Code signing is important before releasing our software to the client. In the previous post, we use a PowerShell script to publish our code. After publishing the code, we need to sign the code before release. We must have code cert for signing. Install the code sign in your machine. Certificate installs process is simple using certificate import wizard.
Windows Certificate installation wizard.
Once the certificate is install, we can procced to code signing process.
cd src
$paths = Get-ChildItem -include *.csproj -Recurse
foreach($pathobject in $paths)
{
cd $pathobject.directory.fullName
dotnet publish -o ..\..\__DEPLOY__\Program
}
cd ..\..
This part of the code from previous post this script publish all the project in the solution.
$cert = Get-ChildItem -Path Cert:\CurrentUser\My -CodeSigningCert
Get-ChildItem -recurse -path '__DEPLOY__\' -Include *.exe, *.dll | ForEach-Object {
$signingParameters = @{
FilePath = $_.FullName
Certificate = $cert
HashAlgorithm = 'SHA256'
TimestampServer = 'http://timestamp.digicert.com'
}
Set-AuthenticodeSignature @signingParameters
}
The first line gets the signing cert path.
Next line, navigate to the code that needed to sign, in this example path is ‘__DEPLOY__’, sign will only the files with exe and dll extension. Subsequent lines shows different params for signing. You can find more about the code signing params from PowerShell documentation.
If you want to exclude any folder and files from signing, you can define like this
[string[]]$Exclude = @('ExcudeFolderName')
Get-ChildItem -recurse -path '__DEPLOY__\Program\' -Include *.exe, *.dll | Where-Object { $_.DirectoryName -notmatch $Exclude } | ForEach-Object
cd src
$paths = Get-ChildItem -include *.csproj -Recurse
foreach($pathobject in $paths)
{
cd $pathobject.directory.fullName
dotnet publish -o ..\..\__DEPLOY__\Program
}
cd ..\..
[string[]]$Exclude = @('ExcudeFolderName')
$cert = Get-ChildItem -Path Cert:\CurrentUser\My -CodeSigningCert
Get-ChildItem -recurse -path '__DEPLOY__\Program\' -Include *.exe, *.dll | Where-Object { $_.DirectoryName -notmatch $Exclude } | ForEach-Object {
$signingParameters = @{
FilePath = $_.FullName
Certificate = $cert
HashAlgorithm = 'SHA256'
TimestampServer = 'http://timestamp.digicert.com'
}
Set-AuthenticodeSignature @signingParameters
}
Above snippet is the entire script.
Happy coding 🙂
