c# - 代码签名应该放在构建/发布过程中的什么位置？

Question

我最近才对能够签署可执行文件感到高兴。现在，我正尝试在我们的构建/发布过程中建立一个适当的位置，在该位置应该对程序集进行签名。

我的第一直觉是尽早签名(在构建后事件中)以确保签名的内容符合构建者的预期。

但这将(在我们的例子中)要求每个开发人员都拥有对私钥的完全访问权限，这可能是不可取的。

另一个想法是仅在我们发布时才签名，这样签名很少由少数人执行。但那太晚了吗？

是否存在最佳实践？

Answer 1

Delay Signing an Assembly :

An organization can have a closely guarded key pair that developers do not have access to on a daily basis. The public key is often available, but access to the private key is restricted to only a few individuals. When developing assemblies with strong names, each assembly that references the strong-named target assembly contains the token of the public key used to give the target assembly a strong name. This requires that the public key be available during the development process.

You can use delayed or partial signing at build time to reserve space in the portable executable (PE) file for the strong name signature, but defer the actual signing until some later stage (typically just before shipping the assembly).