[OpenTK] Create RPM packages for Fedora/openSUSE and derivatives (help wanted)

Thanks for looking into this!

There are two parts to the signature issue:

1. Ability to sign the assemblies. This is already implemented in OpenTK: $ mono Build.exe lib will automatically sign everything if a keyfile ("OpenTK.snk") exists in the build directory. All 1.0 binaries distributed through sourceforge are signed.
2. What keyfile should you use? .Net policy dictates that all binaries of a "product" are signed with the same key. Unfortunately, this is at odds with open-source development: you cannot add the private key to source control (because that would allow a malicious person to distribute a tampered binary without any way to detect the tampering) and you shouldn't use different keys for the same product (because that's against .Net policy and would break applications that verify the signature at runtime).

Two solutions I can think of:

• Either distribute the private key to all packagers of an application. (I have no idea what is the policy of fedora regarding this but I don't think that would work.)
• Or sign the assemblies with the fedora key and rely on the fact that mono doesn't provide a way to verify signatures at runtime (AFAIK).

What do you think? Is there an official policy on this sort of thing?

Edit: on further research, it seems that signature verification ("authenticode") is actually a different issue entirely. In light of this, it might be better to simply add the keyfile in source control. I wonder how the Tao Framework handled this issue.