CodeSign React Native Reference Documentation

CodeSign

Current Version: 11.7.0

Markdown version of this page for AI tools (v 11.7.0) · all AI docs

Chilkat.CodeSign

Sign, verify, inspect, and remove Authenticode signatures on Windows executables, installers, and scripts.

Chilkat.CodeSign works directly with Authenticode signatures on Windows executable files such as .exe and .dll, and, starting in v11.7.0, on Windows Installer packages (.msi), PowerShell files (.ps1, .psm1, .psd1), and VBScript files (.vbs). It provides functionality for applying a code-signing signature, validating whether a signed executable can be trusted, extracting signature information, retrieving the signer certificate, and removing an existing signature.

Sign executables, installers, and scripts

Apply Authenticode signatures to EXE, DLL, MSI, PowerShell, and VBScript files using a certificate and associated private key.

Validate trust

Check whether a signed executable has a valid signature and whether the signing certificate chain can be trusted.

Inspect signatures

Extract details about the Authenticode signature, including signer information and signature-related metadata.

Retrieve signer certificates

Get the certificate used to sign the executable and inspect it with Chilkat.Cert.

Remove signatures

Remove an existing Authenticode signature from a signed file when an unsigned output file is required.

Diagnostics

Use detailed diagnostic output to troubleshoot signing, certificate, trust-chain, timestamping, or validation problems.

Common pattern: Load or provide a code-signing certificate that has access to its private key, sign the target file, optionally add timestamping if supported by the signing workflow, then verify the resulting signature and inspect diagnostics if validation does not succeed.

For an extended overview, see CodeSign Class Overview.

Object Creation

// npm install @chilkat/react-native react-native-nitro-modules
// (React Native 0.76+ with the New Architecture; then `pod install` for iOS.  The Chilkat
//  native library is downloaded and verified during the native build -- see the package README.)

import { Chilkat, CodeSign } from '@chilkat/react-native'

// Once per app start, before any other Chilkat call:
Chilkat.unlockBundle('Anything for 30-day trial')   // shorthand for new Global().unlockBundle(..)

const codeSign = new CodeSign()
// ... the native object is released when `codeSign` is garbage collected, or now with codeSign.dispose()

new CodeSign()

Creates the underlying native Chilkat object. CodeSign is a Nitro Module HybridObject: use it from the JavaScript thread only (it cannot be passed to a Worklet or another runtime). Every member is synchronous and blocks the JavaScript thread until Chilkat returns; a method that can take a while also exists as a ...Async twin returning a Promise, which runs the same call on a native worker thread so the UI keeps rendering. While such a call is pending, every other call on this object throws, except abort() and assigning onPercentDone / onProgressInfo.

dispose(): void

Releases the native object immediately instead of waiting for garbage collection (useful for a large BinData or an open socket). Calling it more than once is harmless; any other use of the object afterwards throws. An object with a pending ...Async call cannot be disposed until the promise settles.

Errors

A method that can fail throws a plain Error: a method whose only outcome is success or failure returns void and throws on failure; a method producing a string or an object returns it and throws where Chilkat would have returned null. The error's message is "Class.method(...): reason", where the reason is the last informative line of the object's lastErrorText, which holds the full Chilkat log of the failed call. A ...Async twin rejects its promise with the same Error instead of throwing. Properties never throw, and methods that answer a question (has..., is..., ...) return a plain boolean.

try {
  codeSign.someMethod(...)
} catch (e) {
  console.log((e as Error).message)   // CodeSign.someMethod(...): <reason>
  console.log(codeSign.lastErrorText)   // the full Chilkat log of the failed call
}

// The same call without blocking the JavaScript thread:
try {
  await codeSign.someMethodAsync(...)
} catch (e) {
  console.log((e as Error).message)   // CodeSign.someMethodAsync: <reason>
}

Properties

DebugLogFilePath

// read/write
debugLogFilePath: string

If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. This logging helps identify the context and history of Chilkat calls leading up to any crash or hang, aiding in debugging.

Enabling the VerboseLogging property provides more detailed information. This property is mainly used for debugging rare instances where a Chilkat method call causes a hang or crash, which should generally not happen.

Possible causes of hangs include:

A timeout property set to 0, indicating an infinite timeout.
A hang occurring within an event callback in the application code.
An internal bug in the Chilkat code causing the hang.

More Information and Examples

Option	Effect
`codesign-allow-expired-cert`	Prevents Authenticode verification from failing solely because the signing certificate is expired.
`codesign-allow-cert-padding`	Starting in v11.7.0. Prevents verification of an EXE or DLL from failing solely because the PE certificate table fails the strict check (extra data or entries outside the verified signature). The failed check is still reported in `LastErrorText`. Use only for files known to carry such data, such as some installers that store configuration data in the certificate table.

File type	Extensions	Where the signature is stored
Windows PE images	`.exe`, `.dll`, and other PE files such as `.sys` and `.ocx`	The PE certificate table. PE files are identified from the file content, not the extension.
Windows Installer packages (starting in v11.7.0)	`.msi`	The package's digital signature stream.
PowerShell scripts, modules, and data files (starting in v11.7.0)	`.ps1`, `.psm1`, `.psd1`	A comment block appended to the file (`# SIG # Begin signature block` ... `# SIG # End signature block`). The file's text encoding (UTF-8, UTF-8 with BOM, or UTF-16) is kept.
VBScript files (starting in v11.7.0)	`.vbs`	A comment block appended to the file (`'' SIG '' Begin signature block` ... `'' SIG '' End signature block`).

JSON member	Purpose
`hashAlg`	Selects the file-digest algorithm, such as `sha256`.
`timestampToken.enabled`	Enables an RFC 3161 timestamp token.
`timestampToken.tsaUrl`	Specifies the timestamp authority URL.
`timestampToken.requestTsaCert`	Requests inclusion of the timestamp authority certificate.
`timestampToken.hashAlg`	Selects the timestamp-request digest algorithm, such as `sha256`.

CodeSign React Native Reference Documentation

CodeSign

Current Version: 11.7.0

Sign, verify, inspect, and remove Authenticode signatures on Windows executables, installers, and scripts.

Sign executables, installers, and scripts

Validate trust

Inspect signatures

Retrieve signer certificates

Remove signatures

Diagnostics

Object Creation

Errors

Properties

DebugLogFilePath

HeartbeatMs

LastErrorHtml

LastErrorText

LastErrorXml

LastMethodSuccess

UncommonOptions

VerboseLogging

Version

Methods

AddSignature

AddSignatureAsync

GetSignerCert

RemoveSignature

VerifySignature

Events

PercentDone

ProgressInfo