Strong name needed for assemblies referencing an unsigned project?

Question

I am working on a WCF service. The WCF service interface and implementation are in separate projects. There is also a Windows service project to host the WCF service.

One of the things that the WCF service implementation must do is invoke several external ( SOAP ) web services. As we usually structure this, we create a separate class library project for SOAP services; we will create a web link and a factory / helper method in the class library.

The above item may or may not be appropriate for a real problem. This is what I get an error when creating a WCF service deployment project (where X is one of the assemblies of the SOAP service assembly):

assembly reference 'X' does not have a strong name

But the WCF service implementation project is not set up for signing (and is not an interface project). And at the moment, only two things that reference it are the Windows service project and the unit test project, and not one of them is signed.

The WCF implementation also refers to other (pre-existing) web services wrapper projects, but it only complains about these two. I fixed the existing and new project file in a text editor side by side ... And I see significant differences.

I also checked if any of the projects is importing a parameter that requires its signing, as described in the Remove signature from assembly question. This does not seem to be the case.

I tried to use AutoMapper - 1.1, since we are still on .NET 3.5 - in my WCF implementation. This is a signed assembly, so I can see where there might be a problem with my code and SOAP service wrappers. But it seems to me that this will be a runtime issue, not a build time. But since I suspected this might be at least a factor, I removed AutoMapper and its dependent code, but I still get the same error.

I investigated the problem, most of the search results consist of instructions on how to sign (possibly third-party) assemblies.

I tried removing and re-adding links, restarting Visual Studio and my computer.

Visual Studio 2010 / .NET 3.5 on Windows and 7 64-bit editions.

I'm sure I'm missing something pretty obvious ... I just can't understand that.

Answer 1

Well ... that's awkward.

As I suspected, it was something simple. The interface and service implementation were actually signed; I was wrong about that. However, this was not done in the project settings / file, but in the AssemblyInfo.cs file, through the [assembly: AssemblyKeyFile("keyfile.snk")] directive.

I was not familiar with this signature method. I believe that it has been deprecated since VS2005 - partly because it is easier to manage the signature through the project properties, partly because placing this information in AssemblyInfo is considered a security risk.

And I actually looked at least one of the AssemblyInfo files ... but apparently I did not scroll far enough. (I said this is embarrassing.)

I hope this helps someone.

Answer 2

You cannot reference an unsigned assembly from a signed assembly; a project that fails to build should be someone who has a strong key key attached to it.

Perhaps you have a signed version of one of your links in the global assembly cache, which MSBuild selects instead of the link you selected.