C# 4 and .NET 4

Distributing Code Using Certificates ❘ 567
}
{
}
CodeAccessPermission permissionA =
new FileIOPermission(FileIOPermissionAccess.AllAccess, @"C:\");
CodeAccessPermission permissionB =
new FileIOPermission(FileIOPermissionAccess.Read, @"C:\temp");
if (permissionB.IsSubsetOf(permissionA))
{
Console.WriteLine("PermissionB is a subset of PermissionA");
}
code snippet ImplicitPermissions/Program.cs
The output looks like this:
PermissionB is a subset of PermissionA
disTribuTing Code using CerTifiCaTes
You can make use of digital certifi cates and sign assemblies so that consumers of the software can verify the
identity of the software publisher. Depending on where the application is used, certifi cates may be required.
For example, with ClickOnce the user installing the application can verify the certifi cate to trust the
publisher. Using Windows Error Reporting, Microsoft uses the certifi cate to fi nd out which vendor to map
to the error report.
ClickOnce is explained in Chapter 17, “Deployment.” Windows Error Reporting is
discussed in Appendix A, “Guidelines for Windows 7 and Windows Server 2008 R2.”
In a commercial environment, you would obtain a certifi cate from a company such as Verisign or
Thawte. The advantage of buying a certifi cate from a supplier instead of creating your own is that it
provides a high level of trust in the authenticity of the certifi cate; the supplier acts as a trusted third party.
For test purposes, however, .NET includes a command - line utility you can use to create a test certifi cate.
The process of creating certifi cates and using them for publishing software is complex, but we walk through
a simple example in this section.
The example code is for a fi ctitious company called ABC Corporation. The company ’ s software product
(simple.exe) should be trusted. First, create a test certifi cate by typing the following command:
makecert -sv abckey.pvk -r -n "CN=ABC Corporation" abccorptest.cer
The command creates a test certifi cate under the name ABC Corporation and saves it to a fi le called
abccorptest.cer . The - sv abck e y . p v k argument creates a key fi le to store the private key. When creating
the key fi le, you are asked for a password that you should remember.
After creating the certifi cate, you can create a software publisher test certifi cate with the Software Publisher
Certifi cate Test tool ( Cert2spc.exe ):
> cert2spc abccorptest.cer abccorptest.spc
With a certifi cate that is stored in an spc fi le and the key fi le that is stored in a pvk fi le, you can create a pfx
fi le t h at c ont a i n s b ot h w it h t he pvk2pfx utility:
> pvk2pfx -pvk abckey.pvk -spc abccorptest.spc -pfx abccorptest.pfx
Now the assembly can be signed with the signtool.exe utility. The sign option is used for signing, -f
specifi es the certifi cate in the pfx fi le, and -v is for verbose output:
> signtool sign -f abccorptest.pfx -v simple.exe
www.it-ebooks.info