Sign the MuseScore installer

• Apr 3, 2012 - 15:04
Type
Functional
Severity
S4 - Minor
Status
closed
Project
MuseScore

We received a question from a Microsoft employee: "did you guys actually digitally sign the install routine so it's source can be publicly verified?". The answer is no, not yet.

First investigation reveals that we will need to acquire a Certificate from a Certificate Authority.

Source:
* http://stackoverflow.com/questions/2282002/how-to-sign-an-installer-to-…
* http://msdn.microsoft.com/en-us/library/ms537361(VS.85).aspx

Comments

• Feb 27, 2013 - 10:14

Build procedure to sign MuseScore 1.3 binaries and installer

SignTool is necessary. It's part of the Windows SDK.
An authenticode certificate needs to be installed on the computer.

Compile and install

make -f Makefile.mingw release
make -f Makefile.mingw install

Sign all exe and dll files in win32install. Timestamp them. Substitute CERT filename and PASSWORD.

set dSource=win32install
for /f "delims=" %%f in ('dir /a-d /b /s "%dSource%\*.dll" "%dSource%\*.exe"') do (
echo "Signing %%f"
SignTool" sign /f "CERT.pfx" /t http://timestamp.verisign.com/scripts/timstamp.dll /p PASSWORD "%%f"
)

Package

make -f Makefile.mingw package

Sign the installers Substitute CERT filename and PASSWORD.

set FILEPATH=win32build\MuseScore-1.3.msi
for /F %%i in ("%FILEPATH%") do set FILENAME=%%~nxI
SignTool sign /f "CERT.pfx" /t http://timestamp.verisign.com/scripts/timstamp.dll /p PASSWORD /d %FILENAME% %FILEPATH%


set FILEPATH=win32build\MuseScore-1.3.exe
for /F %%i in ("%FILEPATH%") do set FILENAME=%%~nxI
SignTool sign /f "CERT.pfx" /t http://timestamp.verisign.com/scripts/timstamp.dll /p PASSWORD /d %FILENAME% %FILEPATH%

Reply