Zig Requires Chilkat v11.7.0+

Verify the Authenticode Signature of an MSI, PowerShell, or VBScript File

See more Code Signing Examples

Demonstrates how to verify the Authenticode signature of a Windows Installer package (.msi), a PowerShell file (.ps1, .psm1, .psd1), or a VBScript file (.vbs), and how to get the certificate of the signer. Verifying these file types requires Chilkat v11.7.0 or later. Zig

const std = @import("std");
const chilkat = @import("chilkat");

pub fn main(init: std.process.Init) !void {
    const alloc = init.arena.allocator();

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Starting in Chilkat v11.7.0, VerifySignature can verify the Authenticode signature of
    //   - Windows Installer packages (.msi)
    //   - PowerShell scripts, modules, and data files (.ps1, .psm1, .psd1)
    //   - VBScript files (.vbs)
    // in addition to EXE and DLL files.

    // This example verifies a signed PowerShell script.
    // To verify an .msi or a .vbs, pass the path of that file instead.
    const path = "C:/someDir/Deploy.ps1";

    const code_sign = try chilkat.CodeSign.init();
    defer code_sign.deinit();
    const sig_info = try chilkat.JsonObject.init();
    defer sig_info.deinit();

    // VerifySignature returns true if the file has a valid Authenticode signature.
    // It returns false if the file is not signed, if the file was changed after it was signed,
    // or if the signing certificate is not trusted.
    code_sign.verifySignature(path, sig_info) catch {
        // The LastErrorText explains why the verification failed.
        std.debug.print("{s}\n", .{try code_sign.getLastErrorText(alloc)});
        return;
    };

    std.debug.print("The Authenticode signature is valid.\n", .{});

    // The details of the signature are returned in the JSON, in the same layout as for an EXE or DLL.
    // See Verify Authenticode Signature of EXE or DLL for a sample of the JSON and code that parses it.
    std.debug.print("signing algorithm: {s}\n", .{try sig_info.stringOf(alloc, "pkcs7.verify.signerInfo[0].signingAlgName")});
    std.debug.print("hash algorithm: {s}\n", .{try sig_info.stringOf(alloc, "pkcs7.verify.signerInfo[0].cert.digestAlgName")});

    // Get the certificate of the signer.
    // The signer certificate is available only after a call to VerifySignature that returned true.
    // It is the public certificate only.  It does not include the signer's private key.
    const signer_cert = try chilkat.Cert.init();
    defer signer_cert.deinit();
    code_sign.getSignerCert(signer_cert) catch {
        std.debug.print("{s}\n", .{try code_sign.getLastErrorText(alloc)});
        return;
    };

    std.debug.print("signed by: {s}\n", .{try signer_cert.getSubjectCN(alloc)});
    std.debug.print("certificate issued by: {s}\n", .{try signer_cert.getIssuerCN(alloc)});
    std.debug.print("certificate serial number: {s}\n", .{try signer_cert.getSerialNumber(alloc)});
    std.debug.print("certificate valid until: {s}\n", .{try signer_cert.getValidToStr(alloc)});
}