Home/ Questions/Q 3843344
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-19T15:55:28+00:00

Every now and then I see a sample project on the network which contains

  • 0

Every now and then I see a sample project on the network which contains a .snk file used for signing the compilation results with a strong name.

AFAIK this is plain wrong – once a .snk file is disclosed anyone can produce an assembly that can be used to replace an assembly shipped by the original code supplier but now containing malicious code. I suppose that people shipping .snk files don’t treat that risk seriously and just ship the file because otherwise the project wouldn’t compile off-the-shelf.

Is there any reason for shipping the .snk file except that “convenience”?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    A very valid question. I for my part do not ship the SNK file but do provide instructions how to produce one yourself and make the required changes (to enable InternalsVisibleTo for instance).

    I think that the current practice has been pushed my Microsoft with the changes in the SNK handling starting with VS2005. Using a key container requires a manual edit of the CSPROJ file with an undocumented MSBUILD item KeyContainerName… the default of VS is to copy the SNK into the project directory, which is convenient but wrong IMHO.

    • 0