问题描述
这是什么意思签署程序集？为什么它做什么？
What does it mean to sign an assembly? And why is it done?
什么是签署它最简单的方法？什么是？
What is the simplest way to sign it? What is the .snk file for?
推荐答案
另外两个答案都很好，但一个附加点.snk文件。这是很容易得到证书签名和强名称签署的困惑。
The other two answers are fine, but one additional point. It is easy to get confused between "certificate" signing and "strong name" signing.
强名称签名的目的是为斯特凡Steinegger说：让你的客户建立他们认为他们确实加载代码恰恰是他们的代码加载。这是所有强名称是。具体而言，强大的名称不的确定的任何类型的客户和你们之间的信任关系。如果客户决定，他们相信来自于你的代码，它是由他们来弄清楚到底是什么正确的强名称是你的代码。该密钥管理问题不是出在解决任何方式;客户有搞清楚如何知道该相信哪个键的负担。
The purpose of strong name signing is as Stefan Steinegger says: to allow your customer to establish that the code they THINK they're loading really is precisely the code that they ARE loading. That is ALL strong names are for. Specifically, strong names do not establish any kind of trust relationship between your customer and you. If the customer decides that they trust code that comes from you, it is up to THEM to figure out exactly what the correct strong name is for your code. The "key management" problem is not in any way solved; the customer has the burden of figuring out how to know what key to trust.
证书签名，也就是说，你从Verisign或其他认证机构获得证书签名，具有复杂得多的目的。证书签名的目的是建立一个从证书颁发机构的信任和身份的验证环比回落到签署了代码的组织。您的客户可能不信任你，你的客户可能没有连的听到的你，但你的客户可以说，如果威瑞先天不足这个代码，那么我会信任他们的作者的身份。密钥管理问题归结为客户，因为发证机关已采取上负担他们。
Certificate signing, that is, signing with a certificate you get from Verisign or some other certifying authority, has a much more complex purpose. The purpose of certificate signing is to establish an authenticated chain of trust and identity from the certifying authority down to the organization which signed the code. Your customer might not trust you, your customer might not have even heard of you, but your customer can say "if Verisign vouches for the identity of the author of this code, then I will trust them". The key management problem is reduced for the customer because the certifying authority has taken on that burden for them.
这篇关于签名组件 - 基础知识的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！