node-signtool

node-signtool is a Node module wrapper around the SignTool binary.

Getting Started

node-signtool works as a wrapper around the SignTool library. It abstracts the commands' switches with JS object abstraction. Options mapping is available below.

Installation

node-signtool can be installed using NPM:

$ npm install node-signtool --save

Usage

First import node-signtool in your project:

var signtool = require("signtool");

Then use signtool's commands:

signtool.sign("path/to/my.exe", { certificate: "path/to/my/cert.pfx", password: "*******" });
signtool.verify("path/to/my.exe");

node-signtool uses native Promise to wrap asynchronous operations and resolves with the result of the command:

signtool.sign("path/to/my.exe", { certificate: "path/to/my/cert.pfx", password: "*******" });
	.then(result => {
		result.code 	// The signtool exit code.
		result.stdout 	// The signtool stdout content.
		result.stderr	// The signtool stderr content.
	});

Documentation

signtool.sign(file: string | string[], [options: SignOptions], [runOptions: RunOptions]): Promise

The sign command allows to digitally signs files. If no options are provided, node-signtool use the default auto behavior.

| Switch | Option | Description | |-----------|-------------------|-----------------------------------------------------------------------| | /a | auto | Selects the best signing certificate automatically. | | /as | append | Appends this signature. If no primary signature is present, this signature is made the primary signature. | | /uw | verify | Specifies using "Windows System Component Verification" (1.3.6.1.4.1.311.10.3.6). | | /f | certificate | Specifies the signing certificate in a file (PFX). | | /p | password | Specifies the password to use when opening a PFX file. | | /i | issuer | Specifies the name of the issuer of the signing certificate. | | /n | subject | Specifies the name of the subject of the signing certificate. | | /r | rootSubject | Specifies the name of the subject of the root certificate that the signing certificate must chain to. | | /d | description | Specifies a description of the signed content. | | /du | url | Specifies a URL for expanded description of the signed content. | | /s | store | Specifies the store to open when searching for the certificate. | | /sm | computerStore | Specifies that a computer store, instead of a user store, be used. | | /sha1 | sha1 | Specifies the SHA1 hash of the signing certificate. | | /csp | csp | Specifies the cryptographic service provider (CSP) that contains the private key container. | | /kc | key | Specifies the key that contains the name of the private key. | | /c | template | Specifies the Certificate Template Name (a Microsoft extension) for the signing certificate. | | /ac | additional | Specifies a file that contains an additional certificate to add to the signature block. | | /fd | algorithm | Specifies the file digest algorithm to use to create file signatures. | | /u | EKU | Specifies the enhanced key usage (EKU) that must be present in the signing certificate. | | /t | timestamp | Specifies the URL of the time stamp server. | | /tr | rfcTimestamp | Specifies the RFC 3161 time stamp server's URL. | | /td | timestampAlgo | Used with the rfcTimestamp switch to request a digest algorithm used by the RFC 3161 time stamp server. | | /dg | digest | Generates the to be signed digest and the unsigned PKCS7 files. | | /dxml | digestXML | When used with the digest option, produces an XML file. | | /dmdf | digestFunction | When used with the digest option, passes the file’s contents to the AuthenticodeDigestSign function without modification. | | /dlib | digestLib | Specifies the DLL implementing the AuthenticodeDigestSign function. | | /ds | digestOnly | Signs the digest only. The input file should be the digest generated by the digest option. | | /p7 | pkcs | Creates the signature by ingesting the signed digest to the unsigned PKCS7 file. | | /p7ce | pkcsCE | Specifies options for the signed PKCS #7 content. | | /p7co | pkcsOID | Specifies the object identifier (OID) that identifies the signed PKCS #7 content. | | /ph | pageHashes | If supported, generates page hashes for executable files. | | /nph | suppresPageHashes | If supported, suppresses page hashes for executable files. |

signtool.verify(file: string | string[], [options: VerifyOptions], [runOptions: RunOptions]): Promise

The verify command allows to verify the digital signature of files.

If no options are provided, node-signtool use the default useAllMethods behavior.

The SignTool verify command determines :

• whether the signing certificate was issued by a trusted authority,
• whether the signing certificate has been revoked,
• and, optionally, whether the signing certificate is valid for a specific policy.

| Switch | Option | Description | |-----------|-------------------|-----------------------------------------------------------------------| | /a | useAllMethods | Specifies that all methods can be used to verify the file. | | /o | os | Verifies the file by operating system version. (PlatformID:VerMajor.VerMinor.BuildNumber) | | /ds | index | Verifies the signature at a certain position. | | /hash | hash | Specifies an optional hash algorithm to use when searching for a file in a catalog. | | /r | rootSubject | Specifies the name of the subject of the root certificate that the signing certificate must chain to. | | /ag | catalogDatabase | Finds the catalog in the catalog database identified by the GUID. | | /c | useDefaultCatalog | Specifies the catalog file by name. | | /ad | useDefaultCatalog | Finds the catalog by using the default catalog database. | | /as | useDriverCatalog | Finds the catalog by using the system component (driver) catalog database. | | /all | verifyAllSignatures | Verifies all signatures in a file with multiple signatures. | | /kp | useX64Kernel | Performs the verification by using the x64 kernel-mode driver signing policy. | | /ms | useMultiSemantics | Uses multiple verification semantics. | | /p7 | verifyPKCS | Verify PKCS #7 files. | | /ph | verifyPageHash | Print and verify page hash values. | | /tw | verifyTimestamp | Specifies that a warning is generated if the signature is not time stamped. | | /pa | defaultAuthPolicy | Specifies that the Default Authentication Verification Policy is used. | | /pg | useAuthPolicy | Specifies a verification policy by GUID. | | /d | showDescription | Print the description and description URL. |

signtool.timestamp(file: string | string[], [options: TimestampOptions], [runOptions: RunOptions]): Promise

The timestamp command allows to time stamps files.

| Switch | Option | Description | |-----------|-------------------|-----------------------------------------------------------------------| | /t | url | The file being time stamped must have previously been signed. | | /tr | rfcUrl | Specifies the RFC 3161 time stamp server's URL. | | /tseal | sealUrl | Specifies the RFC 3161 timestamp server's URL for timestamping a Sealed file. | | /td | algorithm | Used with the rfcUrl switch to request a digest algorithm used by the RFC 3161 time stamp server. | | /tp | index | Adds a timestamp to the signature at index. | | /p7 | pkcs | Adds a timestamp to PKCS #7 files. |

signtool.catdb(file: string | string[], [options: CatDBOptions], [runOptions: RunOptions]): Promise

The catdb command allows to add or remove a catalog file to or from a catalog database.

| Switch | Option | Description | |-----------|-------------------|-----------------------------------------------------------------------| | /d | default | Specifies that the default catalog database be updated. | | /g | guid | Specifies that the catalog database identified by the GUID be updated. | | /r | remove | Removes the specified catalog from the catalog database. | | /u | unique | Specifies that a unique name be automatically generated for the added catalog files. |

RunOptions

Run options are optional. It allows to enable some common signtool switches and to specify some child_process.spawn() options.

Common Switches

| Switch | Option | Description | |-----------|-------------------|-----------------------------------------------------------------------| | /q | quiet | No output on success and minimal output on failure. | | /v | verbose | Print verbose success and status messages. | | /debug | debug | Display additional debug information. |

Spawn Options

| Spawn | Option | Description | |-----------|-------------------|-----------------------------------------------------------------------| | cwd | cwd | Specifies the Current Working Directory to execute signtool on. | | stdio | stdio | Specifies the spawn stdio option. |

Contribute

Install Global Dependencies

node-signtool needs some development dependencies:

• typings

$ npm install -g typings

Install Project dependencies

$ npm install && typings install

Build project

$ npm run build