signing

Generic approach for signing non-PE files

I know that Windows can intrinsically detect and verify signatures of PEs and some types of text file (.vbs, .ps and .wsf). However I'm curious whether there is a way to somehow attach or associate a signature to a file that doesn't directly support signatures, such as .ISO or .zip files. Drivers packages that contain a mixture of bin...

How to verify / troubleshoot AVD debug key

Hi, I'm trying the HelloMapView example found here: http://developer.android.com/guide/tutorials/views/hello-mapview.html Problem I'm having is that when I run my application, none of the map tiles will load... I heard this is usually do to my google maps api key not being correct. I tried signing my app with a key that I generated from...

iPhone signing conceptual question: why is Ad Hoc deployment needed?

I must be missing something conceptually here, and I'm hoping someone can set me straight. I'm not really clear why Ad Hoc deployments of iPhone applications are necessary, and why development builds can't be used instead. Specifically, I don't understand why I can't just send someone my development provisioning profile and my app, as ...

Using gpg to sign an RPM as part of a continous build - how do I avoid the prompt for the passphrase?

I have a continuous integration build system that generates an RPM via a shell script triggered by cron. I want to sign the RPM with gpg, but gpg insists on the user manually entering the passphrase at the console, which is clearly a non-starter since there is no user console for cron. I have read about gpg-agent which will let you ente...

managed c++ strong name/signing

How can I sign a managed c++ dll with a .pfx file?? Or is there a way to include the unsigned managed c++ dll in a signed c# project? I realy dont need a signed dll I just need VS to stop giving me the Error "Referenced assembly 'SlimDX' does not have a strong name." in my c# project that must be signed. ...

DSA: What can a hacker do with *just* a public key?

The shareware registration system I'm currently developing embeds the public DSA key in the executable itself, and the private key resides on a server. (For the sake of discussion let's assume that the server is 100% secure, and there is no way for anybody to get their hands on the private key.) Whenever the program is purchased, the se...

Publish Signed Files?

Hi I built an auto-update feature to my program. It polling an xml in some http url, and in case there is new version is notifies the user and downloading the new files. I want to allow redistributing of those updates in closed networks without internet connections. The administrators can download all update files and host in some HTTP...

How to handle APK signing for Android in an FOSS project?

Hi, I'm working on an open source project for android and am wondering whether there are any best practices (or at least well-argued hints) on how to manage the private key for signing the APKs. On the one hand, the key should be secured, on the other hand, at least the members of the core team should be able to create "official" relea...