Digitally signing an InstallShield Executable With An Automated Build Process

Those that are familiar with InstallShield knows about the option to digitally sign your executable, DLLs and other helper classes. You simply enter the paths to your .spc and .pvk certificates along with your password and the files are digitally signed ever time you build a release. You also have the option of using the newer .pfx certificate along with your password to do the same thing. Either way works just fine if you are manually building your installer. If you are trying to automate this process, you will run into trouble.

The sign process is one of the most hockey things InstallShield has slapped together. Have you ever noticed small dialog boxes that seem to flicker on the screen during the build of the release? That is the sign code in action. I'm pretty sure this process applies for several versions back, but the 2009 InstallShield Premier edition is where I discovered this blunder. What this is actually doing in the background is calling signcode.exe in the background and pasting your password into the dialog box that signcode prompts the user for. Obviously, when you are trying to automate the build process, no dialogs or UI of any kind can pop up or it will hang the program. That is what was happening to me.

There is a solution, sort of. In order to automate the build, you will have to pull the code signing out of InstallShield and do it yourself via command line. InstallShield uses SignCode.exe, but it also comes with SignTool.exe that will allow you to pass your password to it via command line. The one catch is that you must use a .pfx formatted certificate in order to use SignTool.exe. So, what I did was call ISCmdBld.exe to build my installer and right after that, I called SignTool.exe with the command line switches it would be looking for. The defination of switches available should be viewable if you place a /? after the call. The steps for automating the build process and calling SignTool.exe you will have to look up somewhere else. There are loads of data about how that works, but the one thing I never found spelled out anywhere is the fact that InstallShield simply is not capable of automating the digital signiture process inside of its build steps.

Creating a Silent Installation with Acresso InstallShield

There are a few project types in which to develop your installations in. One common project type is the Windows Installer or MSI. However, the project type I am developing in is the InstallScript project type. In order for an InstallScript project to run silently, you must first create a response file. The file directs the setup through the answers that a user would normally have to answer. The response file is a text file except that it has the ".iss" file type normally named "Setup.iss". I'm not going to explain more about this response file process. That is well documented in other places and can be easily found on the internet. What I want to talk about is how the setup can be created as one executable with the Setup.iss wrapped into it.

Here is the trick that I couldn't even find in Acresso's knowledge base. To wrap the response file into the installation so it isn't a separate file that you have to lug around with the setup executable, put it in the Support directory. More specifically, place it in the "Disk 1" subdirectory under the Support section. Simple, but effective. It took me 2 days to discover how to do this.

The Woes of Developing With InstallShield

For a year now, I have been in charge of building the installation software for our applications. I use InstallShield to create the setup. The first thing I had to do was convert the project from InstallShield 6 to InstallShield Premier 2009. It wouldn't be so bad if there weren't so many gothcas about how things work.

For those of you that may not know what InstallShield is, it is basically the software behind making it simple to load software onto a computer. For example, if you wanted to load Microsoft Word to your computer, you would put the disc in and run the wizard-like setup process to install it. That wizard-like setup process is what InstallShield allows you to develop. I just wish some things where better documented and sometimes worked a little differently.

I've had to learn some tricks and unknown facts through lots of trial and error, so I'd like to share some of those tricks that have worked for me. There are several, so I'll break them up into other posts.