How to sign all the msi file which are under folder? - powershell

Question

I am using signtool to sign my msi.
How to recursively search all the msi in a folder and subfolder then sign them all?

Answer 1

The previous 2 answers show a PowerShell solution.
You can accomplish this easily enough from a CMD.EXE Command Prompt as well.
for /r "yourRootFolder" %F in (*.msi) do signtool sign /a "%F"
Obviously you need to modify your signtool options to suit your needs. The important bit is %F will iteretively hold the name of each .MSI file.
If you want to run the command from within a batch file, then the % must be doubled, so %F becomes %%F in both places.

Answer 2

Here's an example using a code signing certificate (I have only one certificate in $cert):
$cert = Get-ChildItem -Path Cert: -CodeSigningCert -Recurse
Get-ChildItem -Path C:\MsiFolder -Filter *.msi -Recurse | Set-AuthenticodeSignature -Certificate $cert

Answer 3

Assuming you know what command line parameters you need for the MSI signing tool are you can get all MSIs under a given folder like this:
Get-ChildItem -recurse -path C:\MsiFolder -Include *.msi | ForEach-Object {
$msiPath = $_.FullName
$output = & the_msi_sign_tool.exe -msifile $msiPath -parameterB -parameterC 2>&1
if ($LASTEXITCODE -ne 0) {
Write-Error $output
}
}

Answer 4

Only one password prompt!
$signExe = 'C:\Program Files (x86)\Windows Kits\8.1\bin\x64\signtool.exe'
$files = gci 'C:\Temp\*' -Include *.msi | %{('"{0}"' -f $_.FullName)}
$fingerprint = '00000000000000000000000000000000000000000'
$timestampUrl = 'http://rfc3161timestamp.globalsign.com/advanced'
$filesInputArg = $files -join " "
.$signExe sign /tr $timestampUrl /td SHA256 /sha1 $fingerprint $filesInputArg