Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add option to force replace strong name on some assemblies #34

Open
augustoproiete opened this issue Nov 1, 2018 · 0 comments
Open

Comments

@augustoproiete
Copy link

It would be very useful if we could force replacing the strong name of some referenced assemblies.

Example scenario:

Deploying an assembly to SQL Server / SQL CLR

In order to deploy an assembly to SQL Server, the assembly must have a strong name, and we need to create an asymmetric key for every different strong name public key in every assembly referenced (as they have to be added to SQL Server too).

e.g.:

  • MyCompanyAssembly.dll (signed with MyCompany.snk)
  • OpenSourceLibraryANotSigned.dll (signed with MyCompany.snk via StrongNamer)
  • ClosedSourceVendorLibraryBSigned.dll (signed with their private ProjectB.snk)
  • OpenSourceLibraryCSigned.dll (signed with their public ProjectC.snk)
  • OpenSourceLibraryDSigned.dll (signed with StrongNamer's SharedKey.snk, by the maintainer)
  • ...

Based on the examples above, we'll need to create 4 asymmetric keys in SQL Server. One for each different strong name key file.

Besides the extra work, it brings security concerns as we're now enabling SQL Server to allow the registration of any assembly that is signed with one of these keys, some of which are publicly available.

In this scenario, it would be ideal to have StrongNamer replace the strong name on all of these referenced assemblies with MyCompany.snk, which would make the deployment a lot simpler as only one asymmetric key would be needed in SQL Server, and it's the one we trust.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant