.net - 代码签名 .NET 程序集还是只是设置？

Question

我的公司终于购买了代码签名证书。

我有一个 WinForms 应用程序(1 个 exe 和几个 dll)，所有程序集都已使用强名称进行签名。然后将整个应用程序打包到 msi 安装程序中。然后我使用 NSIS 将 msi、 Bootstrap 和先决条件(框架、SQL CE...)打包到单个 setup.exe 中。

显然我的 setup.exe 需要签名，以避免出现“可怕的”UAC 提示。这样就足够了，还是您还要对其他文件(尤其是 .NET 程序集)进行签名？

属于该应用程序的另一个项目是 Windows 服务。您会签署该集会吗？

Answer 1

您不必这样做，但这不是一个坏主意。

Authoring a Fully Verified Signed Installation

You can use these guidelines to cover an entire Windows Installer installation by a digital signature.

Authors of Windows Installer installations must adhere to the following to ensure that all parts of the installation are covered by a digital signature:

• Use internal cabinet files, or use signed external cabinet files and correctly author the MsiDigitalSignature table and MsiDigitalCertificate table.
• Use only custom actions stored within the package or installed with the package.
• Sign the installation package.
• Include an MsiPatchCertificate table in the package. To enable User Account Control (UAC) Patching, this table must contain information used to identify the signer certificates used to digitally sign patches. UAC patching enables the author of the installation package to identify digitally-signed patches that can be applied in the future by non-administrator users.

上面的说明涵盖了您需要对安装程序本身执行的操作。签署程序集取决于您，并且在某种程度上是一个单独的问题，并且具有单独的关注点和好处。请阅读Strong name assemblies can keep you out of DLL Hell有关签署程序集的更多信息。