review turnaround.
The C-Rank™ index scores repositories on a 0 to 100 scale using an objective formula: external PR merge rates, initial response speed, active maintainer count, and first-time contributor retention. A score of 65.8 places dotnet/sign in the Welcoming tier.
The external pull request merge rate is 52.4%. GetMerged isolates non-core community contributions so external developers get an accurate benchmark of PR acceptance probability.
Yes, dotnet/sign currently has 3 active issue(s) tagged with beginner-friendly labels. You can inspect these directly from the repository issues tab.
All metrics displayed for dotnet/sign are automatically retrieved via the public GitHub API and recalculated daily. Insider pull requests submitted by repository owners or organization members are excluded from merge rate calculations to preserve objective external contributor statistics.