winsign 2.0.0

Utilities to support code signing Windows executable files

winsign is a python module for signing and manipulating Authenticode signatures in PE and MSI files.

• Works on Python 3.6 and up.

• Free software: MPL2

Requirements

Most dependencies are specified in requirements/base.txt, however, currently you also need osslsigncode installed to perform signing. This utility can be fetched from your distribution’s package repository, or from e.g. https://github.com/theuni/osslsigncode

Installation

pip install winsign

CLI Usage

usage: winsign [-h] --certs CERTS --key PRIV_KEY [-n COMMENT] [-i URL] -d
               {sha1,sha256} [-t {old,rfc3161}] [-v] [-q]
               infile [outfile]

positional arguments:
  infile            unsigned file to sign
  outfile           where to write output to. defaults to infile

optional arguments:
  -h, --help        show this help message and exit
  --certs CERTS     certificates to include in the signature
  --key PRIV_KEY    private key used to sign
  -n COMMENT        comment to include in signature
  -i URL            url to include in signature
  -d {sha1,sha256}  digest to use for signing. must be one of sha1 or sha256
  -t {old,rfc3161}
  -v, --verbose
  -q, --quiet

Future plans

• Stop using osslsigncode for PE signatures

• Refactor code so that osslsigncode functionality is in its own module

• Add python support for MSI, then we can drop dependency on osslsigncode

Credits

• Chris AtLee <[e-mail]>

History

2.0.0 (2019-10-17)

• Breaking API: Some functions are now async. In particular, the top-level sign_file function is now an async function.

• Restructured module layout

• Added docs

1.3.0 (2019-09-12)

• Fixed old style timestamp generation

• Added signature verification code

• Removed autograph support. Client code can implement their own autograph signing hooks for winsign.sign.sign_file

1.2.0 (2019-09-10)

• Updated logging so that is_signed doesn’t produce error logs when files aren’t signed

1.1.0 (2019-09-05)

• Added is_signed method to check if files are signed

1.0.0 (2019-08-30)

• First release