Monday, July 26, 2010

Warning 1 Use command line option '/keyfile'

This is the common Warning message we usuall get when we build a 1.1 framework project in newer version like 2.0 or 3.5. I got the warning as below.
Warning 1 Use command line option '/keyfile' or appropriate project settings instead of 'AssemblyKeyFile'

I had never noticed the warning before, but looked into some of the past builds and noticed that it had always been there. After doing some research, I found out that Visual Studio 2005 now considers the use of setting the AssemblyKeyFile in the AssemblyInfo.cs file a security issue. This is due to the AssemblyKeyFile attribute being embedded within your assembly and possibly containing sensitive path information. The warning also recommended setting this information via the project settings. I use an external strong name key file for all of my assemblies. It resides outside all of my projects/solutions. When I referenced this strong name key file, VS2005 copied it into the project. This wasn't a good thing at all.


If you are using Visual Studio 2005, you can use Project Settings (right click project name in solution explorer) to sign the assembly.