Digital Workshop

Hi

Anyone have any experience code signing a publication file (exe) directly? I usually code sign a setup file which works well. However, I am creating a small, standalone file for internet download and don't want any extra steps in the process of using it (i.e. click and open). If I use SignCode.exe, the publication file becomes corrupted and will not open (ILM: Cannot find publication file).

This may be too obscure a problem and I don't want to start editing binaries. Just wondered if anyone had come across this issue. From what I have found on the net, it is likely a problem with the exe rather than the signcode ap.

Cheers
Dan

You could try code signing your ilmplay.exe file (in Opus' players\win32 directory) and then publishing. I would imagine the fact that the EXE has changed since code signing would invalidate the code, but it'd be worth a try.

That was a good call thanks Dave, but it didn't quite get us over the line. The player is signed, but something still gets corrupted on publishing. The output does open now and the file properties suggest that the signature is in place with all details correct. However, it also states that it is not valid, and on downloading, Windows presents this as 'Unknown Publisher'.

Thanks for the idea (any others are welcome). The alternative is that I just create a very simple Setup package that copies the file to a temp directory and runs it.

Cheers
Dan

If you post a link to a code signed EXE (using your original method), I'll see if I can get it to work.

Cheers Dave

There are 3 versions in the zipped file:

http://www.orbeducation.co.uk/Pub.zip


1. Unsigned.exe
2. Signed.exe (signed afterwards with MS SignCode.exe)
3. Sig Player.exe (player signed before publishing)

Thanks for having a look at this. My other idea wasn't great, as any use of the setup packager resulted in a file that would likely result in the end of civilised society as we know it (according to MS, atleast). We predominantly sell to schools, and teachers are more likely to be able to run an exe than have install rights.

Ta
Dan

PS. I just read my forum signature. Opus V6 has so far worked without issue on Windows 7.

is there any way you can make that one thread the only thread they may post on?

What is the progress of code signing Opus publications? If someone is doing this on a regular basis can you post a tutorial of what to do and with costs involved.


Thanks.

Code signing is difficult to set up and can cost a bit. Be warned

Generally, we use a setup packager to create an install file with the Opus files, icons and a few other bits and bobs. This package is then code signed. On one project, I tried to code-sign the opus file directly, but this corrupted the file. Stick with packaging for now.

There are plenty of tutorials online. Generally:

1. Select a packager (we purchased Setup Builder from lindersoft, but have used free ones in the past). The packager must support code-signing.

2. Buy a certificate (can be a nightmare). We use Comodo.

3. Install the certificate and get it working with the packager (can be even more of a nightmare, especially on Vista or later).

I would suggest you go for as long a period as you are comfortable with. If you go for a 12 month solution you have to do it all again in a year.

The following thread gives you an idea about the type of issues you generally come across. We had similar issues with a different packager/certificate combination used previously, so they are common.
http://www.lindersoft.com/forums/showthread.php?t=8279

Someone may want to add other experiences to this, or flesh out the details.

Cheers
Dan

Have you tried it with Opus v7? The player should now be a bit more forgiving.

Opus 7 publications can be signed and packaged quite easily and run without any of the problems that previous versions experienced.

Mack

Excellent Mack, is the procedure similar to Dan?

So is it a case of purchasing a Code Signing Certificate, I noticed Comodo.com charge $179 per year and GoDaddy.com charge $199 per year. The price comes down if purchased for longer periods.

So assuming I purchase the certificate, and I use my installer/packager software of choice. I use QSetup from Pantaray Software myself, this supports code signing. Sp the code is applied to the Opus produced exe through the installer/packager.

So each time I release an update or rebuild using Opus, I assume I just apply the same certificate to the exe.

Sorry for the questions, this is something I never looked into before, but will need to do soon and just want to know procedure.

Thanks for the replies.


Just checked prices from Lindersoft, great deals there from $79
http://www.lindersoft.com/products_secu ... rvices.htm

If you are just going to sign and zip the opus exe (and this is now OK with V7) then you can use SignCode.exe (you still have to install your certificates first etc).

If you are using a set-up packager, then I think you probably need to sign the package as it is being created rather than the opus file that goes inside. You save all the settings, so you simply run the packager whenever you publish.

Sorry - this process is a bit hazy already.

I will be doing this procedure soon and will update on progress.

Here is another article that outlines pretty clearly the steps for getting a certificate from a CA.
While the beginning of the article focuses on Microsoft dev/projects, the main part is good information.

Step-by-step guide to purchasing a certificate
http://www.jeff.wilcox.name/2010/02/codesigning101/