Pros/Cons of strong-named/signed assemblies

Question

We have a solution with many projects in it (probably 20 or more). Recently we've made some changes that require a couple of those assemblies to be callable from COM, which means we need to strong-name them. Those assemblies reference others in our project, which means they need to be strong-named as well. They also have InternalsVisibleTo attributes, so the assemblies that are granted that must also be strong-named.

Rather than hunt-and-peck trying to find just which assemblies need signing/strong-naming, I recommended we simply strong-name them all. This has put a couple of people in a tizzy about risk. I'm arguing that there is no risk, but they want pros and cons of signing assemblies. The only things I've been able to come up with are:

Pros

• It's a requirement to call the assembly from COM
• It would allow us to put the assemblies in the GAC (we don't do that now)
• It prevents tampering (we host the application, it's not installed on client sites, so not that big an issue)

Cons

• It requires that every assembly we use in the future be signed

I have two specific questions:

1. Would you say, in general, it's a good idea to sign/strong-name assemblies?
2. Can you think of any other pros or cons?

Answer 1

Your single con is bogus. It's actually a pro.

Unsigned assemblies can be used exclusively by unsigned assemblies. Signed assemblies can be used by both signed assemblies and unsigned assemblies.

Answer 2

"It's a requirement to call the assembly from COM"

You dont need to sign an assembly to make it a COM Component. I implemented a lot of COM-server without signing the assembly.

some more Cons:

• you cant update an assembly with a new version without replacing all other assemblies requiring it => no shared components easily
• can't use non signed third party components (many Free/OpenSource)
• signed assemblies in the GAC are not validated, someone evil can alter/replace your signed assembly with anything and your programs happily accept this anything link