sign

Command: sign

Description: This command allows you to sign packages you have created with a certificate that complies with the X.509 standard, using a certificate from the certificate store or a PFX file.

Use: tcpkg sign <path>

Arguments:

<path>

Path to a .nupkg file to be signed.

Options:

--pfx <pfx>

Path to a PFX file containing the certificate and the private key.

-p, --password <password>

Password for the PFX file.

--thumbprint <thumbprint>

The fingerprint of the certificate in the certificate store that will be used to sign the package.

-o, --output <output>

Path where the signed package should be saved. If no value is specified, the file you entered will be overwritten.

--timestamp-server <timepstamp-server> (REQUIRED)

URL of an RFC3161 timestamp server. If set to “None”, the timestamp is disabled.

--hash-algorithm <sha256|sha384|sha512>

The hash algorithm used for the signature. (Default: sha512)

--timestamp-hash-algorithm <sha256|sha384|sha512>

The hash algorithm used when RFC3161 timestamps are employed.

--verify-after-signing

After the signature is generated, a verification is performed to ensure that it works. To do this, the Tcpkg certificate must be recognized as trusted.

Examples:

Company policies on private keys Your company or IT department may have policies and guidelines that require the private key to be more securely protected and, therefore, generated in a different way along with the certificate. Nowadays, for example, it is common practice to protect the private key within the hardware, such as with a crypto token. Check to see if such policies exist in your company, and take them into account.

1. Generating your own certificate for the signature
The following PowerShell script provides an example of how to create a certificate, store the private key in the user's certificate store, export it as a PFX file, and export the public key as a CER file:

$cert = New-SelfSignedCertificate `
-Subject "CN=TcPkg Test Signing" `
-KeyUsage DigitalSignature `
-Type CodeSigning `
-CertStoreLocation "Cert:\CurrentUser\My" `
-NotAfter (Get-Date).AddYears(2)

$password = ConvertTo-SecureString -String "test1234" -Force -AsPlainText

Export-PfxCertificate `
-Cert $cert `
-FilePath ".\test-signing.pfx" `
-Password $password

Export-Certificate `
-Cert $cert `
-FilePath ".\test-signing.cer"

Write-Host "Thumbprint: $($cert.Thumbprint)"
Write-Host "Private Key exported to: $(Resolve-Path '.\test-signing.pfx')"
Write-Host "Public Key exported to: $(Resolve-Path '.\test-signing.cer')"

2. Add the certificate with the private key to the TwinCAT Package Manager's certificate store

tcpkg certificate add C:\Users\User\test-signing.pfx -p “test1234”

3. Signing a newly created package

tcpkg sign C:\Users\User\Documents\Packages\NewPackage.1.0.0.nupkg --timestamp-server None --thumbprint <thumbprint> --verify-after-signing 

4. Providing the package and public key to customers or colleagues.