Do I need to publish the public key from .snk file?

后端 未结 3 1900
太阳男子
太阳男子 2020-12-06 19:48

From the description of sn.exe utility and this question I see that a copy of the public key is added to every assembly signed with the strong name. This is enough to valida

3条回答
  •  臣服心动
    2020-12-06 20:34

    1. You can go to some 3d party certificate provider (e.g. VeriSign) and purchase a certificate from them (Code Signing At Verisign).
    2. You use given certificate that has your company name, URL, etc. on it to sign your code.
    3. I download you app, and look at the list of certificates your app was signed with.
    4. I use your certificate, go back to VeriSign and verify that the certificate has been indeed issued to MyCompany, LLC.
    5. I look at the certificates that has been used to issue your certificate, and verify that VeriSign is one of them (Windows comes with few trusted certificates installed).

    Summary:
    You not only verify that code has not been tinkered with, but also was signed with a certificate that was issued by a party you trust.

提交回复
热议问题