I've been trying to wrap my mind around Authenticode certificates for a week now. I purchased a CSC from Comodo and I've got a ClickOnce application I'd like to sign so that the SmartScreen Filter warnings go away.
My application assembly is strong-named and I've ticked the box to "Sign the assembly" in my Project Properties. I've also ticked the box to "Sign the ClickOnce manifest" in the same Project Properties. And finally, I have the following executions set up as AfterCompile targets in my project file, in order to dual-sign the executable with both SHA1 and SHA256:
<Target Name="AfterCompile">
<Exec Command=""C:\Program Files (x86)\Windows Kits\8.1\bin\x64\signtool.exe" sign /f "$(ProjectDir)certificate.pfx" /p mypassword /t http://timestamp.comodoca.com /v "$(ProjectDir)obj\$(ConfigurationName)\$(TargetFileName)"" />
<Exec Command=""C:\Program Files (x86)\Windows Kits\8.1\bin\x64\signtool.exe" sign /f "$(ProjectDir)certificate.pfx" /p mypassword /fd sha256 /tr http://timestamp.comodoca.com/?td=sha256 /td sha256 /as /v "$(ProjectDir)obj\$(ConfigurationName)\$(TargetFileName)"" />
</Target>
Then I run the following the command to publish the project:
"C:\Program Files (x86)\MSBuild\14.0\Bin\MSBuild.exe" /target:Publish /p:Configuration=Release /p:Platform=AnyCPU MyCoolApplication.csproj
What I've noticed is that this command ultimately creates three separate versions of MyCoolApplication.exe:
- It builds one copy in bin\Release, which is unsigned
- It builds another copy in obj\Release, which is dual-signed
- It builds a final copy in bin\Release\app.publish, which is signed only once and appears to be missing a timestamp
Unfortunately it's the copy in bin\Release\app.publish that needs to work, but for some reason this version is removing the dual signature. My understanding – which could be wrong – was that it built things in obj\Release, copied them to bin\Release\app.publish, and then signed the manifest. However clearly something else is going on, as the digital signature on the final executable is clearly changed. Here's the properties of those two files side-by-side:
The problem with the final single-signed/missing timestamp version is that the application still gets flagged with the SmartScreen filter, rendering the whole process pointless. How can I fix this?
UPDATE: After reading this guide, it seems that even if I sign things properly, I may still bump into the SmartScreen Filter by virtue of not having enough "reputation" for my application. However I would like to confirm that I have signed things properly in the first place, and am not chasing smoke. (Or if this is indicative of a breakdown in the build process, I want to correct that!)
EDIT: Here is the end of the MSBuild.exe output, which @CodeFuller has requested:
AfterCompile:
"signtool.exe" sign /f "certificate.pfx" /p mypassword /t http://timestamp.comodoca.com /v "MyCoolApplication\obj\Release\MyCoolApplication.exe"
The following certificate was selected:
...
Done Adding Additional Store
Successfully signed: MyCoolApplication\obj\Release\MyCoolApplication.exe
Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0
"signtool.exe" sign /f "MyCoolApp lication\certificate.pfx" /p mypassword /fd sha256 /tr http://timestamp.comodoca.com/?td=sha256 /td sha256 /as /v "MyCoolApplication\obj\Release\MyCoolApplication.exe"
The following certificate was selected:
...
Done Adding Additional Store
Successfully signed: MyCoolApplication\obj\Release\MyCoolApplication.exe
Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0
_DeploymentComputeClickOnceManifestInfo:
Creating directory "bin\Release\app.publish".
Copying file from "obj\Release\MyCoolApplication.exe" to "bin\Release\app.publish\MyCoolApplication.exe".
_CopyAppConfigFile:
Copying file from "App.config" to "bin\Release\MyCoolApplication.exe.config".
_CopyManifestFiles:
Copying file from "obj\Release\MyCoolApplication.exe.manifest" to "bin\Release\MyCoolApplication.exe.manifest".
MyCoolApplication -> C:\Users\Gordon\Documents\Visual Studio 2015\Projects\MyCoolApplication\MyCoolApplication\bin\Release\MyCoolApplication.exe.manifest
Copying file from "obj\Release\MyCoolApplication.application" to "bin\Release\MyCoolApplication.application".
MyCoolApplication -> C:\Users\Gordon\Documents\Visual Studio 2015\Projects\MyCoolApplication\MyCoolApplication\bin\Release\MyCoolApplication.application
CopyFilesToOutputDirectory:
Copying file from "obj\Release\MyCoolApplication.exe" to "bin\Release\MyCoolApplication.exe".
MyCoolApplication -> C:\Users\Gordon\Documents\Visual Studio 2015\Projects\MyCoolApplication\MyCoolApplication\bin\Release\MyCoolApplication.exe
Copying file from "obj\Release\MyCoolApplication.pdb" to "bin\Release\MyCoolApplication.pdb".
_CopyFilesToPublishFolder:
Creating directory "bin\Release\app.publish\Application Files\MyCoolApplication_1_0_0_0".
Copying file from "bin\Release\MyCoolApplication.exe.manifest" to "bin\Release\app.publish\Application Files\MyCoolApplication_1_0_0_0\MyCoolApplication.exe.manifest". Copying file from "bin\Release\app.publish\MyCoolApplication.exe" to "bin\Release\app.publish\Application Files\MyCoolApplication_1_0_0_0\MyCoolApplication.exe.deploy". Copying file from "App.config" to "bin\Release\app.publish\Application Files\MyCoolApplication_1_0_0_0\MyCoolApplication.exe.config.deploy". Copying file from "triforce.ico" to "bin\Release\app.publish\Application Files\MyCoolApplication_1_0_0_0\triforce.ico.deploy". Done Building Project "C:\Users\Gordon\Documents\Visual Studio 2015\Projects\MyCoolApplication\MyCoolApplication\MyCoolApplication.csproj" (Publish target(s)).
Build succeeded. 0 Warning(s) 0 Error(s)
Time Elapsed 00:00:06.53
