Mono(signcode)

🌸 signcode — Mono(signcode) 🌸

okay bestie, sit DOWN, because today we're talking about signcode, the Mono tool that digitally signs PE executables with an X.509 certificate. yes, like actual cryptographic signature energy. it's giving notary public but make it cyber. 💅

---

✨ SYNOPSIS ✨

signcode [options] filename

that's it. that's the whole vibe. options + a filename. slay.

---

💖 DESCRIPTION 💖

So. signcode digitally signs a PE executable — and when we say PE executable we mean a CLR assembly, a Win32 EXE, or a DLL — using an X.509 certificate and its associated private key. 🫶

The signature it produces is compatible with Authenticode(r), and you can validate it with chktrust — either on Windows or on literally any platform Mono supports. cross-platform queen behavior, no cap.

---

🎀 OPTIONS 🎀

• -spc spcfile — The Software Publisher File (spc) that contains the X.509 certificate chain used to digitally sign the PE executable. 📜
• -v pvkfile — The Private Key File (pvk) that contains the private key used to digitally sign the PE executable. This private key must match the public key inside the publisher X.509 certificate. no mismatches allowed, that's a vibe check fail. 💀
• -a sha1 | md5 | sha2 | sha256 | sha384 | sha512 — The hash algorithm used in the digital signature of the PE executable. The default algorithm is SHA1. pick your fighter ✨
• -$ individual | commercial — Add information about the publisher, i.e. if the signature is generated by an individual or a commercial entity. are you a person or a brand, bestie, choose wisely 👑
• -n description — Add a textual description of the signed file. a lil caption for your binary, cute. 🌸
• -i url — Add a URL associated to the publisher or the signed file. link in bio but for executables 🦋
• -t url — URL to a timestamp service to countersign the PE executable. Countersignature is required if you want the PE executable signature to be valid after the publisher certificate expires. The countersignature proves that the publisher had a valid (non-expired) certificate when the PE executable was signed. it's a receipt, basically. proof you were valid at the time. iconic. ⏰
• -tr # — Number of retries to get a timestamp for the countersignature. 🔁
• -tw # — Delay (in seconds) between the retries to get a timestamp for the countersignature. patience is a virtue, lowkey. ⌛
• -k name — CryptoAPI key container name (when not using -v).
• -p name — CryptoAPI provider name (when not using -v).
• -y # — CryptoAPI provider type (when not using -v or -p).
• -ky signature | exchange | # — CryptoAPI key type (when not using -v).
• -r localMachine | currentUser — CryptoAPI key location (when not using -v).
• -help, -h, -?, /? — Display help about this tool. when in doubt, ask for help, it's self care 🫶

---

🌈 OTHER CODE SIGNING TECHNOLOGIES 🌈

Assemblies are PE files that can also be strongnamed using the sn.exe tool. 👀

And here's the part where the order matters, so listen up: the order of code signature is important if a file requires both an Authenticode and a strongname signature. Strongname must be applied before the Authenticode signature.

Applying a strongname after the Authenticode signature, like re-signing an assembly (e.g. delay-sign), will invalidate the Authenticode signature. not "might", not "maybe", it WILL. 💀 order of operations is real, bestie.

---

🙈 KNOWN RESTRICTIONS 🙈

signcode cannot generate Authenticode signatures for CAB files. that's it, that's the limit, she said no. 🚫

---

👑 AUTHOR 👑

Written by Sebastien Pouliot. thank you for your service, king. 🫡

---

📝 COPYRIGHT 📝

Copyright (C) 2003 Motus Technologies. Copyright (C) 2004 Novell.

Released under BSD license. 📄

---

💌 MAILING LISTS 💌

Visit http://lists.ximian.com/mailman/listinfo/mono-devel-list for details. come hang out, the group chat is open 💬

---

🌐 WEB SITE 🌐

Visit http://www.mono-project.com for details. ✨

---

🔗 SEE ALSO 🔗

chktrust(1), makecert(1), cert2spc(1)

---

and that's the whole page, bestie!! 🎀 this was Mono(signcode) — the Mono manual's signcode(1) page, written by Sebastien Pouliot, copyright 2003 Motus Technologies and 2004 Novell, BSD licensed, and you read the WHOLE thing. so proud. now go sign something. periodt. 💅💖✨