Signing the internal MSI and setup exe

[hdwivedi23]

Hi,

For our product we are using web-based installer. The final installer is a .MSI file. We sign the source files and the final MSI file. But is there a way to sign the internal setup exe files as well.
I don't want to use the Authenticode signature feature as we have a seperate process of signing.

Can you please help me with this. I am using Installaware 17 studio.

[FrancescoT]

Dear User,

honestly, it is not very clear to me what you want to sign exactly ... can you try to clarify?

Regards

[hdwivedi23]

Thanks for a prompt reply.

I am creating a .MSI web-based installer with web media blocks.

Now, here is my issue:

The msi file internally contains an .exe and an .msi file with the same name as outer msi installer.

Now as per my understanding. Installaware creates setup executables and a MSIs and wraps the whole thing with in an outer MSI file (when we choose to produce a msi installer). On running the outer msi file, it copies all the files and internal setup files in a temp folder and launches the internal setup executable, which actually installs the application.

I want to digitally sign the internal setup files as well (that are wrapped inside the outer msi). Is it possible?

[FrancescoT]

No,it is not possible ... and even not needed.

Those file are un-compresed at runtime by the main installer and it is just enough to digitally sign it.

Regards

[hdwivedi23]

We are having issues with some of the antivirus brands. They are saying that because the internal setup files are not signed, antivirus is detecting them as a threat. This is why we want to sign the internal setup files.

[FrancescoT]

... probably they are referring to the files installed by the package and not to the other ones.

Regards

[hdwivedi23]

No. They are not referring to the files installed by the package. All those files are signed by us. They specifically mentioned that the issue is with the internal setup executable as it is not signed but gets cached on the target machine.

[FrancescoT]

... those are not the only cached files (... some of them are temporary files).

I am sorry but I don't agree with them.
Any installer (...created with any tool) stores at runtimes some cached files ... and I never found them signed.

Regards