R – Setting CAS Policy

As per Eric's suggestion, I solved it by checking the key myself. In the code I want to protect, I add the following call,

EnsureAssemblyIsSignedByMyCompany( Assembly.GetCallingAssembly() );

Then the implementation of that method is

  /// <summary>
  /// Ensures that the given assembly is signed by My Company or Microsoft.
  /// </summary>
  /// <param name="assembly"></param>
  private static void EnsureAssemblyIsSignedByMyCompany( Assembly assembly )
  {
     if ( assembly == null )
        throw new ArgumentNullException( "assembly" );

     byte[] pubkey = assembly.GetName().GetPublicKeyToken();
     if ( pubkey.Length == 0 )
        throw new ArgumentException( "No public key token in assembly." );

     StringBuilder builder = new StringBuilder();
     foreach ( byte b in pubkey )
     {
        builder.AppendFormat( "{0:x2}", b );
     }
     string pkString = builder.ToString();
     if ( pkString != "b77a5c561934e089" /* Microsoft */ &&
          pkString != "abababababababab" /* Ivara */ )
     {
        throw new ArgumentException( "Assembly is not signed by My Company or Microsoft. You do not have permission to call this code." );
     }
  }

** Names and keys changed to protect the innocent. Any likeness to real names or companies is merely a coincidence.*

First Question:

The zone is applied based on where the assembly is run from. Because the assembly payload is executed on the local machines and lives on the local harddrive, not a network or internet location, the My Computer Zone security will apply to the assembly. At this point the evidence does not apply. However if I have explicuity coded my assembly to require for example administrator access, this will still be enforced.

Second Question:

No you do not need to change the All_Code setting. The two policies will be merged effectively and the most restrictive policy will apply.