Digitally signing a strong named .NET assembly

4
votes

I have a .NET assembly which I've strongly named, to put it in the GAC. However, the same assembly is also digitally signed using a .pfx file later on, for digital signature.
I've noticed that this assembly, which has been so dual signed, fails the strong name validation, and does not install in the target machine's GAC.

Could it be possible that the digital signing procedure removes the SN-key generated strong naming procedure?

The digital signature is essential and if the 2 are not compatible, then can the file be signed by the .pfx file instead, as easily as the SN-naming process?

Also, the assembly is in C++/CLI, not in C#.

EDIT : Looking at MSDN Documentation, it says if using linker options for strong naming, and if using a post process tool likemt.exe (I'm not sure if Signtool.exe falls amongst these tools), the assembly would need to be resigned.

Also, this statement :

If you use the signing attributes when building in the development environment, you can successfully sign the assembly by explicitly calling sn.exe (Sn.exe (Strong Name Tool)) in a post-build event.

...is slightly confusing. Which attributes is it referring to, the CLR attributes, or Linker options?

2
.netc++-clidigital-signaturestrongnameauthenticode

2 Answers

4
votes

They are compatible and should be applied in a specific order:

  1. Strong name (sn.exe)
  2. Authenticode/code sign/digital signature (signtool.exe)

I do this regularly without any problems with C# assemblies. I am not aware that this would be different for c++.

This works because the strong name hash code does not include certain parts of the PE header, including the authenticode hash. As is explained here here.

0
votes

We build a few C++/CLI assemblies. We use the linker switches:

  • /KEYFILE - to select the snk file with the public key
  • /DELAYSIGN - to specify delay signing

Then, in a post-build event, we call sn.exe to apply test signing

Later, just before including the assembly in a merge module, we call:

  • sn.exe - to apply the real strong name signature
  • signtool.exe - to apply the Authenticode signature

You should be able to use just /KEYFILE to specify the snk file holding your keypair and then just call signtool to do the Authenticode signature.

Unless you are using some other post-build tool, that should do it.