0

I would like to use the best security coding practices in a VSTO Addin project I am implementing for Microsoft Outlook application and I have a question regarding code signing.

Following the creation of a code signing certificate (.pfx), I have successfully signed:

a) the DLL files produced by my project via using Visual Studio post-build event parameters.

b) the EXE & MSI installers using the SignTool command-line tool.

c) <"filename">.vsto and <"filename">.dll.manifest files

My question is that I used mage tool (Manifest Generation and Editing Tool) to sign the <"filename">.VSTO and <"filename">.dll.manifest files via the following commands - according to Microsoft:

 "C:\Program Files (x86)\....\mage.exe" -sign "<filename>.dll.manifest" -CertFile <certificate.pfx> -Password <password>
 "C:\Program Files (x86)\....\mage.exe" -update "<filename>.vsto" -appmanifest "<filename>.dll.manifest" --CertFile <certificate.pfx> -Password <password>

Verified that the relevant files have a "valid signature" after viewing the output of the following commands; apart from Visual Studio build output (reporting successful signing):

 "C:\Program Files (x86)\......\mage.exe" -ver "<filename>.vsto"
 "C:\Program Files (x86)\......\mage.exe" -ver "<filename>.dll.manifest"

However, when I check their properties via the windows explorer I do not see any "Digital Signatures" tab, not sure if this is the proper setting?

Am I missing something? Please let me know if there is anything I could additionally do to enhance the security posture of my VSTO Addin project.

Thank you.

References:

User1911
  • 197
  • 1
  • 13
  • Could you please add some information how to do steps a) and b)? I think this will be useful because there seems to be a lot of contradictory information out there. Also shouldn't the sequence be a), c), b)? Instead of a) why did you not go for https://learn.microsoft.com/en-us/visualstudio/vsto/how-to-sign-office-solutions?view=vs-2022 ? Thanks for any input – chriscode Apr 17 '22 at 19:33

1 Answers1

0

You can see digital signature in Windows Explorer only for the executable (dll and exe) files.

VSTO is a text file (try to open it in Notepad).

Dmitry Streblechenko
  • 62,942
  • 4
  • 53
  • 78
  • Hey, thank you for your response, It is my very first Miicrosoft Addin and I am not very familiar with VSTO. You are right as it appears it contains XML data. So you think that everything is in accordance with the best practices? I am worried of any potential tampering of the Addin I have implemented this is the reason I want to code sign every possible file of the Addin. – User1911 Jan 31 '21 at 09:00
  • 1
    Yes, that sounds fine to me. – Dmitry Streblechenko Jan 31 '21 at 16:03