{"id":416,"date":"2016-02-08T16:56:46","date_gmt":"2016-02-09T00:56:46","guid":{"rendered":"http:\/\/www.installaware.com\/blog\/?p=416"},"modified":"2016-02-12T18:12:38","modified_gmt":"2016-02-13T02:12:38","slug":"how-to-comply-with-microsoft%e2%80%99s-new-code-signing-policy-using-installaware-x3%e2%80%99s-new-build-events","status":"publish","type":"post","link":"https:\/\/www.installaware.com\/blog\/?p=416","title":{"rendered":"How to Comply With Microsoft\u00e2\u20ac\u2122s New Code Signing Policy Using InstallAware X3\u00e2\u20ac\u2122s New Build Events"},"content":{"rendered":"<p>In this tutorial we are going to show you how to make your installer packages conform with Microsoft\u00e2\u20ac\u2122s new code signing policy. The \u00e2\u20ac\u0153Windows Enforcement of Authenticode Code Signing and Timestamping\u00e2\u20ac\u009d is effective as of January 1, 2016. This new policy basically mandates the deprecation of SHA-1 code signing certificates, time stamps, and file hashes for Code Signing. The new Microsoft Policy involves SHA-2 code signing certificates, time stamps, and file hashes as part of the updated policy:<\/p>\n<p><a href=\"http:\/\/social.technet.microsoft.com\/wiki\/contents\/articles\/32288.windows-enforcement-of-authenticode-code-signing-and-timestamping.aspx\">http:\/\/social.technet.microsoft.com\/wiki\/contents\/articles\/32288.windows-enforcement-of-authenticode-code-signing-and-timestamping.aspx<\/a><\/p>\n<p>Fortunately this can be easily achieved following the few steps described with this tutorial. This is entirely based on the use of the new \u00e2\u20ac\u0153Build Events\u00e2\u20ac\u009d feature available with InstallAware X3.<\/p>\n<p>The &#8220;Build Events&#8221; feature makes it possible to run any third party process as an integral part of a build process. A \u00e2\u20ac\u0153Process\u00e2\u20ac\u009d is any executable and may be invoked during the various stages of a build that InstallAware follows while packaging your apps.<\/p>\n<p>In this tutorial, we will not be boring you with the details of the new Code Signing Policy. If you are interested in resolving the overt contradictions in the Microsoft documentation and fancy that sort of a wild goose chase, please enjoy the official Microsoft documentation linked above. Having suffered through the nitty gritty details at InstallAware HQ on your behalf, we will be sparing you this pain; and focus on just the steps necessary to comply with the new Code Signing Policy in order to let you to build trusted setup packages.<\/p>\n<p>Let us start with an overview of the setup binaries produced by a build which need code signing. These are of course, the MSI and\/or EXE binaries that comprise your setup files. Please note that if you are setting the NO_MSI compiler variable to TRUE \u00e2\u20ac\u201c meaning that you are opting to build a pure Native Engine installation, without any Windows Installer (MSI) bloat \u00e2\u20ac\u201c in that case, you may omit the steps for the MSI files below. Similarly, when you are building a pure Windows Installer target (no final EXE output), you may omit the steps for EXE files.<\/p>\n<p>These are in summary the targets that need to comply with the new Code Signing Policy. We may now proceed to the implementation using InstallAware X3.<\/p>\n<p>&nbsp;<\/p>\n<p><strong><span style=\"text-decoration: underline;\">Requirements for This Tutorial<\/span><\/strong><\/p>\n<p>\u00e2\u20ac\u00a2\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 InstallAware version X3,<\/p>\n<p>\u00e2\u20ac\u00a2\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 An SHA-2 code signing certificate,<\/p>\n<p>\u00e2\u20ac\u00a2\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 A recent version of the Microsoft SignTool.exe that supports double signing. This tool is included with the Windows 8 SDK, Windows 8.1 SDK and Windows 10 SDK.<\/p>\n<p>Once the SDK is installed, the SignTool.exe binary is generally found inside one of the following directories:<\/p>\n<ul>\n<li>C:\\Program Files (x86)\\Windows Kits\\8.0\\bin\\x86<\/li>\n<li>C:\\Program Files (x86)\\Windows Kits\\8.1\\bin\\x86<\/li>\n<li>C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x86<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><strong><span style=\"text-decoration: underline;\">Getting Started<\/span><\/strong><\/p>\n<p>Make sure the \u00e2\u20ac\u0153Sign the package with Authenticode\u00e2\u20ac\u009d checkbox in the Build | Authenticode page of your Project Options window is UNCHECKED. This step is necessary since we are replacing the default code signing process in InstallAware X3.<\/p>\n<p>&nbsp;<\/p>\n<p><strong><span style=\"text-decoration: underline;\">Defining B<\/span><\/strong><strong><span style=\"text-decoration: underline;\">uild <\/span><\/strong><strong><span style=\"text-decoration: underline;\">E<\/span><\/strong><strong><span style=\"text-decoration: underline;\">vents to <\/span><\/strong><strong><span style=\"text-decoration: underline;\">S<\/span><\/strong><strong><span style=\"text-decoration: underline;\">ign an <\/span><\/strong><strong><span style=\"text-decoration: underline;\">U<\/span><\/strong><strong><span style=\"text-decoration: underline;\">ncompressed <\/span><\/strong><strong><span style=\"text-decoration: underline;\">Build Layout<\/span><\/strong><\/p>\n<p>With this kind of build its necessary to apply the digital signature to the following files which are part of an uncompressed build layout for a setup package (such as, for a DVD\/Blu-Ray distribution target). These are stored at build time under your project&#8217;s \u00e2\u20ac\u0153uncompressed\u00e2\u20ac\u009d output folder.<\/p>\n<p>\u00e2\u20ac\u00a2\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 &lt;PackageName&gt;.exe<\/p>\n<p>\u00e2\u20ac\u00a2\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 &lt;PackageName&gt;.msi<\/p>\n<p>\u00e2\u20ac\u00a2\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 \\data\\&lt;PackageName&gt;.msi<\/p>\n<p>1. In the Project Options dialog (\u00e2\u20ac\u0153CTRL+SHIFT+F11\u00e2\u20ac\u009d) select the \u00e2\u20ac\u0153Post-Build\u00e2\u20ac\u009d event node listed within the left tree pane control. Then in the Commands field enter the following command line sequence.<\/p>\n<p><span style=\"color: #ff6600;\">&#8211; &#8220;#IADIR#\\authenticode\\SignTool.exe&#8221; sign \/f &lt;SHA2_cert&gt; \/t &lt;SHA1_timestamp_url&gt; \/p &lt;cert_password&gt; &#8220;#PROJDIR#\\Release\\Uncompressed\\#TITLE#.msi&#8221;<\/span><\/p>\n<p><span style=\"color: #ff6600;\">&#8211; &#8220;#IADIR#\\authenticode\\SignTool.exe&#8221; sign \/f &lt;SHA2_cert&gt; \/t &lt;SHA1_timestamp_url&gt; \/p &lt;cert_password&gt; &#8220;#PROJDIR#\\Release\\Uncompressed\\Data\\#TITLE#.msi&#8221;<\/span><\/p>\n<p><span style=\"color: #ff6600;\">&#8211; &#8220;C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x86\\SignTool.exe&#8221; sign \/f &lt;SHA2_cert&gt; \/t &lt;SHA1_timestamp_url&gt; \/p &lt;cert_password&gt; &#8220;#PROJDIR#\\Release\\Uncompressed\\#TITLE#.exe&#8221;<\/span><\/p>\n<p><span style=\"color: #ff6600;\">&#8211; &#8220;C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x86\\SignTool.exe&#8221; sign \/f &lt;SHA2_cert&gt; \/as \/fd sha256 \/tr &lt;SHA256_timestamp_url&gt; \/td sha256 \/p &lt;cert_password&gt; &#8220;#PROJDIR#\\Release\\Uncompressed\\#TITLE#.exe&#8221;<\/span><\/p>\n<p><span style=\"text-decoration: underline;\">*Note<\/span><span style=\"text-decoration: underline;\">s<\/span><span style=\"text-decoration: underline;\">:<\/span><\/p>\n<p><span style=\"text-decoration: underline;\">a) P<\/span><span style=\"text-decoration: underline;\">ress CTRL+ENTER to start a new command line.<\/span><span style=\"text-decoration: underline;\"> Each new line above represents a new command line and a new process invocation.<\/span><\/p>\n<p><span style=\"text-decoration: underline;\">b) Ensure to update paths to the folder where the SignTool.exe binary is actually located on your system. In the above example, a typical path for the Windows 10 SDK on a 64-bit operating system has been used.<\/span><\/p>\n<p><span style=\"text-decoration: underline;\">c) You will need to replace these tokens with your actual desired targets:<\/span><\/p>\n<p><span style=\"text-decoration: underline;\">&lt;SHA256_timestamp_url&gt;: Replace with the actual time stamp server URL to use, for example <\/span><a href=\"http:\/\/timestamp.comodoca.com\/rfc3161\">http:\/\/timestamp.comodoca.com\/rfc3161<\/a><span style=\"text-decoration: underline;\">.<\/span><\/p>\n<p><span style=\"text-decoration: underline;\">&lt;cert_password&gt;: Replace with your code signing certificate password (we better not know what that is, right?)<\/span><\/p>\n<p><span style=\"text-decoration: underline;\">&lt;SHA2_cert&gt;: Enter the full path to your code signing certificate file here. Ensure to enclose the entire path string inside double quotes (\u00e2\u20ac\u0153\u00e2\u20ac\u009d) if the path to your code signing certificate contains spaces. Those adventurous among you may also opt to use the short path name for the certificate, if you are averse to using paths with spaces in them (even when they have been double-quoted).<\/span><\/p>\n<p>Notice how, in the above command line sequence, we have refrained from hard-coding any folder paths and file names, insofar as your project folder and setup name is concerned. The examples above make use of the pre-defined compiler variables #PROJECTDIR#, #IADIR# and #TITLE#, instead of hard-coding folder paths and file names. These compiler variables are automatically resolved to their final values during the build process. This helps you use the exact same commands across all of your setup projects; without having to engage in the laborious task of updating paths and file names across projects, and\/or having to update them when you actually move project folders around\/change setup names.<\/p>\n<p>2. In the Post-Build event settings, you may want to check the \u00e2\u20ac\u0153Abort build on error (if any command returns non-zero result)\u00e2\u20ac\u009d checkbox. Checking this box fails the setup build process when any invoked application returns a non-zero error code as its exit code, which is typically how an error condition is indicated on the command line. You may also want to keep this box unchecked, if you don\u00e2\u20ac\u2122t care to break your build process when an intermittent failure occurs with a code signing time stamp server (or if it is not otherwise critical for your code signing to succeed).<\/p>\n<p>3. Finally in the Project Options dialog, select the OK button to confirm the Post-Build event settings. Then rebuild the project. You\u00e2\u20ac\u2122re done!<\/p>\n<p><strong><span style=\"text-decoration: underline;\"><br \/>\n<\/span><\/strong><\/p>\n<p><strong><span style=\"text-decoration: underline;\">Defining B<\/span><\/strong><strong><span style=\"text-decoration: underline;\">uild <\/span><\/strong><strong><span style=\"text-decoration: underline;\">E<\/span><\/strong><strong><span style=\"text-decoration: underline;\">vents to <\/span><\/strong><strong><span style=\"text-decoration: underline;\">S<\/span><\/strong><strong><span style=\"text-decoration: underline;\">ign a<\/span><\/strong><strong><span style=\"text-decoration: underline;\"> Compressed, Web, or Patch<\/span><\/strong><strong><\/strong><strong><span style=\"text-decoration: underline;\"> Build Layout<\/span><\/strong><\/p>\n<p>With all other build targets, including a Single Compressed File (monolithic) installer, a Web Build (main setup file plus optional web media block files), or a Patch Build; we need to define either a Post-Compress Event (if your final build target is an EXE file) or a Post-Wrap event (if your final build target is an MSI file).<\/p>\n<p>Note that you could also \u00e2\u20ac\u0153nest\u00e2\u20ac\u009d your signatures all the way in, if you wanted to. Since any compressed setup is ultimately composed of files found in an uncompressed layout (which are then packaged into a single [or a few, in the case of a web build\u00e2\u20ac\u2122s web media block files] file), there\u00e2\u20ac\u2122s no harm in signing all those source materials as well.<\/p>\n<p>While Windows will obviously not display any additional elevation requests once you have already elevated the main entry point of your setup package, you may want to use this trick of nested package signing for reasons of improving your chances of preventing false positives with anti-virus software. Anti-viruses have indeed become a cure worse from the disease, often hindering legitimate setups from installation. It may help your installation success rates to sign your packages from top to bottom (although, to set your expectations right; some anti-virus vendors have gotten so aggressive, that your mileage may vary even with everything signed inside out).<\/p>\n<p>So if you want to do the nesting, copy over\/retain the Post-Build event instructions for Uncompressed Builds to your compressed build types as well. Of course, remember to replace the string \u00e2\u20ac\u0153uncompressed\u00e2\u20ac\u009d with the string \u00e2\u20ac\u0153single\u00e2\u20ac\u009d, \u00e2\u20ac\u0153web\u00e2\u20ac\u009d, or \u00e2\u20ac\u0153patch\u00e2\u20ac\u009d based on your new distribution target.<\/p>\n<p>Again while nesting, when building a single MSI file target, retain the Post-Compress event instructions (normally, you would only need to implement the Post-Wrap event instructions).<\/p>\n<p>&nbsp;<\/p>\n<p>So here are the Post-Compress build events for a Single File Compressed Build:<\/p>\n<p><span style=\"color: #ff6600;\">&#8211; &#8220;C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x86\\SignTool.exe&#8221; sign \/f &lt;SHA2_cert&gt; \/t &lt;SHA1_timestamp_url&gt; \/p &lt;cert_password&gt; &#8220;#PROJDIR#\\Release\\Single\\#TITLE#.exe&#8221;<\/span><\/p>\n<p><span style=\"color: #ff6600;\">&#8211; &#8220;C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x86\\SignTool.exe&#8221; sign \/f &lt;SHA2_cert&gt; \/as \/fd sha256 \/tr &lt;SHA256_timestamp_url&gt; \/td sha256 \/p &lt;cert_password&gt; &#8220;#PROJDIR#\\Release\\Single\\#TITLE#.exe&#8221;<\/span><\/p>\n<p>Here are the Post-Compress build events for a Web Compressed Build:<\/p>\n<p><span style=\"color: #ff6600;\">&#8211; &#8220;C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x86\\SignTool.exe&#8221; sign \/f &lt;SHA2_cert&gt; \/t &lt;SHA1_timestamp_url&gt; \/p &lt;cert_password&gt; &#8220;#PROJDIR#\\Release\\Web\\#TITLE#.exe&#8221;<\/span><\/p>\n<p><span style=\"color: #ff6600;\">&#8211; &#8220;C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x86\\SignTool.exe&#8221; sign \/f &lt;SHA2_cert&gt; \/as \/fd sha256 \/tr &lt;SHA256_timestamp_url&gt; \/td sha256 \/p &lt;cert_password&gt; &#8220;#PROJDIR#\\Release\\Web\\#TITLE#.exe&#8221;<\/span><\/p>\n<p>And finally, the Post-Compress build events for a Patch:<\/p>\n<p><span style=\"color: #ff6600;\">&#8211; &#8220;C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x86\\SignTool.exe&#8221; sign \/f &lt;SHA2_cert&gt; \/t &lt;SHA1_timestamp_url&gt; \/p &lt;cert_password&gt; &#8220;#PROJDIR#\\Release\\Patch\\#TITLE#.exe&#8221;<\/span><\/p>\n<p><span style=\"color: #ff6600;\">&#8211; &#8220;C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x86\\SignTool.exe&#8221; sign \/f &lt;SHA2_cert&gt; \/as \/fd sha256 \/tr &lt;SHA256_timestamp_url&gt; \/td sha256 \/p &lt;cert_password&gt; &#8220;#PROJDIR#\\Release\\Patch\\#TITLE#.exe&#8221;<\/span><\/p>\n<p>&nbsp;<\/p>\n<p>Now, if you are producing an MSI output instead of an EXE output, use the following build events instead. Of course, if you will be doing nested signing, then remember to retain the above Post-Compress build events as well.<\/p>\n<p>For a Single File MSI Build, use these Post-Wrap build events:<\/p>\n<p><span style=\"color: #ff6600;\">&#8211; &#8220;#IADIR#\\authenticode\\SignTool.exe&#8221; sign \/f &lt;SHA2_cert&gt; \/t &lt;SHA1_timestamp_url&gt; \/p &lt;cert_password&gt; &#8220;#PROJDIR#\\Release\\Single\\#TITLE#.msi&#8221;<\/span><\/p>\n<p>For a Web MSI Build, use these Post-Wrap build events:<\/p>\n<p><span style=\"color: #ff6600;\">&#8211; &#8220;#IADIR#\\authenticode\\SignTool.exe&#8221; sign \/f &lt;SHA2_cert&gt; \/t &lt;SHA1_timestamp_url&gt; \/p &lt;cert_password&gt; &#8220;#PROJDIR#\\Release\\Web\\#TITLE#.msi&#8221;<\/span><\/p>\n<p>For a Patch MSI Build, use these Post-Wrap build events:<\/p>\n<p><span style=\"color: #ff6600;\">&#8211; &#8220;#IADIR#\\authenticode\\SignTool.exe&#8221; sign \/f &lt;SHA2_cert&gt; \/t &lt;SHA1_timestamp_url&gt; \/p &lt;cert_password&gt; &#8220;#PROJDIR#\\Release\\Patch\\#TITLE#.msi&#8221;<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><strong><span style=\"text-decoration: underline;\">Conclusion<\/span><\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>That&#8217;s it!<\/p>\n<p>You\u00e2\u20ac\u2122ve seen how easy and versatile it can be to use InstallAware X3\u00e2\u20ac\u2122s new Build Events to extend the default build process in the IDE and across the entire InstallAware build toolchain.<\/p>\n<p>Please feel free to use this mechanism to do anything special you like when building your own installers. Have fun!<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Francesco Toscano<\/strong><br \/>\nYour InstallAware\u00e2\u201e\u00a2 Support Team.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this tutorial we are going to show you how to make your installer packages conform with Microsoft\u00e2\u20ac\u2122s new code signing policy. The \u00e2\u20ac\u0153Windows Enforcement of Authenticode Code Signing and Timestamping\u00e2\u20ac\u009d is effective as of January 1, 2016. This new policy basically mandates the deprecation of SHA-1 code signing certificates, time stamps, and file hashes &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/www.installaware.com\/blog\/?p=416\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;How to Comply With Microsoft\u00e2\u20ac\u2122s New Code Signing Policy Using InstallAware X3\u00e2\u20ac\u2122s New Build Events&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-416","post","type-post","status-publish","format-standard","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/www.installaware.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.installaware.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.installaware.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.installaware.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.installaware.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=416"}],"version-history":[{"count":6,"href":"https:\/\/www.installaware.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/416\/revisions"}],"predecessor-version":[{"id":418,"href":"https:\/\/www.installaware.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/416\/revisions\/418"}],"wp:attachment":[{"href":"https:\/\/www.installaware.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.installaware.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.installaware.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}