[fpc-pascal] Signing applications, how?

[Jeppe Johansen]

On 8/10/24 09:56, Bo Berglund via fpc-pascal wrote:
> I have been using FreePascal (and before that Delphi) for many years and it has
> worked fine. I am now retired and only perform maintenance work.
>
>
> And now I am getting a request for "signing" the applications (and/or possibly
> the installers made by InnoSetup) and I have no idea on how to do this.
>
> Apparently some customers cannot install the software because of IT department
> policies prohibiting running unsigned programs...
>
> What to do about this? Most involved products are for Windows and they are 32
> bit.
>
> Several of the applications are quite old with last compile date back around
> 2012-2016...
>
> Is there a how-to for FreePascal and Delphi that outlines how to do it?
>
> The process should be possible to be applied to already existing exe files
> because the builds can no longer be performed since the original dev
> environments no longer exist.

Basically you need the Windows SDK. It comes with a program called 
signtool.exe that can sign things. Lots of examples here: 
https://learn.microsoft.com/en-us/dotnet/framework/tools/signtool-exe

It's fairly straight-forward to use this on executables. You point it at 
the EXE and the code signing certificate you will use.

For InnoSetup it needs to be rebuilt since you also need to sign the 
uninstaller that it creates. Info here 
https://jrsoftware.org/ishelp/index.php?topic=setup_signtool

Best Regards,
Jeppe