The MsiDigitalSignature table contains the signature information for every digitally signed object in the installation database.
The MsiDigitalSignature and MsiDigitalCertificate tables are available starting with Windows Installer version 2.0.
Windows Installer version can use digital signatures as a means to detect corrupted resources. Windows Installer 2.0 can only verify the digital signatures of external cabinets, and only by the use of the
MsiDigitalSignature and MsiDigitalCertificate tables.
Beginning with Windows Installer 3.0, the Windows Installer can verify the digital signatures of patches (.msp files) by using the MsiPatchCertificate and MsiDigitalCertificate tables. For more information, see Guidelines for Authoring Secure Installations and User Account Control (UAC) Patching.
The MsiDigitalSignature table has the following columns.
Columns
- Table
With the Windows Installer version 2.0, the entry in this field must be "Media" for the
Media table. The installer only verifies the digital signatures on external cabinet media entries. This column and the SignObject column together specify the resource that is digitally signed.
- SignObject
A foreign key into the primary key of the table specified by the Table column. This column and the Table column together specify the resource that is digitally signed.
- DigitalCertificate_
A foreign key into the
MsiDigitalCertificate table. This identifies the certificate that must exist on the file for the associated action to succeed. The resource (or object) is always required to match this certificate in the MsiDigitalCertificate table.
- Hash
In this field enter the reference hash of the resource (or object) that is to be checked against the actual hash of the resource (or object) obtained at run-time. If only the certificate needs to be verified, the Hash field may be null. Note that the format of the hash depends on the type of the resource (or object) being signed.
The Hash column contains the binary representation of the hash. The actual content is the pbData member of the
CRYPT_HASH_BLOB structure, which is part of the CRYPTOAPI_BLOB structure. This may be obtained by calling
WinVerifyTrust or
MsiGetFileSignatureInformation.
Validation
- ICE03
- ICE06
- ICE29
- ICE32
- ICE66
- ICE81
See Also
MsiGetFileSignatureInformation
MsiDigitalCertificate table
Digital Signatures and Windows Installer
Send comments about this topic to Microsoft
Build date: 6/5/2008