digisign.exe takes a long time to finish

[sbaebler]

Hi,

I have an issue with digisign.exe. I noticed that the time for AdvancedInstaller to create our installer executable went up from 5 minutes to over an hour.
After some investigation I observed that it is the digisign executable that takes so long. We have about 50 exe files that we sign. Calling digisign.exe outside of AdvancedInstaller shows a big increase in time:

Code: Select all

digisign.exe sign /f "mycert.pfx" /p thepassword /t "http://timestamp.verisign.com/scripts/timstamp.dll" MyExecutable.exe

This used to take about 2 seconds, now it's taking 90 seconds (nevertheless it then finishes successfully signing the file).

90 seconds for the 50 exe files (i.e. 75 minutes) is about the time that the installer takes now.

What could be the reason that this takes so long?

Thank you for your help

Note: We are using AdvancedInstaller 12.7.2 on Windows 8.1 which i s running in a Virtual Machine.

[Dan]

Hello,

When the Digital Signature is performed a hash function is applied to the related files which need to be signed. Also, using the time stamp URL then establishing the connection can be a time consumer.

However, can you please try to use SignTool in the External tools section to digitally sign the setup package and see if behaviour still persist?

Best regards,
Dan

[sbaebler]

I changed to SignTool.exe as described in the link you provided, but when building the installer, I run into an error with the signing:

When I check "Digitally sign the file" in the Properties of one of the executables (MyFile.exe), there is the issue:

Code: Select all

[ Release ]
Building package (en): MyPackage.exe 
Preparing files... The digital signing of the APPDIR\MyFile.exe file failed. Error Message:SignTool Error: Invalid option: /as  Details

Build finished because an error was encountered.

When I don't sign any files, but only the exe/msi/cab installer file, the error occurs a bit later:

Code: Select all

[ Release ]
Building package (en): MyPackage.exe 
Creating CAB file(s)... done.
Creating MSI database... done.
Writing Summary Information... done.
Signing MSI... Done Adding Additional Store
Successfully signed and timestamped: MyPackage.msi  done.
Creating EXE file... error.
The digital signing of the EXE failed. Error Message:SignTool Error: Invalid option: /as  Details

Build finished because an error was encountered.

I did not find any place in AdvancedInstaller where I could change any options for digitally sign a file. Is this a Bug in AdvancedInstaller?

[Daniel]

Hello,

This may happen if you are using our "Sign for compatibility with all operating systems, including Windows XP/Vista ​(deprecated)​" option from "Digital Signature" page and you are not using the SignTool.exe from Windows SDK v8.0 or newer version of the Windows SDK. Can you please make sure you are picking in our "External Tools" dialog the SignTool.exe from Windows SDK 8.0 or newer version?

The /as signing switch is used only when the "Sign for compatibility with all operating systems, including Windows XP/Vista ​(deprecated)​" option is checked and this switch is supported only by the SignTool from Windows SDK 8.0 or newer.

All the best,
Daniel

[sbaebler]

Hi,

Thanks for the hint. We had used Windows SDK 7.0. After an update to Windows SDK 8.1 and setting the signing executable to SignTool.exe instead of DigiSign.exe, we can now successfully build the installers in a few minutes instead of hours.

It would still be interesting to know why using the default (i.e. DigiSign.exe) takes so long. Will you follow up on that?

Thank you

[Daniel]

You're welcome. I'm glad you got everything working.

The digisign.exe is an Advanced Installer internal tool we use for signing. The signing delay might be caused by the Windows API we use to sign the files, but this is only a supposition, I cannot say that for sure.

All the best,
Daniel