签署应用程序集的风险
我们考虑将我们的程序集之一放入 GAC 中以进行版本控制。 这意味着必须对该程序集进行签名，并且它使用的每个其他程序集（例如第 3 方）也必须进行签名。只有第 3 方供应商可以进行签名。是否存在某些供应商不提供签名版本而我们限制自己的实际风险？
We consider to put one of our assemblies in the GAC for the purpose of versioning.
This means this assembly must be signed and each other assembly it uses (e.g. 3rd party) must also be signed. Only the 3rd party vendor can do the signature. Is there a practical risk that some vendors will not supply a signed version and we are limitting ourselves?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
该风险不适用。
仅当程序集仅依赖于其他 GAC 程序集时，您才能将其放入 GAC 中。
所以您的第 3 方库应该已经在 GAC 中。
如果不是，您可以伪造它（请参阅@Preet Sangha），但随后您将成为这些库的发布者。并且与其他应用程序共享这些二进制文件将不会发生。
The risk is not applicable.
You can only put an assembly in the GAC if it depends only on other GAC assemblies.
So your 3rd party libs should already be in the GAC.
If they are not, you can fake it (see @Preet Sangha) but then you become the publisher of those libs. And sharing those binaries with other apps will (can) not happen.
您始终可以使用 ilmerge 签署第三方协议。
我的博客上有一个链接： http://preetsangha.blogspot .com/2007/10/signing-third-party- assembly.html
You can always sign a third party one with ilmerge.
there's a link on my blog here: http://preetsangha.blogspot.com/2007/10/signing-third-party-assembly.html
是的，存在风险，但如果第三方供应商适合 GAC，则应与其签署。如果没有，您应该能够要求他们签名。
IMO，这是一种风险，但不是主要风险，特别是如果您有一个可以验证是否已全部签名的现有解决方案。
Yes there is a risk, but 3rd Party vendors should be signed if they are appropriate for the GAC. You should be able to ask for them to be signed if they are not.
IMO, it is a risk, but not a major one, especially if you have an existing solution that you can verify is all signed.