Windows Installer: Signing Transforms

Question

I've done a fair bit of Googling around this topic, and I haven't found a definitive answer yet. Hopefully one of you guys will be able to help out :-)

I'm producing a Multi-lingual User Interface (MUI) installer using WiX; the output is a localised MSI for each culture targetted. After the MSIs have been built, a transform (MST) is generated between the en-US MSI (the base) and the localised MSI. This way we only package the one MSI, and the MST can be applied at run-time based on the user's language choice.

I've just implemented a new build step that signs our base MSI. It would appear that applying a transform to a signed MSI doesn't break the digital signature, but I'm curious whether the MSTs also need signing. Should the localised MSIs be signed too, before the transforms are generated?

Thanks in advance!

Answer 1

A small amount of touch-testing would imply that signing the MSI only is sufficient, and that neither the localised MSIs nor the MSTs need signing as well.

Hope that helps anyone else looking into this area.