Using Authenticode with ClickOnce WPF Application

Question

Well, I am not doing anything right, and I need help. Here's what happens:

• I have a “real” Authenticode certificate from Comodo that I paid for.
• I am trying to sign and deploy a WPF application written in Visual Studio 2012 and .NET 4.5.
• In the project properties, I checked "Sign the ClickOnce manifest" and selected my certificate.
• I also use Comodo timestamp ( http://timestamp.comodoca.com/authenticode )
• On the Publish tab and in the Prerequisites section, I checked Create an installer to install components of the required components.

When I build and publish, everything works! The setup.exe file is signed with my Comodo certificate, so ok. In addition, the .application file .application signed with a Comodo certificate, and my company name is displayed as a publisher - this is also good.

Here the problem arises: after the application is downloaded to the client, Windows 8 issues a warning about an unreliable program (MyProgram.exe), and the publisher is not my company name. So, everything is signed, except for the actual executable.

I tried to add a post-build script that uses signtool.exe for obj \ Release \ MyProgram.exe, but when I try to install the application, I get an explicit error stating that the hash values ​​are not used, t. In other words, a manifest is generated before the post-build event.

How to sign my .exe and maintain the integrity of the ClickOnce manifest? Is there an easy way to do this or do I need to use mage.exe for each file manually (hopefully not)?

Answer 1

Well, nobody jumped on it, but, fortunately, I figured it out!

Thanks to this question: "The file has a different hash than what is indicated in the manifest" error signing the EXE

I managed to edit the XML project file (upload the project, then select "Edit myproject.csproj") and added:

  <Target Name="SignOutput" AfterTargets="CoreCompile"> <PropertyGroup> <TimestampServerUrl>http://timestamp.comodoca.com/authenticode</TimestampServerUrl> <ApplicationDescription>My Project Friendly Name</ApplicationDescription> <SigningCertificateCriteria>/n MyCertName</SigningCertificateCriteria> </PropertyGroup> <ItemGroup> <SignableFiles Include="$(ProjectDir)obj\$(ConfigurationName)\$(TargetName)$(TargetExt)" /> </ItemGroup> <GetFrameworkSdkPath> <Output TaskParameter="Path" PropertyName="SdkPath" /> </GetFrameworkSdkPath> <Exec Command="&quot;$(SdkPath)bin\signtool&quot; sign $(SigningCertificateCriteria) /d &quot;$(ApplicationDescription)&quot; /t &quot;$(TimestampServerUrl)&quot; &quot;%(SignableFiles.Identity)&quot;" /> 

I had to move the signtool.exe file to the SDK folder (C: \ Program Files (x86) \ Microsoft SDK \ Windows \ v8.0A \ bin, in my case), but after that it worked like a charm

I hope this helps someone else in the future.