signcode

Sign Windows executables and installers from a Mac.

Works with .pem, .p12, and .pfx code signing files.

Signs with sha1 and sha256 signatures by default.

Installing

npm install --save-dev signcode

Using

var signcode = require('signcode')

var options = {
  cert: '/Users/kevin/certs/cert.pem',
  key: '/Users/kevin/certs/key.pem',
  overwrite: true,
  path: '/Users/kevin/apps/myapp.exe'
}

signcode.sign(options, function (error) {
  if (error) {
    console.error('Signing failed', error.message)
  } else {
    console.log(options.path + ' is now signed')
  }
})

signcode.verify({ path: '/Users/kevin/apps/myapp.exe' }, function (error) {
  if (error) {
    console.error('Not signed', error.message)
  } else {
    console.log(options.path + ' is signed')
  }
})

Signing Options

Name	Type	Required	Description
cert	String	Yes	Path to a certificate file.
path	String	Yes	File path to executable to sign.
hash	Array	No	Signature types to sign the executable with. Defaults to ['sha1', 'sha256'].
key	String	No	Path to a .pem key file. Only required if cert is a .pem file.
name	String	No	Product name to include in the signature.
overwrite	Boolean	No	true to sign the executable in place, false to write the signed file at the same path but with -signed at the end of it. Defaults to false.
password	String	No	Password to the certificate or key.
passwordPath	String	No	Path to a file containing the password for the certificate or key.
site	String	No	Website URL to include in the signature.

Verification Options

Name	Type	Required	Description
path	String	Yes	File path to executable to verify.
hash	String	No	Certificate fingerprint to expect on executable.

Command Line Example

signcode sign /Users/kevin/apps/myapp.exe \
  --cert /Users/kevin/certs/cert.p12 \
  --prompt \
  --name 'My App' \
  --url 'http://birthday.pizza'
signcode verify /Users/kevin/apps/myapp.exe

Run signcode -h to see all the supported options.

Cert helpers commands

These commands are helpful when working with certificates.

Create cert and key with no password

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -nodes

Create cert and key with a password

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem

Create a p12 with no password

openssl pkcs12 -export -out ./test/fixtures/cert.p12 -inkey ./test/fixtures/key.pem -in ./test/fixtures/cert.pem

Show fingerprint of a cert

openssl x509 -noout -in ./test/fixtures/cert.pem -fingerprint -sha1

openssl x509 -noout -in ./test/fixtures/cert.pem -fingerprint -sha256