Sign in Join

Live chat for Free Pascal, Lazarus, Delphi and every Pascal programmer.

Mailing lists / lazarus / 2024-09

Can Lazarus/FPC sign the created executables (Windows)?

7 messages · 4 people · –

Reply by email Subscribe to this list Your subscription

Read-only archive. Use j and k to move between messages.

Bo Berglund

I have run into a problem where certain customers require the applications to be "signed" and now I wonder if there is an option somewhere in Lazarus or FPC to do that when building an app?

If so how does one go about it?

Googling brings up stuff about Windows SDK etc, but I want to stay with FPC if possible....

Has someone here already done this and can share the way to do it?

Bo Berglund Developer in Sweden

Reply by email

Michael Van Canneyt
to Bo Berglund
Bo Berglund wrote 10 lines
I have run into a problem where certain customers require the applications to be "signed" and now I wonder if there is an option somewhere in Lazarus or FPC to do that when building an app? If so how does one go about it? Googling brings up stuff about Windows SDK etc, but I want to stay with FPC if possible.... Has someone here already done this and can share the way to do it?

Signing needs to be done outside of the compiler.

Lazarus can probably make a nice GUI for it and do the signing after the compile step is finished, but it is not part of the compiling step.

It's just a matter of executing the windows "signtool" with the correct options. (and the signtool is indeed part of the SDK, so you will need it in each case)

Michael.

Reply by email

Martin Frb
to Bo Berglund: I have run into a problem where certain customers require the applications to be "signed"…
Bo Berglund wrote 10 lines
I have run into a problem where certain customers require the applications to be "signed" and now I wonder if there is an option somewhere in Lazarus or FPC to do that when building an app? If so how does one go about it? Googling brings up stuff about Windows SDK etc, but I want to stay with FPC if possible.... Has someone here already done this and can share the way to do it?

" Project Options" => "Compiler Commands"

You can use "Execute after" to invoke the "signtool.exe" (can be downloaded from Microsoft).
Neither Lazarus, nor Fpc contain the functionality of the signtool (or any similar software).

The rest depends on the certificate that you use to sign with. (I.e. where/how it is stored/accessed)

Reply by email

Bo Berglund
to Martin Frb
Martin Frb wrote 20 lines
On 24/09/2024 09:09, Bo Berglund via lazarus wrote: > I have run into a problem where certain customers require the applications to be > "signed" and now I wonder if there is an option somewhere in Lazarus or FPC to > do that when building an app? > > If so how does one go about it? > > Googling brings up stuff about Windows SDK etc, but I want to stay with FPC if > possible.... > > Has someone here already done this and can share the way to do it? " Project Options" => "Compiler Commands" You can use "Execute after" to invoke the "signtool.exe" (can be downloaded from Microsoft). Neither Lazarus, nor Fpc contain the functionality of the signtool (or any similar software). The rest depends on the certificate that you use to sign with. (I.e. where/how it is stored/accessed)

OK, thanks.

I downloaded the Windows SDK installer and when I ran it I got to a selection page where I could select to ONLY install the signing tool.

The InnoSetup6 install builder does have support for signing so I will go there for further research.

Bo Berglund Developer in Sweden

Reply by email

Martin Frb
to Bo Berglund
Bo Berglund wrote 7 lines
OK, thanks. I downloaded the Windows SDK installer and when I ran it I got to a selection page where I could select to ONLY install the signing tool. The InnoSetup6 install builder does have support for signing so I will go there for further research.

Well, do you have a certificate?

This is the command I use
?? signtool.exe? sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /a ? ? C:\path\to\target.exe
The params are explained on
https://learn.microsoft.com/en-us/dotnet/framework/tools/signtool-exe

The /tr .... /td...? is optional, but recommended. And there is a list of time servers that can be used

If you have more than one certificate (added to the windows certificate store), then you may need to add something to select the one you want....

Usually, if you buy a cert, you get a piece of hardware? (e.g. usb dongle) and instructions which extra software to use to add the cert from that hardware to the cert store. (and it will only work while the dongle is plugged in).

If you want to use a self issued cert, you need to find a tutorial on that => but windows will not trust self signed certs... (Well the user may or may not be able to add your cert to their trusted cert list, but I have no idea ...)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lazarus-ide.org/pipermail/lazarus/attachments/20240924/ab54a8f6/attachment.htm>

Reply by email

Michael Van Canneyt
to Martin Frb
Martin Frb wrote 34 lines
On 24/09/2024 12:15, Bo Berglund via lazarus wrote: > OK, thanks. > > I downloaded the Windows SDK installer and when I ran it I got to a > selection > page where I could select to ONLY install the signing tool. > > The InnoSetup6 install builder does have support for signing so I will go > there > for further research. Well, do you have a certificate? This is the command I use ?? signtool.exe? sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /a ? ? C:\path\to\target.exe The params are explained on https://learn.microsoft.com/en-us/dotnet/framework/tools/signtool-exe The /tr .... /td...? is optional, but recommended. And there is a list of time servers that can be used If you have more than one certificate (added to the windows certificate store), then you may need to add something to select the one you want.... Usually, if you buy a cert, you get a piece of hardware? (e.g. usb dongle) and instructions which extra software to use to add the cert from that hardware to the cert store. (and it will only work while the dongle is plugged in). If you want to use a self issued cert, you need to find a tutorial on that => but windows will not trust self signed certs... (Well the user may or may not be able to add your cert to their trusted cert list, but I have no idea ...)

It's maybe an idea to add a small wizard for this to the IDE, for beginners this would be easier.

Michael.

Reply by email