Making DLLs Globally Available

For a DLL to be available to more than one Web application, the DLL needs to be installed in the Global Assembly Cache (GAC). Before a DLL can be installed in the GAC it must be digitally signed. A digital signature is created by running the compiler with certain attributes set. The compiler gathers information about the DLL (this is called creating a hash of the DLL) and uses a private/public key file to encrypt it. This information becomes a digital signature and gets embedded into the resulting DLL. The public key is published as part of the metadata for the DLL. The runtime uses the public key to decrypt the information in the signature, and then compares the file hash to the current DLL file to see if any tampering occurred.

To digitally sign a DLL and add it to the GAC:

Create a Class Library Project.
From the Start menu select All Programs > Microsoft Visual Studio .NET > Visual Studio Tools > Visual Studio .NET Command Prompt.
In the command prompt window, change the current directory to the directory of the class library project (use the cd command to do so).
Type sn -k mykey.snk , where mykey.snk is any name to give to your private/public key file ( Figure 13.8 ).

Figure 13.8. The resulting .snk file contains a private and public key pair. This is the file that you want to keep in a safe place. If the bad guys get hold of this file, they can tamper with the code in the DLL.
Back in the class library project, double-click on the AssemblyInfo.cs file in the Solution Explorer.
In the AssemblyKeyFile attribute, type the complete path to the digital signature file, for example: [assembly: AssemblyKeyFile(@"c:\prep\BankLib\mykey.snk")] ( Figure 13.9 ).

Figure 13.9 The Assembly.cs file contains attributes that apply to the entire project. In this case we're setting the path of the public/private key, the compiler will use the private portion to create a digital signature to protect the file.
```
 [assembly: AssemblyDelaySign(false)]  [assembly:   AssemblyKeyFile(@"c:\prep\BankLib\mykey.snk")]  [assembly: AssemblyKeyName("")] 
```
Select Build > Build Solution from the menu bar.
Back in the command prompt window, switch directories to the directory where the DLL was generated; usually this is done as follows : cd bin\debug .
Type gacutil -i nameofdll.dll where nameofdll.dll is the name of the DLL ( Figure 13.10 ).

Figure 13.10. Once a DLL has been digitally signed, you can move it to the GAC. This means that every Web application can then share the same copy of the DLL. You can either transfer the file visually by dragging it to the Windows\Assembly directory, or you can do it manually with the gacutil tool that ships with the .NET Framework.

Tips

You can view all of the DLLs in the GAC by opening Windows Explorer and switching to the Windows\Assembly directory. You should see something like what you saw in Figure 13.7 .
When you digitally sign an assembly, the assembly gets a public key token, also known as the originator or the strong name for the assembly. Figure 13.11 highlights the public key token column.

Figure 13.11. The Public Key Token is useful in identifying the DLL (or assembly). Remember that the assembly's full name is the name of the file minus the extension, the version number, the culture, and the number highlighted in the picture, the Public Key Token.
You can also add a DLL to the GAC (once you digitally sign it) by dragging and dropping the file into the Windows\Assembly directory.
Once you digitally sign the DLL, the version number becomes very important. Version numbers have four parts : major.minor.buildnumber.revision. Your Web application can only use the DLL with the version you referenced. Version numbers can be set by changing the AssemblyVersion attribute ( Figure 13.12 ). By default this version number is set to 1.0.*. The asterisk tells the compiler to auto-generate the build and revision numbers based on the calendar date and system clock. However, you should change the version number to a more specific number (containing all four parts) and leave it like that until you make a significant change.

Figure 13.12 The version number becomes very important when you digitally sign the DLL. By default, the application that is compiled using a certain version of the DLL will always want to use the same version. The GAC can store many versions of the same DLL.
```
 // // Version information for an assembly consists of the // following four values: // //      Major Version //      Minor Version //      Build Number //      Revision //  [assembly: AssemblyVersion("2.0.0.0")]  
```
You can remove a DLL from the GAC by pressing the Delete key after highlighting the DLL in the Windows\Assembly directory. You can also use gacutil -u dllname , where dllname is the display name of the DLL. This means: nameminusextension , Version=1.2.3.4, Culture=neutral, PublicKeyToken= 874e23ab874e23ab .

To digitally sign a DLL and add it to the GAC:

Figure 13.8. The resulting .snk file contains a private and public key pair. This is the file that you want to keep in a safe place. If the bad guys get hold of this file, they can tamper with the code in the DLL.

Figure 13.9 The Assembly.cs file contains attributes that apply to the entire project. In this case we're setting the path of the public/private key, the compiler will use the private portion to create a digital signature to protect the file.

Figure 13.11. The Public Key Token is useful in identifying the DLL (or assembly). Remember that the assembly's full name is the name of the file minus the extension, the version number, the culture, and the number highlighted in the picture, the Public Key Token.

Figure 13.12 The version number becomes very important when you digitally sign the DLL. By default, the application that is compiled using a certain version of the DLL will always want to use the same version. The GAC can store many versions of the same DLL.

Figure 13.9 The `Assembly.cs` file contains attributes that apply to the entire project. In this case we're setting the path of the public/private key, the compiler will use the private portion to create a digital signature to protect the file.