log4net.snk.readme

Apache log4net Strong Name Key Readme
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The log4net release builds are strongly named using the log4net.snk key 
file.  This key is different from the key used to sign log4net 1.2.10
and earlier releases.

Starting with log4net 1.2.11 we've decided to use a key that we don't
keep secret so you can build a drop-in replacement for an official
release yourself.  This means that the strong name of a log4net
assembly no longer provides any means of checking its authenticity.
The only way to ensure you are using an official release by the Apache
Software Foundation is by downloading the distribution from the Apache
log4net download page and verifying the PGP signature of the ZIP
archive.

The key used to sign those older releases is not and has never been
distributed as part of the log4net source or binary downloads.

In order to make it easier to migrate from log4net 1.2.10 to newer
releases log4net 1.2.11 we also provide builds using the key used to
sign 1.2.10.  We may stop distributing these alternative builds in the
future.

You should use the binary builds signed with log4net.snk for new
projects and only use the ones signed with "the old key" if switching
to the newer builds is not possible because other parts of your
project depend on the old strong name.