Does anyone here, who caches their msi file on the target system, digitally sign the file?
It’s not difficult to get the file signed through the installation project but that would break our company policy where only a manager can digitally sign files. I would prefer to leave it unsigned and not break our policy.
Are there any compelling reasons to sign the file?
The most compelling reason may be which UAC prompt you get on Windows Vista (assuming your setup.exe runs as invoker). Unsigned you get a message about an unknown program wanting to modify your computer; signed you are told what it is and who said so. (Admittedly you still get the unknown program at uninstall.)
How worth it this is depends on the kinds of customers you cater to, and if they are likely to be using Windows Vista or later. The policy you're working under, while sensible in terms of who is authorized to use the certificate, certainly seems to present a limitation here.
We Sign the bootstrapper (setup.exe) and set its execution level to require administrator so the screens are taken care of up front before we get to the msi file. We had to do this because we have custom actions that need administrative privileges before msiexec “naturally” elevates.
Its become a moot point because the powers that be want it signed.
