You can sign binary files inside your Kango based extension during build time. The signing is possible both on all supported platforms. You need a proper .pfx certificate file for codesign on Windows, for codesing on Linux and Mac you need to convert .pfx file.
You will require follow items for codesign.
On Windows
On Linux and Mac
Note
This article is describing signing process using osslsigncode tool, you can also choose signcode tool from Mono packages.
Let say you have a extension.pfx that works well for you on Windows. You need to do follow commands to convert it to Key/Cert pair using OpenSSL:
openssl pkcs12 -in extension.pfx -nocerts -nodes -out mykey.pem
openssl pkcs12 -in extension.pfx -nokeys -out mycert.pem
openssl crl2pkcs7 -nocrl -certfile mycert.pem -outform DER -out extension.spc
openssl rsa -outform der -in mykey.pem -out extension.der
rm mykey.pem mycert.pem
After executing these commands you will get extension.spc and extension.der files that could be used with osslsigncode
For signing files inside your extension you need to create a buildstep in your project folder. Create a folder named buildsteps on the same level you have src and certificates folders. Place a file named sign.cmd on Windows and sign.sh on Linux.
On Windows sign.cmd file content should be like:
@echo off
SET SIGNTOOL="../../tools/signtool.exe"
SET PFXFILE="../../certificates/extension.pfx"
SET PFXPASS="TestExtensionPfxPassword"
FOR /R %%i IN (*.exe *.dll) DO @(
%SIGNTOOL% sign /f %PFXFILE% /p %PFXPASS% /t http://timestamp.verisign.com/scripts/timstamp.dll %%i
)
Where SIGNTOOL, PFXFILE and PFXPASS should have appropriate values.
On Linux sign.sh file content should be:
#!/bin/sh
SIGNTOOL="../../tools/osslsigncode"
CERT="../../certificates/extension.spc"
KEY="../../certificates/extension.der"
for file in ./*.exe ./*.dll
do
if [ -f "$file" ]; then
$SIGNTOOL -spc $CERT -key $KEY -t "http://timestamp.verisign.com/scripts/timstamp.dll" -in $file -out $file.signed > /dev/null
if [ -f "$file.signed" ]; then
mv $file.signed $file
fi
fi
done
Where SIGNTOOL, CERT and KEY should have appropriate values.
After signing all the binaries inside the extension you can sign .exe installer file. You need to add some lines to your build.cmd or build.sh files
build.cmd:
@echo off
SET KANGODIR=..\..\
SET SIGNTOOL="tools/signtool.exe"
SET PFXFILE="certificates/extension.pfx"
SET PFXPASS="TestExtensionPfxPassword"
call "%KANGODIR%\kango.py" build .\
FOR /R %%i IN (output\*.exe) DO @(
%SIGNTOOL% sign /f %PFXFILE% /p %PFXPASS% /t http://timestamp.verisign.com/scripts/timstamp.dll "%%i"
)
build.sh:
#!/bin/bash
KANGODIR="../.."
SIGNTOOL="./tools/osslsigncode"
CERT="./certificates/extension.spc"
KEY="./certificates/extension.der"
python $KANGODIR/kango.py build ./
for file in ./output/*.exe
do
if [ -f "$file" ]; then
$SIGNTOOL -spc $CERT -key $KEY -t "http://timestamp.verisign.com/scripts/timstamp.dll" -in $file -out $file.signed > /dev/null
if [ -f "$file.signed" ]; then
mv $file.signed $file
fi
fi
done