Visual studio installer project code signing issue

Question

Visual studio installer project code signing issue

jesdev7 6

I've been trying to get my .NET core program signed (the executable and dlls) with Visual Studio.
In the build directory everything works fine: the properties of the files show my digital signature.

However when I use the Visual Studio Installer Projects extension to make a .msi installer it doesn't seem to sign anything.
The extracted files of my program after running the installer on a clean machine don't have a digital signature.
I've tried using the "Sign the assembly" option in the project settings as well as using signtool.exe in the post build event.
Both options seem to give the same end result.

I'm using Visual Studio 2019 Professional. Maybe there's an option I'm missing but I can't seem to figure it out.
This is the first time I'm using code signing in a project.

David Lowndes 4,731 Reputation points

2022-08-03T15:02:43.483+00:00

The extracted files of my program after running the installer on a clean machine don't have a digital signature.

Are you sure your installer project is picking up the signed EXE/DLLs?
jesdev7 6 Reputation points

2022-08-04T14:13:17.687+00:00

I double checked the source path of the published items in the installer.
Turns out it actually used the files from the obj folder and not the bin folder.
So I explicitly defined the files in the obj folder to sign with signtool.exe in the post build event and those now get signed.
After rebuilding and running the installer though the files remain unsigned in the installation folder.
David Lowndes 4,731 Reputation points

2022-08-04T15:00:35.97+00:00

I don't know what else to suggest. I really can't imagine that the installer would be stripping the signature off. I'm not seeing that with my projects - though they're not .NET ones.
sho 1 Reputation point

2022-08-24T13:20:05.79+00:00

I'm having the same issues using Visual Studio 2022 (17.3.2).

Having the signtool sign the project dll's (and some nuget package dll's as the customer wants everything signed) in the bin\Release folder

Looking at the build process, using Sysiternals Process Monitor, it seems that the setup project gets the files from the obj\Release and packages directories instead.

Resolved it by Excluding the signed assemblies from the dependencies and removing Primary output and instead manually adding the required files from the bin\Release folder.
pekatete 1 Reputation point

2022-11-10T13:20:54.55+00:00

I have this issue too.
Seeing that the Microsoft Store now requires submissions of .msi apps to have the included app signed as well as the msi, this should really be addresses without deploying hacks.

With a .NET 6 (and now 7) winforms app, the contents of the **obj*\Release\net6.0-windows** are the *.dll and apphost.exe (to mention but a few). Adding a post-build event to sign those files does not work. Also signing the final output via post build even in app or a pre-build event to sign the input to the setup project (in the setup project) does not work.

5 answers

Your answer

David Lowndes 4,731 Reputation points

2022-08-03T15:02:43.483+00:00

The extracted files of my program after running the installer on a clean machine don't have a digital signature.

Are you sure your installer project is picking up the signed EXE/DLLs?
jesdev7 6 Reputation points

2022-08-04T14:13:17.687+00:00

I double checked the source path of the published items in the installer.
Turns out it actually used the files from the obj folder and not the bin folder.
So I explicitly defined the files in the obj folder to sign with signtool.exe in the post build event and those now get signed.
After rebuilding and running the installer though the files remain unsigned in the installation folder.
David Lowndes 4,731 Reputation points

2022-08-04T15:00:35.97+00:00

I don't know what else to suggest. I really can't imagine that the installer would be stripping the signature off. I'm not seeing that with my projects - though they're not .NET ones.
sho 1 Reputation point

2022-08-24T13:20:05.79+00:00

I'm having the same issues using Visual Studio 2022 (17.3.2).

Having the signtool sign the project dll's (and some nuget package dll's as the customer wants everything signed) in the bin\Release folder

Looking at the build process, using Sysiternals Process Monitor, it seems that the setup project gets the files from the obj\Release and packages directories instead.

Resolved it by Excluding the signed assemblies from the dependencies and removing Primary output and instead manually adding the required files from the bin\Release folder.
pekatete 1 Reputation point

2022-11-10T13:20:54.55+00:00

I have this issue too.
Seeing that the Microsoft Store now requires submissions of .msi apps to have the included app signed as well as the msi, this should really be addresses without deploying hacks.

With a .NET 6 (and now 7) winforms app, the contents of the **obj*\Release\net6.0-windows** are the *.dll and apphost.exe (to mention but a few). Adding a post-build event to sign those files does not work. Also signing the final output via post build even in app or a pre-build event to sign the input to the setup project (in the setup project) does not work.

Answer 1

Becker, W 66

I managed to solve the problem by copying the signed output of my project inside the postbuild event to obj\release. This is leads to signed files inside the .msi file.

post build event:

if $(ConfigurationName) == Release (
   sign code artifact-signing "$(TargetPath)" -ase "%AZURE_SIGNING_ENDPOINT%" -asa "%AZURE_SIGNING_ACCOUNT%" -ascp "%AZURE_SIGNING_CERT_PROFILE%" -t http://timestamp.acs.microsoft.com/ -fd sha256

   copy /Y "$(TargetPath)" "$(ProjectDir)$(IntermediateOutputPath)$(TargetFileName)"
)

0 comments

Answer 2

DANIEL GIBBS 0

Had the same issue.

Build your Code project (Release build) and sign the executables in \bin\release, bin\release\app.publish and \obj\release. Quicker than figuring out which one it uses.

Before building the MSI (Release build) delete all files in the Installer project \bin\release folder (msi / exe)

Now build the MSI - should be good

0 comments

Answer 3

Okundu Omeni 5

I am having exactly the same issue with VS2022. I initially thought the issue was when I was doing the signing in the wrong folder as the binaries in the publish folder were not signed. So i added a pre-build event to the installer to sign the binaries in the published folder before generating the msi. When I checked the published folder the binaries are now signed but the generated msioutput binaries are still unsigned.

It would appear the signing is being reversed by the packaging process.

0 comments

Answer 4

Michael Pasternak 0

It does not work. Microsoft team, please fix this bug

0 comments

Answer 5

Tianyu Sun-MSFT 34,841 Microsoft External Staff

Hi @jesdev7 ,

Welcome to Microsoft Q&A forum.

Please try to select Release, and rebuild the Setup project under Release mode, then check if it works.

Best Regards,
Tianyu

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Michael Pasternak 0 Reputation points

2024-03-26T16:33:39.1933333+00:00

Dear Microsoft team!

Please fix this BUG. Problem in Visual Studio 2022 even worse. The single solution that I found is to sign files in OBJ\RELESE folder.

It is very inconvenient