Version 9.0.0 fails to load with 'Strong name signature could not be verified'

[philrvr]

Version 9.0.0 of the PhoneNumbers assembly fails to load from a .NET Framework ASP.NET web application running in either IIS or IIS Express. The following exception is reported:

FileLoadException: Could not load file or assembly 'PhoneNumbers, Version=9.0.0.0, Culture=neutral, PublicKeyToken=885a9d270772e1c9' or one of its dependencies. Strong name signature could not be verified. The assembly may have been tampered with, or it was delay signed but not fully signed with the correct private key. (Exception from HRESULT: 0x80131045)

   System.Reflection.RuntimeAssembly._nLoad(AssemblyName fileName, String codeBase, Evidence assemblySecurity, RuntimeAssembly locationHint, StackCrawlMark& stackMark, IntPtr pPrivHostBinder, Boolean throwOnFileNotFound, Boolean forIntrospection, Boolean suppressSecurityChecks) +0
   System.Reflection.RuntimeAssembly.InternalLoadAssemblyName(AssemblyName assemblyRef, Evidence assemblySecurity, RuntimeAssembly reqAssembly, StackCrawlMark& stackMark, IntPtr pPrivHostBinder, Boolean throwOnFileNotFound, Boolean forIntrospection, Boolean suppressSecurityChecks) +232
   System.Reflection.RuntimeAssembly.InternalLoad(String assemblyString, Evidence assemblySecurity, StackCrawlMark& stackMark, IntPtr pPrivHostBinder, Boolean forIntrospection) +113
   System.Reflection.RuntimeAssembly.InternalLoad(String assemblyString, Evidence assemblySecurity, StackCrawlMark& stackMark, Boolean forIntrospection) +23
   System.Reflection.Assembly.Load(String assemblyString) +35
   System.Web.Configuration.CompilationSection.LoadAssemblyHelper(String assemblyName, Boolean starDirective) +49

We're also seeing the same issue running xUnit tests from TeamCity.

I've attached a sample ASP.NET MVC application (LibPhoneNumberWebTest.zip) that demonstrates the issue. It's configured to use IIS Express. Open the solution in Visual Studio 2022, then compile and run the project. The exception will be raised on the first request to the root URL.

The MVC application works without issue if the libphonenumber-csharp NuGet dependency is downgraded to the previous release (version 8.13.55).

Version 9.0.0 added strong name signing in #288.

The public key token that's expected matches the assembly file:

sn -Tp bin\PhoneNumbers.dll

Microsoft (R) .NET Framework Strong Name Utility  Version 4.0.30319.0
Copyright (c) Microsoft Corporation.  All rights reserved.

Public key (hash algorithm: sha1):
0024000004800000940000000602000000240000525341310004000001000100bd3070027f51a9
975cac34376755e3629985626c0ccbb41bb057f7d06dd6940dafb35ed0358fd96f24525cde3229
cecc6fc9eb3bf582ecb6cf3a837f422d38fe2f5d2d7d0b75a5fe9120c77d3a0d25b9b60060cd71
5146920d675b6f639bcf9845bcf0f42070caca24be55143958dcc4eaa7e4e2941ecf2fab4ba479
aaee8dc2

Public key token is 885a9d270772e1c9

I suspect this error is occurring because the PublicSign option has been used:

libphonenumber-csharp/csharp/PhoneNumbers/PhoneNumbers.csproj

Line 35 in d55efb6

<PublicSign>true</PublicSign>

[twcclegg]

Thank you for the report. Based on the link it does seem like the PublicSign likely is the issue. I'll take a look.