Check MSI signature

[Lloyd Dupont]

I want 'auto-updatable' application.
After careful consideration of the available option I choosed, mainly for
security reason, to automatically download latest MSI (if needed) and let
the user click: next next next on the MSI exec interface.

My MSI is signed.

Now my problem is: after downloading latest MSI, how do I check with C# code
that it has not been tampered with?

 

[Guest]

Decided against the updater block?

If you are running a new MSI for updates, simply overwrite everything and
then you do not have to worry about tampering. The user who tampers will have
to tamper again. The only people that tamper with programs are hackers, at
least in most cases. Unless you are building in something to tell on them
(likely to piss a lot of people off), you are not going to get much out of
determining if there has been tampering or not.

If the assemblies in the app are signed, you should be able to pull the
checksums to guarantee they have not been tampered with. This can be a heavy
handed operation, so I would use it sparingly. On a small application, it
will not be noticed, but it could extend the time on a large application (say
Visual Studio .NET anyone?).

--
Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

***************************
Think Outside the Box!
***************************

 

[Lloyd Dupont]

Alright, thanks you for your update Cowboy ;-)
Mhh, mhh...

I might give a go to this updater block this WE at home but these last day I
didn't feel like properly experimenting technology unknown to me, maybe too
much stress, I don't know...
Mhh, mhh, danger alert, I should really be able to learn & discover at
work....