Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / .NET Framework / CLR / June 2004

Tip: Looking for answers? Try searching our database.

Q: assembly signing

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Jiho Han - 08 Jun 2004 22:47 GMT
Ok, this may be a stupid question but do I need to generate public/private
key pair for each assembly in a single solution?

I am thinking about delay-signing and that'd mean the "signer" must maintain
the key pair for every single assembly separately.  Is this how it's
supposed to be done?

Also, this is kind of on a side note.  I've read somewhere that having a
single combined assembly is better than many smaller separate assemblies -
assuming all assemblies involved are always updated at the same time -, is
this true?  I can understand why from file access point of view(single file
= less frequent fs access, many files = more frequent fs access but then
that single file may be huge).  If employing the combined assembly strategy,
do I need to genereate netmodules for each contained assemblies instead or,
is there a way to combine already generated assemblies into one?

Thanks much in advance.
Jiho
Jacek - 09 Jun 2004 08:38 GMT
> Ok, this may be a stupid question but do I need to generate public/private
> key pair for each assembly in a single solution?
>
> I am thinking about delay-signing and that'd mean the "signer" must maintain
> the key pair for every single assembly separately.  Is this how it's
> supposed to be done?

Assembly signing is supposed to identify assembly publisher and protect
assemblies from being modified by anyone except for publisher having access
to its private key. The consequence of this is that unless someone wants to
run into mess of managing hundreds of keypairs the best practice is to have
one official keypair. Obviously some additional keypairs can be used
internally for testing.

> Also, this is kind of on a side note.  I've read somewhere that having a
> single combined assembly is better than many smaller separate assemblies -
> assuming all assemblies involved are always updated at the same time -, is
> this true?  I can understand why from file access point of view(single file
> = less frequent fs access, many files = more frequent fs access but then
> that single file may be huge).

It depends on the usage scenario: if your app does not use all types
declared in assembly it is better to keep them in separate assemblies or
modules of multimodule assembly  - they will be loaded only when type
defined in given assembly or module is called. This obviously will improve
performance for large assemblies.
If someone decides to use single assembly he gets lower overhead of reading
metadata, higher security (modules in mutlimodule assembly are not
StrongName signed - they are referencing main module and are referenced by
hash values only), and easier deplyment.

> If employing the combined assembly strategy,
> do I need to genereate netmodules for each contained assemblies instead or,
> is there a way to combine already generated assemblies into one?

Check for Module Linking by Round Tripping chapter in "Inside Microsoft .NET
IL Assembler" book by Serge Lidin or
http://www.gotdotnet.com/userarea/keywordsrch.aspx?keyword=Lame%20Link tool.

Hope this helps.

Jacek
Jiho Han - 09 Jun 2004 14:47 GMT
Excellent.  Thanks for the clarification.

Jiho

> > Ok, this may be a stupid question but do I need to generate public/private
> > key pair for each assembly in a single solution?
[quoted text clipped - 41 lines]
>
> Jacek

Rate this thread:







Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.