使用Postbuildevent对安装文件进行数字签名
With the advent of Internet Explorer 9's enhanced SmartScreen Filter (also built into Windows 8, so on Win8 it affects users of other browsers) using Application Reputation, developers who make their software available for download online (particularly trial versions that you're using to try to gain new users with) have ever more reason to think about digitally signing their application and its installation file. By digitally signing your application, you reduce the likelihood that people will be scared off from trying your application because of the ominous warning that your software "is not commonly downloaded and could harm your computer," and the resulting extra hoops they have to jump through to actually run or install your application.
随着Internet Explorer 9的增强型SmartScreen筛选器（也内置在Windows 8中，所以在Win8上它会影响其他浏览器的用户）使用应用程序信誉的出现，开发人员可以将其软件在线下载（特别是您正在使用的试用版）尝试吸引新用户）有更多的理由考虑对他们的应用程序及其安装文件进行数字签名。 通过对应用程序进行数字签名，可以减少人们害怕尝试应用程序的可能性，因为这是不祥的警告，警告说您的软件“通常不下载并可能损害您的计算机”，以及由此产生的额外麻烦。实际运行或安装您的应用程序。
Digitally signing your software's application and installation files helps in five ways:
对软件的应用程序和安装文件进行数字签名有助于以五种方式：
1) Instead of "unknown publisher," Windows will now report your name as "Verified Publisher" when someone runs the installer.
1）当有人运行安装程序时，Windows现在将您的名字报告为“ Verified Publisher”，而不是“未知的发布者”。
2) SmartScreen determines the reputation of your software (to decide whether it is "commonly downloaded") based not on the individual build of the installation file, but on all files that use the certificate. This means that if you have multiple applications, or multiple builds (because you're releasing the software with new features, or you have different variants of the application), all of them are summed together for Microsoft to decide the reputation score.
2）SmartScreen并非基于安装文件的单独版本，而是基于使用证书的所有文件来确定软件的信誉（以确定软件是否“通常下载”）。 这意味着，如果您具有多个应用程序或多个内部版本（因为您要发布具有新功能的软件，或者具有不同的应用程序变体），则所有这些总和将汇总在一起，以供Microsoft决定信誉得分。
3) Even when your digital certificate is new and SmartScreen is still reporting that your software isn't commonly downloaded, a signed app gets a yellow border, rather than the red border of an unsigned app. If SmartScreen Filter is disabled, an unsigned app still generates a warning, whereas a signed app doesn't.
3）即使您的数字证书是新的，并且SmartScreen仍报告您的软件不经常下载，已签名的应用程序都会显示黄色边框，而不是未签名的应用程序的红色边框。 如果禁用了SmartScreen筛选器，则未签名的应用程序仍会生成警告，而已签名的应用程序则不会。
4) Digitally signing provides assurance that your software hasn't been tampered with after you released it; any attempt to tamper will generate an error when the altered file is run.
4）数字签名可确保您在发布软件后未对其进行篡改； 运行更改的文件时，任何篡改企图都会产生错误。
5) Some anti-malware software, such as Avast, will automatically block from running unsigned applications that have a low "file prevalence," requiring users to take special steps to enable the application.
5）一些反恶意软件，例如Avast，将自动阻止运行“文件流行率”低的未签名应用程序，从而要求用户采取特殊步骤来启用该应用程序。
Code signing certificates are now available for less than $100/year. You do need to provide proof that you are who you say you are, either as an individual or as a company; how much information you have to provide to the certification authority depends on how extensive your business presence is (at a minimum, you need to have a website of your own with a physical address that matches the address you want to use for your certificate). But the process is pretty simple. A great detailed description that I used is found at Jeff Wilcox's blog, which contains a link to purchase a certificate for as little as $73/year (5 years), at this writing. Note that it's beneficial to get an extended-life certificate, since at this time renewing a certificate causes you to get a brand-new certificate with no reputation, so you have to rebuild your reputation with each renewal. (Whether Microsoft will fix this in the future is unknown; don't bet on it.)
现在，代码签名证书的价格不到100美元/年。 您确实需要提供证明，无论是作为个人还是作为公司，您都是自己所说的人； 您必须向证书颁发机构提供多少信息取决于您的业务范围（至少，您需要拥有一个自己的网站，其实际地址与您要用于证书的地址相匹配）。 但是过程非常简单。 Jeff Wilcox的博客中提供了我所使用的详细说明，其中包含撰写本文的链接，该链接以每年低至73美元/年（5年）的价格购买证书。 请注意，获得延长寿命的证书是有益的，因为此时更新证书会使您获得没有信誉的全新证书，因此您必须在每次更新时都重新建立声誉。 （微软将来是否会解决此问题尚不得而知；请不要打赌。）
But for those of us using Visual Studio .NET (including Visual Basic, C#, and the other .NET languages) and creating Windows Installer .msi installation files, an important simplification step is missing. Jeff Wilcox's blog describes how to get the certificate, install it on your machine, and use it with the SignTool wizard that Microsoft provides with Visual Studio. But that means that every time you build your installation file, you have to manually walk through the wizard, specifying files and titles. That gets tedious, and prone to error. Far better to do the signing as a post-build event, defined in both the application project and the deployment project. The post-build event in the application project signs the executable file (.exe); the post-build event in the deployment project signs the installation file (.msi). It's beneficial to sign both.
但是对于那些使用Visual Studio .NET（包括Visual Basic，C＃和其他.NET语言）并创建Windows Installer .msi安装文件的用户而言，缺少重要的简化步骤。 Jeff Wilcox的博客描述了如何获取证书，将其安装在您的计算机上以及如何将其与Microsoft随Visual Studio提供的SignTool向导一起使用。 但这意味着，每次构建安装文件时，都必须手动遍历向导，并指定文件和标题。 这变得很乏味，并且容易出错。 在应用程序项目和部署项目中都将签名作为构建后事件进行签名要好得多。 应用程序项目中的构建后事件对可执行文件（.exe）进行签名； 部署项目中的构建后事件将对安装文件（.msi）进行签名。 两者都签名是有益的。
Signing your installation file is done with SignTool, provided by Microsoft. It is a 32-bit application, so its location depends on whether you're using a 32-bit or 64-bit version of Windows, as well as what version of Visual Studio you are using:
使用Microsoft提供的SignTool对安装文件进行签名。 它是一个32位应用程序，因此其位置取决于您使用的是32位还是64位版本的Windows，以及所使用的Visual Studio版本：
32-bit Windows: C:\Program Files\Microsoft SDKs\Windows\
32位Windows： C：\ Program Files \ Microsoft SDKs \ Windows \
64-bit Windows: C:\Program Files (x86)\Microsoft SDKs\Windows\
64位Windows： C：\ Program Files（x86）\ Microsoft SDKs \ Windows \
For a complete listing of the options available for SignTool, see here. A list of macros, which start with a $ sign and you can use to define names of files and folders, is available when you open the dialog box for pre- and post-build events in VS. However, I have found that using the following options works well for me. I'm listing one option on each line, so I can describe it; at the bottom, you'll see a full command line put together.
有关SignTool可用选项的完整列表，请参见此处 。 当您在VS中打开构建前和构建后事件的对话框时，可以使用以$符号开头的宏列表，可用于定义文件和文件夹的名称。 但是，我发现使用以下选项对我来说效果很好。 我在每一行上列出了一个选项，因此可以对其进行描述。 在底部，您将看到完整的命令行。
sign command to actually sign the file
sign命令实际对文件进行签名
/d "Description" Description of your application; optional
/ d “描述”您的应用程序的描述； 可选的
/du "http://descriptive.url.com" URL for more information on your application
/ du “ http://descriptive.url.com ” URL，以获取有关您的应用程序的更多信息
/t "http://timestamp.somewhere.com" URL for your certificate's timestamp server
/ t “ http://timestamp.somewhere.com ”证书的时间戳服务器的URL
$(TargetPath) Executable file to be signed, in your development folder
$（TargetPath）要签名的可执行文件，在您的开发文件夹中
$(ProjectDir)obj\$(ConfigurationName)\$(TargetFileName) Executable file to be signed, in the folder that's used to build the deployment package
$（ProjectDir）obj \ $（配置 rationName ）\ $（目标 FileName）待签名的可执行文件，位于用于构建部署程序包的文件夹中
$(BuiltOuputPath) Installation file to be signed (note the misspelling: it really is "Ouput", not "Output", for the middle word)
$（BuiltOuputPath）要签名的安装文件（注意拼写错误：中间的单词实际上是“ Ouput”，而不是“ Output”）
Since this is a command line, any parameter with a space needs to have quote marks around it. In fact, I recommend using quote marks around every parameter; there's no harm, and sometimes characters other than space can cause problems. (I couldn't get /t to work until I surrounded the URL with quotes, even though it had no spaces and worked on a regular command prompt line.)
由于这是命令行，因此任何带有空格的参数都必须在其周围加上引号。 实际上，我建议对每个参数使用引号。 这没有什么害处，有时空格以外的字符可能会引起问题。 （直到URL没有引号，并且在常规的命令行提示符下都可以使用，直到将URL用引号引起来，我才能使/ t工作。）
There are several ways to specify the certificate to be used. If you only have one signing certificate on your computer, then no specification is required; SignTool will automatically find and use the certificate (assuming you've put it in the certificate store). If you have more than one signing certificate, you can use one of the following methods:
有几种方法可以指定要使用的证书。 如果您的计算机上只有一个签名证书，则不需要任何规范。 SignTool将自动查找并使用证书（假设您已将其放入证书存储中）。 如果您具有多个签名证书，则可以使用以下方法之一：
/a Select the best signing certificate automatically. SignTool chooses for you.
/ a自动选择最佳的签名证书。 SignTool为您选择。
/f xyz.pfx Use a .pfx file that contains a certificate. This can be output from the certificate store (see Jeff Wilcox's Step Five). If you used a password to protect the .pfx file, specify it with /p password. Note, though, that this requires putting your password in plaintext in the postbuildevent property, which is not terribly secure. Use this only if you have tight security on your computer. If your .pfx file doesn't contain the private keys, see the /csp and /k options in Microsoft's SignTool description.
/ f xyz.pfx使用包含证书的.pfx文件。 可以从证书存储输出（请参阅Jeff Wilcox的第五步）。 如果使用密码保护.pfx文件，请使用/ p密码指定它。 但是请注意，这需要将密码以纯文本格式放在postbuildevent属性中，这并不是十分安全。 仅当您的计算机具有严格的安全性时才使用此功能。 如果您的.pfx文件不包含私钥，请参阅Microsoft的SignTool说明中的/ csp和/ k选项。
/i issuer Specify the certificate by using part or all of the issuer's name.
/ i颁发者通过使用部分或全部颁发者的名称来指定证书。
/n subject Specify the certificate by using part or all of the subject's name (that is, who the certificate is issued to: your company or personal name, as shown on the certificate)
/ n主题使用部分或全部主题名称（即，证书的颁发者：证书的名称，您的公司或个人名称）指定证书
To set up a post-build event in the application project, go to the project's Properties, Compile tab, and click on Build Events.... Enter the command in the Post-build event command line.
要在应用程序项目中设置构建后事件，请转到项目的“属性”，“编译”选项卡，然后单击“构建事件...”。在构建后事件命令行中输入命令。
To set up a post-build event in the deployment project, highlight your deployment project in the Solution Explorer and select the PostBuildEvent property in the Properties window.
要在部署项目中设置构建后事件，请在解决方案资源管理器中突出显示您的部署项目，然后在“属性”窗口中选择PostBuildEvent属性。
Some example commands:
一些示例命令：
"C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bin\signtool" sign /a /d "ElrondCT's Wonderful App" /du "www.wonderfulapp.com" /t "http://timestamp.comodoca.com/authenticode" "$(ProjectDir)obj\$(ConfigurationName)\$(TargetFileName)"
if $(ConfigurationName) == Release "C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bin\signtool" sign /a /d "ElrondCT's Wonderful App" /du "www.wonderfulapp.com" /t "http://timestamp.comodoca.com/authenticode" "$(TargetPath)"
"C:\Program Files\Microsoft SDKs\Windows\V6.0A\Bin\SignTool" sign /a /d "ElrondCT's Wonderful App" /du "www.wonderfulapp.com" /t "http://timestamp.comodoca.com/authenticode" "$(BuiltOuputPath)"
"C:\Program Files\Microsoft SDKs\Windows\V7.0A\Bin\SignTool" sign /i COMODO /t "http://timestamp.comodoca.com/authenticode" "$(BuiltOuputPath)"
Now you have a higher-credibility distributable, so potential users are less likely to be scared off, with no extra effort after the initial setup.
现在，您具有较高的可分发性，因此，在初始设置后无需付出额外努力即可减少潜在用户的恐惧。
Note that having a certificate does not immediately turn off the "not commonly downloaded" warning. You'll have to wait for enough people to install your application (or otherwise use your certificate in ways that Microsoft logs) before the warning will go away. But even during that time, having "verified publisher" next to your name provides substantial reassurance to users that you're not a malicious or fly-by-night developer. And that's likely to translate into higher usage and sales of your software, as well as fewer calls asking why your software has a virus (a common misconception caused by the "may harm your computer" wording of SmartScreen's message). Microsoft also suggests signing up for the Windows 7 logo program to improve your reputation.
请注意，拥有证书不会立即关闭“不经常下载”警告。 在警告消失之前，您必须等待足够的人来安装您的应用程序（或通过Microsoft记录的方式使用您的证书）。 但是即使在这段时间里，在您的名字旁边放有“经过验证的发布者”也可以向用户保证，您不是恶意的开发者。 这很可能会转化为更高的软件使用率和销售量，以及更少的询问您的软件为何具有病毒的呼叫（SmartScreen消息的“可能损害您的计算机”引起的常见误解）。 微软还建议注册Windows 7徽标计划，以提高您的声誉。
Moderate cost and minimal effort can get you the trust you deserve. Now is the time to take the plunge.
适中的成本和最少的精力可以使您获得应有的信任。 现在是时候尝试一下了。
翻译自: https://www.experts-exchange.com/articles/11184/Digitally-signing-an-installation-file-with-a-Postbuildevent.html