SignTool.exe as a server.
This tool is intended to be run locally (intranet), use with caution.
1. Install the hardware token driver, me using SafeNet;
Note: Remember to turn on "enable single logon" in driver client settings.
2. Install the certificate correctly, me using DigiCertHardwareCertificateInstaller;
Note: Remember to also install the certificate into your PC.
3. Check if you've done right by running script below in PowerShell:
gci -Recurse Cert: -CodeSigningCert
If you see the certificate name installed from 1 and 2, then you're done.
Otherwise, make sure you have the hardware token connected and try again.
4. Install Node.js >= 18;
5. Install SignTool.exe from Windows SDK Installer.
Note: You cannot complete some steps above through a Windows Remote Desktop client.
git clone https://github.com/netless-io/sign-server
cd sign-server
npm start
------
serving http://{local-ip}:3000
Remember the {local-ip} output above, you will use it in the sign.js.
See next section.
If you see errors when running 'npm start', see the errors table below.
- Not found SignTool.exe
- Go edit package.json/config.signtool.
- Not found certificate
- Make sure you have successfully completed the first section and your hardware token is currently connected.
- Found multiple certificates
- Go edit package.json/config.subject.
You can access the built-in web UI through the address (http://{local-ip}:3000) printed above. It includes a simple example of uploading a file and sign it. You can test the code signing there before hitting the next section.
See the doc about using custom signing.
See the example sign.js, remember to replace the {local-ip} with the real IP address.
Note: You need at least Node.js 18 to run the electron builder because this script uses the native fetch() API to upload files to the server. If you don't have one, you can import {fetch, FormData} from "undici".
signtool sign
/debug /td sha256 /tr http://timestamp.digicert.com /as
/fd {hash} /sha1 {thumbprint} /s {store} /sm
{file.exe}
- SignTool.exe (Sign Tool)
- Integrate signing with Electron Builder
- app-builder-lib/src/codeSign/windowsCodeSign.ts
The MIT license.