How to get updater to verify signatures

[travis]

I see that IA can sign a setup.exe file with authenticode signatures, as well as check for updates automatically via a publisher's website.

Can InstallAware verify the signature on a downloaded setup.exe update package prior to installing it on the customer's machine, to ensure the update process is not an attack vector to the customer's machines? Recent presentations at security conferences have highlighted the extreme risks of blindly downloading and installing software updates without verifying a signature. Many of my customers refuse to use auto-update mechanisms that do not verify signatures because of this.

[giaviv]

Dear travis,

Even though this is not automatically done by InstallAware, the InstallAware update script is completely customizable and can be altered to support that.
The main issue that I can think of is that the original installer (version 1 for example) does not know what the MD5 of future versions would be.

[travis]

Hello,

Thank you for your reply. I was actually referring to having the updater verify that the downloaded file is signed by a digital certificate that chains back to a trusted root (not just a static MD5 hash, which as you mention would not be known in advance). Is this possible?

Thanks

[giaviv]

Hi,

This isn't possible by default in IA - you could of course write up your own dll that does that and call if from IA, or even better, right a plugin for IA!