0

I have created an MSI package (Using InstallShield - IS) that installs my application along with the MS Postscript driver. My question mainly focuses on the postscript driver install part of the my overall installation process. I have created an IS custom action to run a command file (.cmd) at the correct time that installs the MS Postscript driver. The command file contains the following rundll32 line: rundll32 printui.dll, PrintUIEntry /ia /m "AppX PS" /h "x64" /v "Type 3 - User Mode" /f "c:\(install)\afprint.inf" /F "%windir%\inf\ntprint.inf" .

The above works great accept for the fact I am pestered by a Microsoft Warning box which requires user input. The box includes the title: Windows can't verify the publisher of this driver software. I can select the option "Install this driver software anyway" and the whole process does work. I did research this and there does not appear to be a way to avoid the warning even if I add "run quiet" switches to the PrintUIEntry method. Obviously, I need to sign my driver to avoid the security box, but where? I have no binary code here. My install uses a custom INF file that simply delegates to Microsoft (via ntprint.inf) for the Postscript driver install. The Postscript Driver is already on the OS. I am only supplying a PPD file. What exactly do I need to sign is my main question? How can I do this as I am unfamiliar with driver signing?

I am running this on windows 2008 R2 x64.

Here is a copy of my INF afprint.inf (it's small):

[Version]
Signature="$Windows NT$"
Provider=%AF%
ClassGUID={4D36E979-E325-11CE-BFC1-08002BE10318}
Class=Printer
DriverVer=05/17/2007,1.0.0.1

[Manufacturer]
%AF%=Arbfile,NTamd64

[Arbfile]
"AppX PS" = AFCLIENT,,

[Arbfile.NTamd64]
"AppX PS" = AFCLIENT,,

[OEM URLS]
"Arbfile"   =   "http://www.arbfile.org"

[AFCLIENT]
CopyFiles=@AFCLIENT.PPD
DataFile=AFCLIENT.PPD
DataSection=PSCRIPT_DATA
Include=NTPRINT.INF
Needs=PSCRIPT.OEM,PSCRIPT_DATA

[DestinationDirs]
DefaultDestDir=66000

[Strings]
AF="Arbfile"

thanks for any help

Jim Kennedy
  • 782
  • 9
  • 23

1 Answers1

0

Add a CatalogFile directive to the [Version] section of your inf file, use inf2cat to generate a cat file, then use signtool to sign the cat file.

If you use a certificate that is cross-signed by Microsoft, then the installer security warning will not appear.

You can find inf2cat and signtool in the WDK.

PhilMY
  • 2,621
  • 21
  • 29
  • Your answer is right on. I did already verify the inf2cat and signtool. I used a self signed cert for testing purposes and got the same warning box. Nice tidbit of info on the necessity of the cert being cross-signed by MS. I will order a real code signing cert from Thawte and try again. – Jim Kennedy Jul 30 '12 at 19:29
  • Ordered a code signing cert from Thawte and used the signtool to sign my cat file. This did do the trick. I still get a security dialog but not the red warning as I did before. – Jim Kennedy Aug 22 '12 at 13:22