Media File Wizard: Code Signing

     


  In this step of the media file wizard you can optionally configure code signing for all generated executables. Code-signing ensures that the installer as well as the uninstaller are trusted executables on Windows Vista. For unsigned applications that require admin privileges, Window Vista will display a special warning dialog. Also, Windows XP users who use Internet Explorer receive a different warning dialog when trying to execute a downloaded installer.
  The install4j compiler can invoke a post-processor for each executable that is generated. This includes
  • generated launchers
  • the installer
  • the uninstaller

In the post processor text field you can use the $EXECUTABLE variable to reference the executable that is currently being post-processed. The working directory of the executed process is the directory your config is located in so you can use relative filenames for key or certificate files.

  If you run the build on Windows, you can use the Authenticode tools from the Windows SDK to sign the executable. Older Platform SDKs as well as the .NET v1 SDKs contain the tool signcode.exe. The newer SDKs contain the tool signtool.exe. Both tools are equally suited for code signing with install4j. Please refer to the MSDN documentation for detailed information.
  It is also possible to sign executables on other platforms. The $INSTALL4J_HOME/resource/signcode.exe executable is a mono executable modified by ej-technologies to support signing of 64-bit executables. This executable can only be executed if mono is installed. Mono is available for a number of platforms and can be downloaded free of charge.

The tool has the same syntax as the one from Microsoft. A typical entry would be mono /opt/install4j/resource/signcode.exe -spc mycert.spc -v mykey.pvk -vp password -t http://timestamp.verisign.com/scripts/timstamp.dll $EXECUTABLE

Some SPC files cannot be read directly by this tool. If this is the case for your certificate, you can export all CER files from the SPC file and generate a new SPC file with the cert2spc tool included with mono. You have to add the CER files in the order of the certificate chain (your own certificate is the last one on the command line).