如果互操作程序集签名？ [英] Should interop assemblies be signed?

问题描述

我们有一组在VC ++开发的COM组件。当提到这些组件添加到一个.net项目的Visual Studio生成一个互操作程序集。我们有一组这样的组件了。

We have a set of COM components developed in VC++. When a reference to such component is added to a .NET project Visual Studio generates an interop assembly. We have a set of such assemblies now.

在运行我们的每日构建我们签署所有产生的二进制文件的数字签名。互操作组件没有签名，因为我们不觉得我们是作家 - 任何人都可以使用Visual Studio和产生相同的组件

While running our daily build we sign all the produced binaries with a digital signature. Interop assemblies are not signed since we don't feel we are the authors - anyone can use Visual Studio and produce the same assemblies.

如果我们签署互操作程序集呢？我们也应该签下他们用强名称（SN.EXE实用程序）？究竟是什么原因这样做呢？

Should we sign the interop assemblies as well? Should we also sign them with a strong name (sn.exe utility)? What are the reasons to do so?

推荐答案

这是一个微妙的平衡一段时间。这个问题来自于，你需要与你的code的和的你可能会签署自己的组件分发您的互操作程序集的事实。如果程序集进行签名，然后所有的组件它引用也必须签署 - 包括互操作的组件。所以，你必须给他们签名。

This has been a tricky balance for some time. The issue comes from the fact that you need to distribute your Interop assemblies with your code and you may be signing your own assemblies. If you sign your assembly then all the assemblies it references must also be signed - including the Interop assemblies. So you have to sign them.

如果您正分发独立的应用程序，然后就没有风险，你应该继续和签署组件，使您的生活更轻松。

If you are distributing a standalone application then there's no risk and you should just go ahead and sign the assemblies to make your life easier.

如果您正在分发的组件库，东西都可以，因为使用库可能产生自己的互操作程序集，但用自己的钥匙签他们另一个开发商有点麻烦。这会导致各种各样的命名和依赖的问题。

If you are distributing component libraries, things can be a bit trickier since another developer using your libraries might generate their own interop assemblies but sign them with their own keys. This causes all sorts of naming and dependency issues.

根据多么复杂的互操作组件是 - 你可以生成代理code到一个单独的.CS / .vb文件，并直接编译成汇编。然后，你将不必担心强名称的问题。

Depending on how complex your Interop assemblies are - you can generate the proxy code into a separate .CS/.VB file and compile it directly into your assembly. Then you won't have to worry about strong name issues.

这篇关于如果互操作程序集签名？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！