Automating code signing

Monday, January 15. 2007

When rolling out a Vista compatible installation file, I need to sign every executable (EXE and DLL) with my authenticode signature. Doing so involves executing the signcode tool numerous times (for version 2.8.0 of Creative Docs .NET, this tool is invoked more than 30 times). And every time, I have to type in a pass phrase to validate the signature:

Signcode requesting the private key password

Maybe there is a solution to avoid having this dialog pop up 30 times, but I have not been able to find out how to do so. [Note: that's no longer true, read here]

I finally decided to use a macro recorder to automate this part of the build: whenever the dialog pops up, a small utility called PTFBPro awakes and sends the key strokes followed by return to validate the private key... PTFBPro is well worth its $29.99!

Posted by Pierre Arnaud at 08:09 | Comments (2) | Trackback (1)

Trackbacks

Trackback specific URI for this entry

Automating code signing (II)
In a previous blog post I presented my solution for automated code signing, which relied on PTFBPro to generate the necessary key strokes when the Enter Private Key Password window would pop up. A reader proposed another solution, which is cleaner: usi

Weblog: Creative Docs .NET is alive!
Tracked: Mar 15, 10:31

Comments

Display comments as (Linear | Threaded)

Use Signtool.exe instead (downloadable from Microsoft).
This is a command line util without any annoying UI.

Before using it, you will just have to convert pour SPC file to a Certificate (.pfx) file, you can do it using pvk2pfx.exe (downloadable from MS too)

pvk2pfx.exe -pvk mykey.pvk -pi -spc mycert.spc -pfx cert.pfx -po -f

You should better switch to SIGNTOOL.EXE because, it has the /d option in command line, that allows you to specify a description for the signature. Have you noticed on Vista, during the MSI Installation, that the UAC will prompt you with a randomly named msi file ? If yes, it is because you have not provided a signature description.

#1 Julien R. on 2007-03-01 14:10

Thank you, Julien, for the tip. I'll give it a try. I was not aware that signtool.exe also provided a means of adding Authenticode signatures to binaries.

And yes, I am experiencing random MSI files under Vista, which seemed weird...

#1.1 Pierre Arnaud on 2007-03-01 19:48

Add Comment

Name
Email
Homepage
In reply to
Comment	Enclosing asterisks marks text as bold (word), underscore are made via _word_. Standard emoticons like :-) and ;-) are converted to images. E-Mail addresses will not be displayed and will only be used for E-Mail notifications. To leave a comment you must approve it via e-mail, which will be sent to your address after submission. To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above:
	Remember Information? Subscribe to this entry

Creative Docs .NET

Express yourself

Monday, January 15. 2007

Automating code signing

Calendar

Quicksearch

Archives

Categories

Syndicate This Blog

Blog Administration