search

Squirrel / Squirrel.Windows

An installation and update framework for Windows desktop apps
MIT License
7.23k stars 1.02k forks source link

How to sign just the _ExecutionStub.exe file when run Squirrel --releasify -n ? #1869

Closed emilioHayes closed 7 months ago

emilioHayes commented 7 months ago

Squirrel version(s) 2.0.1

Description In the documentation: https://github.com/Squirrel/Squirrel.Windows/blob/develop/docs/using/application-signing.md

It shows you that adding the parameter -n to the --releasify command it will signs all your executables files, it works, but the problem is it signs all the .exe and all the .dll files too, and i dont want to sign the dll files.

So, is there a away to specify wich files you want to sign ? Or, is there a way to skip the dll files ?

Or is there a way to sign the _ExecutionStub.exe file before packing the release ? This file is created when run "Squirrel --releasify", and when finish i think the program also create a hash of that file, so i guess it cannot be altered after that.

anaisbetts commented 7 months ago

Why would you not want to sign DLLs

emilioHayes commented 7 months ago

Why would you not want to sign DLLs

Well for two reasons: 1st Some dlls are signed by its creators, i dont want to change that.

2nd reason is from june-2023 we are force to use a USB token to can sign files and this require enter the PIN at every single request of signing file, and i have a lot of dlls on my project so i have to enter the PIN several times.

anaisbetts commented 7 months ago

1st Some dlls are signed by its creators, i dont want to change that.

Squirrel already skips signed files

2nd reason is from june-2023 we are force to use a USB token to can sign files and this require enter the PIN at every single request of signing file, and i have a lot of dlls on my project so i have to enter the PIN several times.

https://stackoverflow.com/questions/76595490/avoiding-repeated-password-prompt-when-signing-with-ev-code-signing-certificate

caesay commented 7 months ago

Just FYI, my fork of this project will sign up to 10 files at one time, so signtool is invoked less (requiring you to enter pin less times for free) and signing overall is much faster. You can also use other signing tools (eg. AzureSignTool) and there is an option to skip signing dll's etc.

emilioHayes commented 7 months ago

Thank you both for your help.

It will be cool if Squirrel --releasify command let you sign just specify files or just executable files to then can sign the _ExecutionStub.exe file on a simple way, then user do not need to get deep on another solutions.