Search code examples
c#.netassembliesversioningstrongname

Does the version of dependent assemblies is stored in the referring assembly?

The following saying is quoted from this article in MSDN.

... strong-name signing makes servicing more complicated. Under current versioning policy, an assembly will always attempt to load the exact version of the assembly it was built against. If, for example, your application was built against version 1.0.0.0 of a strong-named assembly and you fix a bug in the assembly, bumping the version number to 1.0.0.1, the existing application will not find the updated assembly.

Now, suppose that two strong-named assemblies (written in C# or VB.net), namely X and Y, exist and X depends on Y.

  1. Does the version of Y is stored somewhere in X in compile time?
  2. Does the public key used in Y is stored somewhere in X to avoid code change attacks?
  3. If the version of Y is checked when CLR loads it, what happens if Y is loaded dynamically and there is no compile time referencing?

Please post references in your answers, if possible.

Solution

  • You can reference Strong Named Assembly either at compile or run time.

    Compile time:

    When you use compile-time referencing, the compiler automatically gets the public key of the targeted strong-named assembly and places it in the assembly reference of the assembly being compiled.

    So it would be stored in the assembly manifest:

    Information on referenced assemblies: A list of other assemblies that are statically referenced by the assembly. Each reference includes the dependent assembly's name, assembly metadata (version, culture, operating system, and so on), and public key, if the assembly is strong named.

    Run time:

    When you make a run-time reference to a strong-named assembly (for example, by using the Assembly.Load or Assembly.GetType method), you must use the display name of the referenced strong-named assembly. The syntax of a display name is as follows:

    <assembly name>, <version number>, <culture>, <public key token>

    Obviously here is you should specify verison manually in run time.

    See How to: Reference a Strong-Named Assembly