Geek Answers Handbook

Pros / Cons of Strong Names / Signed Builds

We have a solution with many projects (maybe 20 or more). We recently made some changes that require a couple of these assemblies to be called from COM, which means we need their strong name. These assemblies refer to others in our project, which means that they must also be strongly named. They also have InternalsVisibleTo attributes, so the provided assemblies must also be strong.

Instead of searching and trying to find which assemblies need to be signed / strongly named, I recommended just to simply name them all. This put a couple of people in silence about the risk. I affirm that there is no risk, but they need the pros and cons of signing the meetings. The only thing I managed to come up with was:

Arguments

  • Requirement to call assembly from COM
  • This would allow us to put assemblies in the GAC (we don’t do it now)
  • This prevents (we accept the application, it is not installed on client sites, so it’s not a big problem).

against

  • This requires that every assembly we use in the future be signed.

I have two specific questions:

  • Could you say that it is a good idea to sign / strong names?
  • Can you think of any other pros or cons?
+8
source share
3 answers

Your only title is fictitious. This is actually a professional.

Unsigned assemblies can be used exclusively by unsigned assemblies. Signed assemblies can be used by both signed assemblies and unsigned nodes.

+5
source share
  • It is a ClickOnce requirement that your assemblies be signed
  • Many open source projects do not distribute signed assemblies and are often not trivial to compile with your own SNK.
+3
source share

"Requiring assembly invocation from COM"

You do not need to sign the assembly to make it a COM component. I implemented a lot of COM server without signing the assembly.

some more minuses:

  • You cannot update an assembly with a new version without replacing all other assemblies requiring this => without common components.
  • cannot use unsigned third-party components (many Free / OpenSource)
  • signed assemblies in the GAC are not checked, someone can change / replace the signed assembly with anything, and your programs will gladly agree to this link
+2
source share

More articles:


All Articles