Digital certificate, code signing preferences

[Pete B]

Hi
I am very new to the digital code signing process and I've just applied for my first one from COMODO. There are a few threads mentioning digital code signing on this forum but I am trying to find out exactly what the experienced developers/distributors do. I will have one code for everything. I distribute via web builds / web media blocks.
Do you guys just sign, in a case like this, just the installer exe ?
Do you sign application exe, ocx etc. files as well, before they are 7zipped ?
I am kind of lost here as to how far I go with this ... advice would be genuinely appreciated.

thanks

[Alex_Ronquillo]

You can just sing the whole setup and that will take care of it.

[Pete B]

Alex
Sorry if I'm being dumb here but ...

just sing the whole setup

... are you saying just the installer.exe (ie. the setup.exe) or does 'whole' mean all files as I mentioned in my initial post.

thanks

[swarovski]

Hi
I am very new to the digital code signing process and I've just applied for my first one from COMODO. There are a few threads mentioning digital code signing on this forum but I am trying to find out exactly what the experienced developers/distributors do. I will have one code for everything. I distribute via web builds / web media blocks.
Do you guys just sign, in a case like this, just the installer exe ?
Do you sign application exe, ocx etc. files as well, before they are 7zipped ?
I am kind of lost here as to how far I go with this ... advice would be genuinely appreciated.

thanks

My preference:
i will sign the application exe, dll etc as well prior to the Setup.exe build.
After Setup.exe is built, sign the Setup.exe

[Pete B]

My thanks to both gentlemen for your comments, 2 apparently different opinions but so what ? ... this is not a question of right or wrong, just how and why.
Thanks again and anybody else have views on this ?

[Alex_Ronquillo]

I don't think we gave you different answers, we just told it with different words. I just think swarovski explained it better. Go with that approach.

[Pete B]

Ah! thanks Alejandro ... so you were not singing a different song after all

[Alex_Ronquillo]

Sorry about the misspelling. It was sign and not sing.

[neillans]

Just to revive an old topic, in the interests of ensuring other users who hit this have complete info

Microsoft recommends that ALL binaries that you distribute are code signed.
This includes:
- All EXE's
- All DLL's (yes, including any Assemblies you have, plus those in the GAC).

You should also ensure you app has a Vista compatible manifest, but thats another story!

Finally, when you are code signing your setup, be sure to use the tools provided in InstallAware, or you will NOT correctly code sign your setup, and it WILL fail the Microsoft certification path.

[get101]

I use the tools provided in IA to code sign the setup.

I have not been code signing the EXE of my application. Is there an easy way to do that?

[swarovski]

Yeah, as neillans said in the next 3 thread.
I sign all binaries because M$ suggestion hehe.

I don't think we gave you different answers, we just told it with different words. I just think swarovski explained it better. Go with that approach.

[swarovski]

I use the tools provided in IA to code sign the setup.

I have not been code signing the EXE of my application. Is there an easy way to do that?

I use signtool.exe provided from the M$ platform development kit.
This is the details and steps by steps:
http://www.verisign.com/support/code-si ... ation.html

I found that the command line of this tool is quite lame. so i use it's wizard mode.

And i also using Auto-It to write a automation script, so that the information will be filled in automatically to the signtool wizard.

Auto-It link:
http://www.autoitscript.com/autoit3/

[get101]

Thanks for the info. Most useful.