12

Is it possible in Inno Setup to sign the Uninstaller and Installer with sha1 and sha256 at the same time?

I know that it is possible to sign the Executable with both certs via command tool, but want to know if this is possible to achieve with SignTool in Inno.

Community
  • 1
  • 1
RobeN
  • 5,346
  • 1
  • 33
  • 50
  • 2
    Why shouldn't it be possible? You can pass a batch file as your signtool which calls signtool.exe two times. – Wosi Aug 18 '15 at 21:17

2 Answers2

11

Autoanswer...

Yes, this is possible. As @Wosi suggested you can write a batch and then call it with $f parameter added.

Sample batch (signtool.bat):

@echo off

"PATH_TO_SIGNTOOL\signtool.exe" sign /v /du "COMPANY_NAME" /fd sha1 /t "http://timestamp.verisign.com/scripts/timstamp.dll" /f "sha1_cert.pfx" /p PASSWORD %1

set SIGN_RESULT_1=%ERRORLEVEL%

"PATH_TO_SIGNTOOL\signtool.exe" sign /as /v /du "COMPANY_NAME" /fd sha256 /tr "http://timestamp.comodoca.com/rfc3161" /td sha256 /f "sha256_cert.pfx" /p PASSWORD %1

set SIGN_RESULT_2=%ERRORLEVEL%

set /a RESULT=%SIGN_RESULT_1%+%SIGN_RESULT_2%

if %RESULT% NEQ 0 (
   echo Warning! Signing failed with %SIGN_RESULT_1% for sh1 and %SIGN_RESULT_2% for sha256
   pause
   exit /B %RESULT%
) 

echo Signing succeeded
exit /B 0

Then in Inno Setup you can call signtool.bat $f where $f will be passed to %1 for the batch.

For Windows XP compatibility for sha1: removed /as, /tr replaced with /t, removed /td (as it requires /tr)

I will leave it here as maybe someone could find it helpful.

RobeN
  • 5,346
  • 1
  • 33
  • 50
  • 3
    While this works, note that [since Inno Setup 5.5.8](http://jrsoftware.github.io/issrc/whatsnew.htm#5.5.8), you can have multiple [`SignTool` directives](http://www.jrsoftware.org/ishelp/topic_setup_signtool.htm), as the [answer by @TheArtTrooper](http://stackoverflow.com/a/38753662/850848) shows. – Martin Prikryl Aug 04 '16 at 05:47
  • I had some compilation errors – need to write full path: c:\...\signtool.bat $f – ViH Nov 27 '16 at 18:49
5

I'm using Inno Setup 5.5.9. I compile my script from the command line using ISCC. My setup script includes these two lines in the [Setup] section:

SignTool=sha1
SignTool=sha256

The ISCC command looks like:

ISCC "/ssha1=signtool.exe /f <cert.pfx> /p <certpwd> /fd SHA1 /t <timestamp.url> /v $f" "/ssha256=signtool.exe /f <cert.pfx> /p <certpwd> /fd SHA256 /tr <timestamp.url> /td SHA256 /as /v $f" setup.iss

Inno Setup will sign the install and uninstall with both certs.

Martin Prikryl
  • 188,800
  • 56
  • 490
  • 992
TheArtTrooper
  • 1,105
  • 8
  • 19