1.0.0 • Published 7 years ago

signtool v1.0.0

Weekly downloads
763
License
MIT
Repository
github
Last release
7 years ago

node-signtool

node-signtool is a Node module wrapper around the SignTool binary.

Getting Started

node-signtool works as a wrapper around the SignTool library. It abstracts the commands' switches with JS object abstraction. Options mapping is available below.

Installation

node-signtool can be installed using NPM:

$ npm install node-signtool --save

Usage

First import node-signtool in your project:

var signtool = require("signtool");

Then use signtool's commands:

signtool.sign("path/to/my.exe", { certificate: "path/to/my/cert.pfx", password: "*******" });
signtool.verify("path/to/my.exe");

node-signtool uses native Promise to wrap asynchronous operations and resolves with the result of the command:

signtool.sign("path/to/my.exe", { certificate: "path/to/my/cert.pfx", password: "*******" });
	.then(result => {
		result.code 	// The signtool exit code.
		result.stdout 	// The signtool stdout content.
		result.stderr	// The signtool stderr content.
	});

Documentation

signtool.sign(file: string | string[], options: SignOptions, runOptions: RunOptions): Promise

The sign command allows to digitally signs files. If no options are provided, node-signtool use the default auto behavior.

SwitchOptionDescription
/aautoSelects the best signing certificate automatically.
/asappendAppends this signature. If no primary signature is present, this signature is made the primary signature.
/uwverifySpecifies using "Windows System Component Verification" (1.3.6.1.4.1.311.10.3.6).
/fcertificateSpecifies the signing certificate in a file (PFX).
/ppasswordSpecifies the password to use when opening a PFX file.
/iissuerSpecifies the name of the issuer of the signing certificate.
/nsubjectSpecifies the name of the subject of the signing certificate.
/rrootSubjectSpecifies the name of the subject of the root certificate that the signing certificate must chain to.
/ddescriptionSpecifies a description of the signed content.
/duurlSpecifies a URL for expanded description of the signed content.
/sstoreSpecifies the store to open when searching for the certificate.
/smcomputerStoreSpecifies that a computer store, instead of a user store, be used.
/sha1sha1Specifies the SHA1 hash of the signing certificate.
/cspcspSpecifies the cryptographic service provider (CSP) that contains the private key container.
/kckeySpecifies the key that contains the name of the private key.
/ctemplateSpecifies the Certificate Template Name (a Microsoft extension) for the signing certificate.
/acadditionalSpecifies a file that contains an additional certificate to add to the signature block.
/fdalgorithmSpecifies the file digest algorithm to use to create file signatures.
/uEKUSpecifies the enhanced key usage (EKU) that must be present in the signing certificate.
/ttimestampSpecifies the URL of the time stamp server.
/trrfcTimestampSpecifies the RFC 3161 time stamp server's URL.
/tdtimestampAlgoUsed with the rfcTimestamp switch to request a digest algorithm used by the RFC 3161 time stamp server.
/dgdigestGenerates the to be signed digest and the unsigned PKCS7 files.
/dxmldigestXMLWhen used with the digest option, produces an XML file.
/dmdfdigestFunctionWhen used with the digest option, passes the file’s contents to the AuthenticodeDigestSign function without modification.
/dlibdigestLibSpecifies the DLL implementing the AuthenticodeDigestSign function.
/dsdigestOnlySigns the digest only. The input file should be the digest generated by the digest option.
/p7pkcsCreates the signature by ingesting the signed digest to the unsigned PKCS7 file.
/p7cepkcsCESpecifies options for the signed PKCS #7 content.
/p7copkcsOIDSpecifies the object identifier (OID) that identifies the signed PKCS #7 content.
/phpageHashesIf supported, generates page hashes for executable files.
/nphsuppresPageHashesIf supported, suppresses page hashes for executable files.

signtool.verify(file: string | string[], options: VerifyOptions, runOptions: RunOptions): Promise

The verify command allows to verify the digital signature of files.

If no options are provided, node-signtool use the default useAllMethods behavior.

The SignTool verify command determines :

  • whether the signing certificate was issued by a trusted authority,
  • whether the signing certificate has been revoked,
  • and, optionally, whether the signing certificate is valid for a specific policy.
SwitchOptionDescription
/auseAllMethodsSpecifies that all methods can be used to verify the file.
/oosVerifies the file by operating system version. (PlatformID:VerMajor.VerMinor.BuildNumber)
/dsindexVerifies the signature at a certain position.
/hashhashSpecifies an optional hash algorithm to use when searching for a file in a catalog.
/rrootSubjectSpecifies the name of the subject of the root certificate that the signing certificate must chain to.
/agcatalogDatabaseFinds the catalog in the catalog database identified by the GUID.
/cuseDefaultCatalogSpecifies the catalog file by name.
/aduseDefaultCatalogFinds the catalog by using the default catalog database.
/asuseDriverCatalogFinds the catalog by using the system component (driver) catalog database.
/allverifyAllSignaturesVerifies all signatures in a file with multiple signatures.
/kpuseX64KernelPerforms the verification by using the x64 kernel-mode driver signing policy.
/msuseMultiSemanticsUses multiple verification semantics.
/p7verifyPKCSVerify PKCS #7 files.
/phverifyPageHashPrint and verify page hash values.
/twverifyTimestampSpecifies that a warning is generated if the signature is not time stamped.
/padefaultAuthPolicySpecifies that the Default Authentication Verification Policy is used.
/pguseAuthPolicySpecifies a verification policy by GUID.
/dshowDescriptionPrint the description and description URL.

signtool.timestamp(file: string | string[], options: TimestampOptions, runOptions: RunOptions): Promise

The timestamp command allows to time stamps files.

SwitchOptionDescription
/turlThe file being time stamped must have previously been signed.
/trrfcUrlSpecifies the RFC 3161 time stamp server's URL.
/tsealsealUrlSpecifies the RFC 3161 timestamp server's URL for timestamping a Sealed file.
/tdalgorithmUsed with the rfcUrl switch to request a digest algorithm used by the RFC 3161 time stamp server.
/tpindexAdds a timestamp to the signature at index.
/p7pkcsAdds a timestamp to PKCS #7 files.

signtool.catdb(file: string | string[], options: CatDBOptions, runOptions: RunOptions): Promise

The catdb command allows to add or remove a catalog file to or from a catalog database.

SwitchOptionDescription
/ddefaultSpecifies that the default catalog database be updated.
/gguidSpecifies that the catalog database identified by the GUID be updated.
/rremoveRemoves the specified catalog from the catalog database.
/uuniqueSpecifies that a unique name be automatically generated for the added catalog files.

RunOptions

Run options are optional. It allows to enable some common signtool switches and to specify some child_process.spawn() options.

Common Switches
SwitchOptionDescription
/qquietNo output on success and minimal output on failure.
/vverbosePrint verbose success and status messages.
/debugdebugDisplay additional debug information.
Spawn Options
SpawnOptionDescription
cwdcwdSpecifies the Current Working Directory to execute signtool on.
stdiostdioSpecifies the spawn stdio option.

Contribute

Install Global Dependencies

node-signtool needs some development dependencies:

$ npm install -g typings

Install Project dependencies

$ npm install && typings install

Build project

$ npm run build