Search code examples
dllinno-setupcode-signing

Inno Setup code signing not applying for all the files. How to fix that?

We are using a setup creation tool called Inno Setup to get the final installation file. In there we are using signtool.exe to sign all the files of our app. We put necessary details in these boxes enter image description here

We are using a certificate called DMCC_Microsoft_Key.pfx But after the creation of the setup and when we install the setup only the application.exe file shows digital signatures while other files do not show that. Here is the script in signtool

"c:\{path}\signtol.exe" sign /f "{Certificate path}\key.pfx" /tr "http://timestamp.digicert.com" /p "Password" $f

The below digital signatures tab is only shown in the .exe file.

enter image description here

How to sign in all the DLLs inside a given directory using Inno Setup?

This is my iss script

;#define APP_EXE_NAME "AsiaMX TY 6.exe"

[Setup]
SignTool=ASIAMX_signtool

[Files]
Source: "{#APP_EXE_NAME}"; DestDir: "{app}"; \
    Flags: ignoreversion signonce; Permissions: everyone-full
Source: "*"; DestDir: "{app}"; \
    Flags: ignoreversion recursesubdirs createallsubdirs; \
    Permissions: everyone-full

I saw some other StackOverflow questions. Another one answered the same kind of question using this answer. I don't know where to put this. How to sign every ocx, dll and exe file

Try

@echo off FOR /f "tokens=*" %%G IN ('dir /s *.dll *.ocx *.exe') DO ( echo %%G set A= "%%G" signtool sign /f "C:\Certificates\FakeCertificate.pfx" %A% )
Solution

  • You have the signonce flag only at the {#APP_EXE_NAME} entry. Not on the others.

    So not surprisingly, Inno Setup signs only the {#APP_EXE_NAME}, not the other files.

    As the * entry matches both executable and non-executable files, you have to the split the entry to two. And actually your {#APP_EXE_NAME} entry conflicts too with the * entry.

    This should do:

    [Files]
Source: "{#APP_EXE_NAME}"; DestDir: "{app}"; \
    Flags: ignoreversion signonce
Source: "*.dll"; DestDir: "{app}"; \
    Flags: ignoreversion recursesubdirs createallsubdirs signonce
Source: "*"; Excludes: "{#APP_EXE_NAME},*.dll" DestDir: "{app}"; \
    Flags: ignoreversion recursesubdirs createallsubdirs

    Btw, Permissions: everyone-full is big NO in general. I've dropped it in my answer, so that others don't copy it inadvertently.