signing | 易学教程

Clickonce signed application fails with “has a different computed hash than specified in manifest”. Mage fails to resolve issue

阅读更多关于 Clickonce signed application fails with “has a different computed hash than specified in manifest”. Mage fails to resolve issue

问题 I've been really struggling with this one for days. I've seen other posts like ClickOnce Deployment Error: different computed hash than specified in manifest, but the solutions do not seem to work for me. I have a valid code signing certificate, and have been using it to sign my ClickOnce application for months. I realized I wasn't signing the executable and dlls themselves, so I attempt to do so. Now every time I publish and run the setup.exe, it fails with: "File, xxxxxx.dll, has a

Where to keep p12 file securely on App Engine?

阅读更多关于 Where to keep p12 file securely on App Engine?

On App Engine, I need a p12 file to create signed URLs: https://developers.google.com/storage/docs/accesscontrol#Signing-Strings Google does not describe what are best practices about keeping this file. Can I use the WEB-INF directory to store the file? It would then be part of the source code and kept together with the password to open it. What are best practices here? Or other approaches? -- What about performance? Is it efficient to load the file over and over again? Does App Engine automatically cache the file across calls (on the same instance)? Or will I need to load the file once using

Using SecKeyRawSign on the iPhone

阅读更多关于 Using SecKeyRawSign on the iPhone

I'm trying to sign some data using SecKeyRawSign but I keep getting a -4 errSecUnimplemented. That seems strange since the documentation states that it is available in iPhone OS2.0 and later. Has anyone been able to use this function? If so, are there any tricks involved? ~Nate If you're having this problem, most likely it is because the private key you generated isn't actually being saved into the keychain. I figured this out when stopping and restarting the application and signing the message wasn't working. So here are my methods to make this work. This one generates the key pair - (void

WSO2 signing system service app

阅读更多关于 WSO2 signing system service app

问题 I want to setup all my devices as COPE. WSO2 EMM setup is complete and working fine. Only thing is left is to sign the system service application with the firmware key. I am using Google devices only (Android one, Motorola G2). From where I can find the key and password to sign the application. Is there any other alternative way to get the application signed? As per documentation, "Sign the application via the device firmware signing key. If you don’t have access to the firmware signing key,

How can I import an RSA private key in PEM format for use with WebCrypto?

阅读更多关于 How can I import an RSA private key in PEM format for use with WebCrypto?

问题 I'm trying to use WebCrypto to sign a token with RSA-PSS, but I keep getting the error: DataError: Data provided to an operation does not meet requirements at crypto.subtle.importKey . This is my JavaScript code: function signToken(token, key) { crypto.subtle.importKey( 'pkcs8', PEM2Binary(key), { name: 'RSA-PSS', hash: { name: 'SHA-256' }, }, false, ['sign'] ).then(function(privKey){ crypto.subtle.sign( 'RSA-PSS', privKey, new TextEncoder().encode(token) ).then(function(signedToken){ msg =

Add Signing Time to PKCS7 Signed CMS?

阅读更多关于 Add Signing Time to PKCS7 Signed CMS?

I'm trying to add the signing time attribute to a file that I am signing using SignedCMS. private byte[] signFile(byte[] fileContent, X509Certificate2 verificationCert) { ContentInfo contentInfo = new ContentInfo(fileContent); SignedCms signedCMS = new SignedCms(contentInfo); CmsSigner cmsSigner = new CmsSigner(SubjectIdentifierType.IssuerAndSerialNumber, verificationCert); Oid signedDate = new Oid("1.2.840.113549.1.9.5"); //oid for PKCS #9 signing time signedDate.Value = DateTime.Now.ToString(); CryptographicAttributeObject cryptoAtty = new CryptographicAttributeObject(signedDate); cmsSigner

Signing an app, but not publishing on Android market

阅读更多关于 Signing an app, but not publishing on Android market

The Android system has a flag called "Unknown Sources" that allows it to install applications from non-market sources. If I sign my application as described on the android developer website (i.e. with a certificate that is created using the private keys I got from google), and decide not to publish my application on the android market, but host it on my own site. Will this application be considered a non-market by the android system ? Will it still install with the "Unknown Sources" option turned off ? "Unknown Sources" allows for the installation of applications via download links (.apk files

How to verify that timestamping is done correctly for signed code

阅读更多关于 How to verify that timestamping is done correctly for signed code

I have just got my code signing certificate from StartSSL and am trying to sign our installer. The signing process goes well and I get an installer exe that Windows no longer complains about being from unknown publisher. This is great! However I tried to make sure that the timestamping also works as advertised so I moved my PC date to 2012, after my code signing certificate expiration date. This supposedly should not make any difference but when I run the same installer exe I now get the same nasty "unknown publisher" warning. Looking at the properties of the exe in the Digital Signatures tab

Signing two apps with the same key

阅读更多关于 Signing two apps with the same key

问题 I build two apps first app com.pakname.pak1 and the second with com.pakname.pak2 package name, then I got one key mykey.keystore. What happens if I sign the both apps with the same key and publish them to the android market ? is this good habit ? I guess is not but I do not get the point of signing apps from same company with different keys. can someone explain me this kind of scenario Thanks 回答1: Read this Signing Strategies Some aspects of application signing may affect how you approach the

Which files should be digitally signed

阅读更多关于 Which files should be digitally signed

I am wondering what files should be digitally signed? I'm not talking about strong naming assemblies, but about digitally signing files so that it is possible to determine if they have been tampered with. I read the following post . The author states that all installer files should be signed as well as the main program executable - that sounds reasonable, but what about other files and applications? I know that ClickOnce applications have their manifest signed, not sure about the installer itself, but as the manifest contains some file hashes, I guess that it's not necessary to sign anything