How to Sign manifest files using Mage?

“Mage.exe” is a command-line tool used in the Windows operating system for signing and verifying software manifests. Mage Signing is primarily used for signing manifests, which are XML files containing information regarding the deployment and update of a software application. By making use of “mage.exe” to sign the manifest, developers can ensure the authenticity and integrity of their applications, providing users with confidence that the software has not been compromised. The tool also enables the verification of signed manifests, allowing users to validate the source and integrity of the application before installation.

At Encryption Consulting, we have extensive expertise in compliance standards, including FIPS 140-2 Level 3 HSMs. We prioritize meeting industry regulations and standards for your package signing process. To enhance security, we utilize Proxy-Based access to the HSM, ensuring that your private key remains safeguarded from unauthorized access and potential breaches. We recognize that every organization has unique requirements, which is why we offer customized solutions tailored to your specific needs. By doing so, we provide a secure signing process that instills trust and confidence in our services.

Pre-Requisites

• Install mage on your system.
• Install .NET Framework 4 or above.
• Obtain a Signing Certificate.

Mage.exe is a .NET Framework tool, so it will either get automatically installed while you install .NET Framework using Visual Studio or it is downloaded with Windows SDK, under Windows SDK signing tools for Desktop apps.

You can locate it in the file path C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8.1 Tools. Once you’ve downloaded mage.exe to your system, you will need to set the PATH environment variable to mage.exe.

Mage commands and parameters

You can also see this by using mage -help or mage -help verbose in your CMD

Using the command line and EV certificate

We will use Mage.exe to sign a file

Syntax

For example:

Here,

A sample of the executed command:

Using the command line and self-signed certificate (from our web portal)

This method also involves leveraging the Mage (Command Line Interface) that provides functionality to create, publish, sign, and manage packages without changing the project files. But first, the user needs to generate a Self-Signed certificate from our web portal. After that, convert the download certificate from .pem to .crt format for better operations. When these steps are performed successfully, perform the following steps:

• Download the Certificate Chain from our “Signing Tools” screen. And unzip it in your client machine.
• After that, install the Root Certificate into your system.

Steps:

1. Click on the INSTALL CERTIFICATE button.

   

2. On the “Import Wizard” popup, select Current User and then hit NEXT

   

3. On the “Certificate Store” popup, choose Trusted Root Certification Authorities for the Root CA certificate and click on NEXT.

   

4. After verifying all the details, click on FINISH.

   

5. After installing Root CA, install the Issuing CA from the Certificate Chain folder (intermediate.crt). Follow the same procedure, except to install this certificate in Intermediate Certification Authorities.
6. After successfully installing the Issuing CA, install the End Entity certificate (or the Self-Signed certificate from our portal) into your system. The process is the same, except this certificate will be installed in the Personal store.

7. Run the repairstore command using the Thumbprint of this End Entity certificate. Like this:

   certutil -f -repairstore -csp “Encryption Consulting Key Storage Provider” -user “My” <thumbprint of the certificate>

When all of these steps have been completed successfully, try running the Mage command-line command using this certificate’s thumbprint.

Syntax

For example:

Here,

A sample of executed command

Conclusion

To verify the application’s integrity and source before installing it, users may also use the tool to verify signed manifests. Signing manifests is essential to preserving security and confidence in Windows platform software deployment procedures.

Encryption Consulting aims to provide you with the necessary tools and guidance to help create a more secure environment. We are well aware of how important file signing is for safeguarding against unforeseen circumstances. We are committed to your security, and we are here to provide you with the information and tools you need to secure the things that are most important to you. We have Code Signing solution to help you with signing your applications. You can reach out to us at [email protected] to request a demo of our CodeSign Secure.