Hi Catalin,
thanks for the update.
A different signtool.exe would not help, as AI executes the "different signtool.exe" for each file to sign individually. So we do not have a session here (or technically: not a session over multiple files to sign) and need a PIN entry for every session aka each file to sign.
Ignoring the security implications completely, ScSigntool.exe would help by allowing the PIN to be set on the command line.
However, I cannot thing of any (trusted) certification authority that allows (TOS) the PIN to be stored anywhere (plaintext, ciphertext, credential store), and from a security standpoint, it would be "unwise" to have the PIN listed in shell history files, process explorers and (possible) log files.
The only solution(s) that works and follows basic security standards would be that
- AI creates a CSP session and uses this session for the entire build run (incl. all build flavours), or
- AI implements the option (additional checkbox for the "different signtool.exe" use case) to pass all files to be signed to the "different signtool.exe".
I guess the workaround with passing all files to be signed to the "different signtool.exe" at ones (example below) would be very easy to implement on your side. With this workaround, I guess there are only 3 PIN entries (calls) per build flavour (signing content files, archives, and final MSI).
Code: Select all
Path = C:\DifferentSignTool.exe
CommandLine = sign /a /d "<signature description>" /du "Description URL" /fd SHA256 /tr "http://timestamp.digicert.com" /td sha256
MultipleFiles = True
this will result in
Code: Select all
C:\DifferentSignTool.exe sign /a /d "<signature description>" /du "Description URL" /fd SHA256 /tr "http://timestamp.digicert.com" /td sha256 C:\Project\File1.exe C:\Project\File2.dll C:\Project\File3.cab C:\Project\File4.ocx C:\Project\File5.jar C:\SetupFiles\Updater.exe
C:\DifferentSignTool.exe sign /a /d "<signature description>" /du "Description URL" /fd SHA256 /tr "http://timestamp.digicert.com" /td sha256 C:\SetupFiles\MainFeature.cab C:\SetupFiles\UpdaterFeature.cab
C:\DifferentSignTool.exe sign /a /d "<signature description>" /du "Description URL" /fd SHA256 /tr "http://timestamp.digicert.com" /td sha256 C:\SetupFiles\Project.msi
However, this would also be a crude workaround. The ideal solution without each customer has to build its own intermediate application would be to implement CSP session into AI. But the workaround would be very helpful in the meantime.
).