Media File Wizard: Code Signing | ![]() ![]() ![]() |
![]() | In this step of the media file wizard you can optionally configure code signing for all generated executables. Code-signing ensures that the installer as well as the uninstaller are trusted executables on Windows Vista and higher. For unsigned applications that require admin privileges, Window Vista and higher will display a special warning dialog. Also, Windows XP users who use Internet Explorer receive a different warning dialog when trying to execute a downloaded installer. |
![]() |
The install4j compiler can invoke a post-processor for each executable that is generated. This includes
In the post processor text field you can use the $EXECUTABLE variable to reference the executable that is currently being post-processed. The working directory of the executed process is the directory your config is located in so you can use relative file names for key or certificate files. If the signing command cannot replace the executable directly, but rather needs a separate output file, use the $OUTFILE variable. It will receive a temporary output file name that will be moved back to the processed executable by install4j after the post processor has completed. |
![]() | If you run the build on Windows, you can use the Authenticode tools from the Windows SDK to sign the executable. Older Platform SDKs as well as the .NET v1 SDKs contain the tool signcode.exe. The newer SDKs contain the tool signtool.exe. Both tools are equally suited for code signing with install4j. Please refer to the MSDN documentation for detailed information. |
![]() |
It is also possible to sign executables on other platforms. The $INSTALL4J_HOME/resource/signcode.exe
executable is a mono executable modified by
ej-technologies to support signing of 64-bit executables. This executable can only be executed if
mono is installed. Mono is available for a number of platforms and can be
downloaded free of charge.
The tool has the same syntax as the one from Microsoft. A typical entry would be mono /opt/install4j/resource/signcode.exe -spc mycert.spc -v mykey.pvk -vp password -t http://timestamp.verisign.com/scripts/timstamp.dll $EXECUTABLE Some SPC files cannot be read directly by this tool. If this is the case for your certificate, you can export all CER files from the SPC file and generate a new SPC file with the cert2spc tool included with mono. You have to add the CER files in the order of the certificate chain (your own certificate is the last one on the command line). |
![]() ![]() ![]() |