Sign Assemblies in an MSI

Question

I have a customer that I have developed Office AddIns for along with an MSI setup package. They need to sign not only the MSI package but also the vsto AddIns inside of that MSI. Is there any way that I can deliver the MSI to the customer and enable them to sign the assemblies within the MSI?

Worst case my current thinking is that I split the setup project into it's own solution and I'll build the vsto addins, pass them to the customer, and then upon receiving those back use the second solution to create the msi and then give him that to sign as well.

Any input anyone has is greatly appreciated.

Answer 1

You can programmatically extract/replace files in an MSI, see this question for an example using VBScript.

I would suggest you provide your customer with a simple script that first extracts the component(s) to be signed, adds the signature and the replaces the original component inside the MSI. Lastly the script would sign the MSI with the customer's certificate.