Step-by-Step Guide to Digitally Signing WiX Installer Packages

Sign MSI Installers

You can configure the MSBuild to sign the MSI files automatically as part of the build process, using the SignTool.exe. This requires modifying your .wixproj file to invoke the signing tool after the MSI is built:

1. The first step is to enable signing by setting the SignOuput property to true.

<SignOutput>true</SignOutput>

2. Create a SignMsi target in your .wixproj file to call the SignTool.exe.

<Target Name="SignMyMsi">
  <Exec Command='signtool.exe sign /v /f $(Certificate) /p password "%(SignMsi.FullPath)" ' />
</Target>

Signing Bundles with WiX

Signing bundles is more complex than signing MSIs. A bundle contains multiple components, including the burn engine, bootstrapper application, and bundle manifest.

To fully sign a bundle, you have to sign two parts:

• The burn engine - to ensure the integrity of the installation process.
• The entire bundle - to ensure the integrity of all included content.

Here are the steps to sign a bundle using WiX:

1. Enable signing by setting the SignOutput property to true.

<SignOutput>true</SignOutput>

2. Create a SignBurn in your .wixproj to invoke your signing tool to sign the Burn engine.

<Target Name="SignBurn">
  <Exec Command='signtool.exe sign /v /f $(Certificate) /p password %(SignBurn.FullPath)' />
</Target>

3. Create a SignAllBundle target in your .wixproj to sign the full bundle:

<Target Name="SignBundle">
  <Exec Command='signtool.exe sign /v /f $(Certificate) /p password %(SignBundle.FullPath)' />
</Target>

Signing MSIX Installers

WiX doesn’t natively support creating or signing MSIX packages.

However, you can use the FireGiantExtension. The extension provides the necessary tools to build and sign MSIX packages.

You can add the extension to your project using the NuGet Package Manager in Visual Studio. It’s available as the FireGiant.HeatWave.BuildTools.Msix.wixext package.However, you’ll need a valid license to use it.

Once the extension is installed, you can use the SignMsix target to execute the signtool. The SignMsix is a pre-built MSBuild target provided by the extension to sign the MSIX packages.

The SingnMsix target uses the SignMsixArguments property to store the arguments that will be passed to the signtool.exe, including certificate path, password, and other options.

<OutputType>Msix</OutputType>
  <SignOutput>true</SignOutput>
  <SignMsixArguments>/fd SHA256 /a /f path\to\your.pfx /p yourpfxpwd</SignMsixArguments>

For advanced scenarios, you can override the SignMsix target.

<Target Name="SignMsix">
  <Exec Command='"$(MsixSignTool)" sign /fd SHA256 /a /f pathTo Your.pfx /p yourpfxpwd "@(SignMsix)"' />
</Target>