Re: Verifying Signed Files Downloaded via HTTP

From: Nicole Calinoiu (calinoiu)
Date: 06/27/05 

Date: Mon, 27 Jun 2005 08:39:18 -0400

"DaveW" <david_wender@yahoo.com> wrote in message
news:1119638456.924177.55680@g47g2000cwa.googlegroups.com...
>I have created a Launcher Application to automatically update files for
> my main application before the main application starts. The launcher
> checks a XML file on a server to see a list of files/versions that are
> associated with the main application and will automatically download
> new versions.
> All DLLs and EXEs are strong named and signed with a Authenticode Code
> signing certificate.
> It seems that some clients are now encountering Strong Name exceptions
> after downloading new versions.

What is the exact exception type and message? (The full output of the
exception's ToString method would be best, if you can provide it.)

> I am trying to figure out whether they are getting these exceptions
> because the downloaded file was somehow corrupted during the file
> transfer. If so, is there any way to verify that a file has a valid
> signature after it is downloaded so that I can attempt to re-download
> if there are problems?

Attempt to load the assembly using Assembly.Load, Assembly.LoadFrom, or
Assembly.LoadFile. If the file is corrupt, simply loading the assembly in
this way will cause an exception to be thrown even before any attempt is
made to call code within the assembly.

> Another thing to note is that I renewed my Digital Certificate on
> 6/6/05 but I have not rebuilt the SNK with new new certificate.

There's no need. The two signing mechanisms are completely independent of
one another.

> I don't
> know much about how these certificates work, but I'm wondering if there
> is some sort of random verification going on that is failing because
> the old certificate may be expired.

It would be rather surprising to see exceptions related to the strong name
being thrown because of any problem with the authenticode signature. A
couple of more likely causes might be the following:

1. The assemblies are delay-signed rather than fully signed.
2. An unexpected/incorrect version of a dependant assembly is being used by
the client.

>
> Any help would be greatly appreciated.
>
> Thanks.
>

Relevant Pages

  • RE: C# Exceptions
    ... signature is valid then the app can decrypt the response and process it. ... exceptions as in: catch or catch ... possible to patch system assemblies. ... do code execution via the stack would be if the target app used ...
    (Pen-Test)
  • Re: Assembly conversion to Pocket Pc format
    ... string strfilename = ... for .NET assemblies, i.e. it is simply passing them through unmodified. ... rather I want to download from HTTP or HTTPS. ...
    (microsoft.public.dotnet.framework.compactframework)
  • RE: Intermittent MissingFieldException
    ... Microsoft Online Support ... |> asp.net application's private bin path. ... |> for those assemblies. ... |> | Attempting download of new URL ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: re:using System.DirectoryServices.dll assembly
    ... You need the assemblies full name: ... > specific parse error details and modify your source file ... Attempting download of new URL ... > Posted Via Usenet.com Premium Usenet Newsgroup Services ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Question about embedded winform controls
    ... You cannot acces the local filesystem from an embedded windows user control. ... Downloaded assemblies are placed in the download ... You can change the security policy for the assembly that you download. ...
    (microsoft.public.dotnet.framework.aspnet)