.NET code assembly sign or just customization?

Question

My company finally bought a code signing certificate.

I have a WinForms application (1 exe and several dlls), all assemblies are already signed with a strong name. The entire application is then packaged in the msi installer. Then I use NSIS to package msi, bootstrapper and prerequisites (Framework, SQL CE ...) into a single setup.exe file.

Obviously, the setup.exe file must be signed in order to avoid a "scary" UAC request. Is that enough or are you also signing other files, especially .NET assemblies?

Another project that relates to the application is Windows serialization. Would you sign this assembly?

Answer 1

You do not have to, but this is not a bad idea.

Create a fully verified signed installation

You can use these guidelines for an entire Windows installer digitally signed installation.

Authors of the Windows installer installation must adhere to ensuring that all parts of the installation are digitally signed:

• Use internal cabinet files or use signed external cabinet files and correctly author the MsiDigitalSignature table and the MsiDigitalCertificate table.
• Use only custom actions stored in the package or installed with the package.
• Sign the installation package.
• Include the MsiPatchCertificate table in the package. To enable the User Account Control (UAC) Patching, this table must contain the information used to identify signed certificates for digitally signing patches. The UAC hotfix allows the author an installation package for digitally signed identification, which may be applied in the future by a non-administrator.

The above instructions describe what you need to do for the installer itself. The signing of meetings is up to you and is a separate issue and has individual problems and benefits. Please read Strong name assemblies may deter you from Hell DLLs for more information on signing assemblies.