Delphi ActiveX Requires Chilkat v11.7.0+

Verify the Authenticode Signature of an MSI, PowerShell, or VBScript File

See more Code Signing Examples

Demonstrates how to verify the Authenticode signature of a Windows Installer package (.msi), a PowerShell file (.ps1, .psm1, .psd1), or a VBScript file (.vbs), and how to get the certificate of the signer. Verifying these file types requires Chilkat v11.7.0 or later. Delphi ActiveX

var
success: Integer;
path: WideString;
codeSign: TChilkatCodeSign;
sigInfo: TChilkatJsonObject;
valid: Integer;
signerCert: TChilkatCert;

begin
success := 0;

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  Starting in Chilkat v11.7.0, VerifySignature can verify the Authenticode signature of
//    - Windows Installer packages (.msi)
//    - PowerShell scripts, modules, and data files (.ps1, .psm1, .psd1)
//    - VBScript files (.vbs)
//  in addition to EXE and DLL files.

//  This example verifies a signed PowerShell script.
//  To verify an .msi or a .vbs, pass the path of that file instead.
path := 'C:/someDir/Deploy.ps1';

codeSign := TChilkatCodeSign.Create(Self);
sigInfo := TChilkatJsonObject.Create(Self);

//  VerifySignature returns true if the file has a valid Authenticode signature.
//  It returns false if the file is not signed, if the file was changed after it was signed,
//  or if the signing certificate is not trusted.
valid := codeSign.VerifySignature(path,sigInfo.ControlInterface);
if (valid = 0) then
  begin
    //  The LastErrorText explains why the verification failed.
    Memo1.Lines.Add(codeSign.LastErrorText);
    Exit;
  end;

Memo1.Lines.Add('The Authenticode signature is valid.');

//  The details of the signature are returned in the JSON, in the same layout as for an EXE or DLL.
//  See Verify Authenticode Signature of EXE or DLL for a sample of the JSON and code that parses it.
Memo1.Lines.Add('signing algorithm: ' + sigInfo.StringOf('pkcs7.verify.signerInfo[0].signingAlgName'));
Memo1.Lines.Add('hash algorithm: ' + sigInfo.StringOf('pkcs7.verify.signerInfo[0].cert.digestAlgName'));

//  Get the certificate of the signer.
//  The signer certificate is available only after a call to VerifySignature that returned true.
//  It is the public certificate only.  It does not include the signer's private key.
signerCert := TChilkatCert.Create(Self);
success := codeSign.GetSignerCert(signerCert.ControlInterface);
if (success = 0) then
  begin
    Memo1.Lines.Add(codeSign.LastErrorText);
    Exit;
  end;

Memo1.Lines.Add('signed by: ' + signerCert.SubjectCN);
Memo1.Lines.Add('certificate issued by: ' + signerCert.IssuerCN);
Memo1.Lines.Add('certificate serial number: ' + signerCert.SerialNumber);
Memo1.Lines.Add('certificate valid until: ' + signerCert.ValidToStr);