Assembly strong name signing

[ProclaimDragon]

Most of the times I run FxCop on my applications/libraries I always have this "error" about signing the application with a strong name key...

What exactly is this?

What is it's purpose?

Should I use it?

Why do I need it?

[ProclaimDragon]

Anyone?

[Kami-]

Don't understand the original query, perhaps rephrase it?

I know English isn't your first language, but it really is hard to understand your requirements.

[Eric Veteran]

Signing an assembly with a strong name allows you to add it to the global assembly cache and will let others know with reasonable certainty where the module came from. You can have Visual Studio automatically generate a key and sign it or you can use the "SN" utility in the Framework SDK to generate one and add it yourself with attributes. Look in an AssemblyInfo.XXX file from C# or VB for comments on the signing key. Normally you wouldn't sign an assembly that you're still developing unless it is shared and you have to test it that way.

[ProclaimDragon]

I must be really stupid because I still don't get it...

@F7S

I don't see what's so confusing about my post, I just want to understand the whole concept behind signing my application with a strong name key.

[Eric Veteran]

Your post isn't confusing to me, but please tell us what's confusing you still?

Perhaps this MSDN article might help? CLR Inside Out: Using Strong Name Signatures

Basically the signing gives your specific assembly a unique name so the CLR can't confuse it with a different assembly or different version. It can also be tested to make sure it isn't modified. You don't have to sign them if your exe or dll will be stand-alone. (i.e.: not used as a global file that many applications access from the GAC.)

[ProclaimDragon]

(...)and will let others know with reasonable certainty where the module came from.

It can also be tested to make sure it isn't modified.

From the article:

Strong names prevent spoofing of your code by a third party.

Without access to the private key, a malicious user cannot modify your code and successfully re-sign it.

What I don't understand is how all these things work by just signing the assembly...

[ultraviolet7]

From the article:

What I don't understand is how all these things work by just signing the assembly...

http://en.wikipedia.org/wiki/.NET_assembly#Assembly_names

http://msdn.microsoft.com/en-us/library/wd40t7ad.aspx