What does it mean to sign an assembly? And why is it done?
What is the simplest way to sign it? What is the .snk file for?
Share
Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
What does it mean to sign an assembly? And why is it done?
What is the simplest way to sign it? What is the .snk file for?
The other two answers are fine, but one additional point. It is easy to get confused between “certificate” signing and “strong name” signing.
The purpose of strong name signing is as Stefan Steinegger says: to allow your customer to establish that the code they THINK they’re loading really is precisely the code that they ARE loading. That is ALL strong names are for. Specifically, strong names do not establish any kind of trust relationship between your customer and you. If the customer decides that they trust code that comes from you, it is up to THEM to figure out exactly what the correct strong name is for your code. The “key management” problem is not in any way solved; the customer has the burden of figuring out how to know what key to trust.
Certificate signing, that is, signing with a certificate you get from Verisign or some other certifying authority, has a much more complex purpose. The purpose of certificate signing is to establish an authenticated chain of trust and identity from the certifying authority down to the organization which signed the code. Your customer might not trust you, your customer might not have even heard of you, but your customer can say “if Verisign vouches for the identity of the author of this code, then I will trust them”. The key management problem is reduced for the customer because the certifying authority has taken on that burden for them.