Code-Signing: what types of files should I sign and why?

Question

I have a new code signing certificate, and I wonder what files I should sign.

Obviously, the .msi installation package and all .exe that start with a promotion must be signed to avoid "unknown publisher" warnings, but I must sign other executables, such as ..exe, which do not require a promotion, .dll or .oxc?

It seems that Microsoft itself is doing this inconsistently:

• In Office 2007, all executables are assigned
• In Visual Studio 2008, all .exe and many .dlls are signed, but there are also many unsigned DLLs (apparently strong assembly names, perhaps they think strong naming is enough)
• On Windows (7), neither executables nor DLLs are signed (even executables that need UAC, for example, mmc.exe!)

Answer 1

I think you answered your question, subscribe only where necessary to avoid prompting.

There are only a few reasons why I will consider everything.

• This may have some advantage with the antivirus vendors, your files are more reliable, so there is less support / installation hassle.
• It marks the file as more reliable for the average user, for example, when I clean the virus infected system using autorun from MS. I tend to look for crappy material that doesn't have a signature; it draws a mile.
• You want to look more professional.

I don’t know what the overhead of verifying a signature is, so older systems can be slower. In addition, if your certificate is owned by a cheap certificate provider, the root CA may not be included in older platforms (XP pre SP2, etc.).

Oh yes, I would only do this as part of the assembly (integrated into MSBuild or the build server), as this can become tedious.

Do not forget that someone else has not gained access to your key, otherwise you will cancel it, and suddenly the settings may stop working. Therefore, use a self-signed certificate for developers and keep the real key on the build server.

Bit bitming, but there is no right answer, I think.