signcode
Sign Windows executables and installers from a Mac.
Works with .pem
, .p12
, and .pfx
code signing files.
Signs with sha1
and sha256
signatures by default.
Installing
npm install --save-dev signcode
Using
var signcode = require('signcode')
var options = {
cert: '/Users/kevin/certs/cert.pem',
key: '/Users/kevin/certs/key.pem',
overwrite: true,
path: '/Users/kevin/apps/myapp.exe'
}
signcode.sign(options, function (error) {
if (error) {
console.error('Signing failed', error.message)
} else {
console.log(options.path + ' is now signed')
}
})
signcode.verify({ path: '/Users/kevin/apps/myapp.exe' }, function (error) {
if (error) {
console.error('Not signed', error.message)
} else {
console.log(options.path + ' is signed')
}
})
Signing Options
Name | Type | Required | Description |
---|---|---|---|
cert |
String |
Yes | Path to a certificate file. |
path |
String |
Yes | File path to executable to sign. |
hash |
Array |
No | Signature types to sign the executable with. Defaults to ['sha1', 'sha256'] . |
key |
String |
No | Path to a .pem key file. Only required if cert is a .pem file. |
name |
String |
No | Product name to include in the signature. |
overwrite |
Boolean |
No | true to sign the executable in place, false to write the signed file at the same path but with -signed at the end of it. Defaults to false . |
password |
String |
No | Password to the certificate or key. |
passwordPath |
String |
No | Path to a file containing the password for the certificate or key. |
site |
String |
No | Website URL to include in the signature. |
Verification Options
Name | Type | Required | Description |
---|---|---|---|
path |
String |
Yes | File path to executable to verify. |
hash |
String |
No | Certificate fingerprint to expect on executable. |
Command Line Example
signcode sign /Users/kevin/apps/myapp.exe \
--cert /Users/kevin/certs/cert.p12 \
--prompt \
--name 'My App' \
--url 'http://birthday.pizza'
signcode verify /Users/kevin/apps/myapp.exe
Run signcode -h
to see all the supported options.
Cert helpers commands
These commands are helpful when working with certificates.
Create cert and key with no password
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -nodes
Create cert and key with a password
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem
Create a p12 with no password
openssl pkcs12 -export -out ./test/fixtures/cert.p12 -inkey ./test/fixtures/key.pem -in ./test/fixtures/cert.pem
Show fingerprint of a cert
openssl x509 -noout -in ./test/fixtures/cert.pem -fingerprint -sha1
openssl x509 -noout -in ./test/fixtures/cert.pem -fingerprint -sha256