Read a Mono Assembly's Strong Name with secutil

When a build needs an assembly's exact public key or version, secutil pulls it straight out of the compiled file. It also formats that output so you can paste it into C#, C++ or Visual Basic source. The examples here only read the assembly, so allow about ten minutes if Mono is already installed.

This guide uses Mono SecUtil 6.8.0.105 from the mono-devel package installed on this machine. The local manual page documents the strong-name and X.509 operations, but the installed program also accepts -hex in its own help output that the manual does not mention. Treat the installed version as the authority for the examples below.

1. Check the command and choose an assembly

Confirm which executable will run and locate a readable managed assembly. This is an unprivileged, read-only check:

$ command -v secutil
/usr/bin/secutil
$ test -r /usr/lib/mono/4.5/mscorlib.dll && echo readable
readable

Replace /usr/lib/mono/4.5/mscorlib.dll with the path to the assembly you actually need to inspect. Do not use a path copied from a package listing without checking it exists on this host.

2. Print the strong-name information

Use -s, or its long form -strongname, followed by the assembly path:

$ secutil -s /usr/lib/mono/4.5/mscorlib.dll
Mono SecUtil - version 6.8.0.105
Extract strongname and X509 certificates from assemblies.
Copyright 2002, 2003 Motus Technologies. Copyright 2004-2008 Novell. BSD licensed.

PublicKey =
{ 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0 }
Name =
mscorlib
Version =
4.0.0.0
Success

• Public key, name and version are the useful fields. The exact key depends on the input assembly.
• Success is just a completion message. It is not a claim that the assembly is trustworthy.
• A strong name is not a distribution guarantee. It identifies an assembly and helps detect replacement, but it is no substitute for a trusted channel or signature policy.

Verify the process result immediately if a script will rely on it:

$ secutil -s /usr/lib/mono/4.5/mscorlib.dll > /tmp/mscorlib-secutil.txt
$ printf '%s\n' "secutil status: $?"
secutil status: 0

3. Select source-code-friendly formatting

The manual describes decimal arrays as the default and C/C++/C# formatting as the default language mode. The installed parser expects the formatting option before the operation, so put -v or -c before -s when combining them:

$ secutil -v -s /usr/lib/mono/4.5/mscorlib.dll
PublicKey =
( 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0 )
Name =
mscorlib
Version =
4.0.0.0
Success
$ secutil -c -s /usr/lib/mono/4.5/mscorlib.dll | sed -n '1,12p'
Mono SecUtil - version 6.8.0.105
Extract strongname and X509 certificates from assemblies.

-v and -vbmode select Visual Basic-friendly output. -c and -cmode select C, C++ or C#-friendly output. -a and -array select a decimal array. Keep the output as text if another build step will consume it; do not treat it as a generated replacement for the assembly.

4. Try certificate extraction only when a certificate is expected

Use -x, or -x509certificate, for an X.509 Authenticode certificate:

$ secutil -x /path/to/signed-assembly.dll
Mono SecUtil - version 6.8.0.105
Extract strongname and X509 certificates from assemblies.

The output after the banner depends on the assembly: an ordinary framework assembly may have no usable certificate at all. On this machine, running secutil -x against mscorlib.dll produced a certificate-decoding error even though the process status was 0. That is the trap: check both the diagnostic output and the extracted content, and never treat the exit status alone as proof a certificate was found.

5. Diagnose the common failures

If the path is wrong, check it without changing anything:

$ ls -l /path/to/assembly.dll
$ test -r /path/to/assembly.dll && echo readable

• Missing file, malformed assembly or certificate-decoding exception: stop and verify the file type and provenance. Do not rename an arbitrary file to .dll and retry.
• Need a known-good copy: for a signed assembly, get one from the publisher, then compare it with the copy you inspected using your normal package or release verification process.
• Wrong argument order: put a formatting option where SecUtil expects the assembly and it can try to open that option as a file. Keep the order shown above: formatting mode, operation, then filename.

Use secutil -h or secutil -help to display the installed help without inspecting an assembly.