Create a signed installer

[jamaa]

https://learn.microsoft.com/en-us/previous-versions/visualstudio/visual-studio-2010/2kt85ked(v%3dvs.100)#authenticode-signing

[jamaa]

Some notes about signing for future reference

Certificate

A self-signed certificate can be used for testing purposes. Official certificates must be purchased from relevant trust authorities, but you can also apply for free open-source certificates e.g. at https://ossign.org.

Creating a self-signed certificate

Create a new self-signed certificate¹:

New-SelfSignedCertificate -Type Custom -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3", "2.5.29.19={text}") -Subject "BlueM Dev Group" -FriendlyName "BlueM Dev Group DigitalSignature"

View the certificate's thumbprint (alternatively, open Windows certmgr to view the certificate and it's thumbprint):

Set-Location Cert:\CurrentUser\My
Get-ChildItem | Format-Table Subject, FriendlyName, Thumbprint

Export certificate to PFX:

$password = ConvertTo-SecureString -String <Your Password> -Force -AsPlainText 
Export-PfxCertificate -cert "Cert:\CurrentUser\My\<Certificate Thumbprint>" -FilePath <FilePath>.pfx -Password $password

Signing

To sign a file with a certificate, use SignTool²:

SignTool sign /f <FilePath>.pfx /p <Your Password> /fd SHA256 /t http://timestamp.digicert.com BlueM.Wave_x64.msi

Integration into GitHub actions

I tried multiple different actions, but only got this one to work so far: https://github.com/marketplace/actions/code-sign-a-file

• Convert the certificate to a base64 encoded string:

certutil -encode <FilePath>.pfx <FilePath>.base64.txt

• Store the base64 string and the certificate password as secrets in the repository settings.
• Add the following action to a workflow:

        uses: dlemstra/code-sign-action@v1
        with:
          certificate: "${{ secrets.CERTIFICATE }}"
          password: "${{ secrets.CERTIFICATE_PASSWORD }}"
          folder: "."
          files: |
            BlueM.Wave_${{ steps.version.outputs.full }}_x64_setup.msi
          recursive: false
          description: "BlueM.Wave"

Footnotes

1. https://learn.microsoft.com/en-us/windows/msix/package/create-certificate-package-signing ↩

2. https://learn.microsoft.com/en-us/windows/win32/seccrypto/using-signtool-to-sign-a-file ↩