Problem with innosetup-6.51 to sign the uninstall E32 file with external tool

[Pairi Daiza]

Hello Martijn, 

Since years, I'm using external batch files to digital sign all my Inno Setup files with100% success rate.

From version "innosetup-6.3.3", I've added the signing of the "Uninstall" files to my signing batch files still with 100% success rate.

With each run, I always produce 2 versions ("x86" and "x64") of Inno Setup files.

To use the external tool for the "Uninstall" file, i use those settings:

- SignedUninstaller=yes
- SignedUninstallerDir=.\Resources\Uninstaller

With each run, 2 new different E32 files ("x86" and "x64") are created in folder "Uninstall.

Today I've upgraded to "innosetup-6.5.1.

Everything works fine, BUT NOT the batch signing of the E32 uninstall files.

With each run, 2 new identical E32 files ("x86" and "x64") are created in folder "Uninstall", with as result that now in total stay only 1 E32 file (the second file is not added but replace the first one) and that broken my signing batch files.

In picture, the content of older "Uninstall.

Thanks in advance for your attention.

Best regards,

hpwamr

[Martijn Laan]

Hi,

Okay thanks, but what is your question?

The part with numbers and letters is the first 10 characters of the SHA256 of the file to sign. If they are they same then the files are the same. Just a few things can make them different, like specifying a custom icon or version info.

You should fix your batch files, there was and is nothing which guarantees that the names are unique. It's actually the opposite, the names stay the same when possible so you don't have to resign. From the help file: "Upgrading to a newer version of Inno Setup, or changing certain [Setup] section directives that affect the contents of the uninstaller EXE file (such as SetupIconFile and VersionInfo directives), will cause a new file to be created under a different name."

I don't know where the 'beta_x86' and 'beta_x64' postfixes come from. Not from Inno Setup.

None of the above is new.

Greetings,
Martijn

Op 27-8-2025 om 20:02 schreef Pairi Daiza:

--
You received this message because you are subscribed to the Google Groups "innosetup" group.
To unsubscribe from this group and stop receiving emails from it, send an email to innosetup+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/innosetup/8b87a897-7adb-4cb8-9d8b-1d351fe92983n%40googlegroups.com.

[Pairi Daiza]

  Hi,

>> Okay thanks, but what is your question?

My question is: so as with previous version "innosetup-6.3.3" which correctly, I want to receive 2 different E32 files.

>> I don't know where the 'beta_x86' and 'beta_x64' postfixes come from.

I've added 'beta_x86' and 'beta_x64' postfixes to better show the result from the 4 different scripts.

My Inno Script x64 and x86 are different, not much but different !

- notepad3_x64_setup_beta.iss    90.613 bytes    SHA-256 08b7c4021ba4823f220764d62684dd305973141e289e1c160a8a730549c8fe63

- notepad3_x86_setup_beta.iss    90.603 bytes    SHA-256 73c0ca58499dc4f65fcd63b1381d92f4d920ebdcdba893de102be1a0ed52c6ef

>> The part with numbers and letters is the first 10 characters of the SHA256 of the file to sign.

Using exactly the same scripts, the generated .E32 file: "uninst-6.5.1-6dadf32301.e32", where 2 different files and the previous version "innosetup-6.4.3"  ?

Best regards,

hpwamr

[Martijn Laan]

The hash is of the file to sign, not of your script.

A script compile only produces one file to sign, not two.

Two scripts can produce the same name for the file to sign, and do so by default.

If those two scripts output the file to the same SignedUninstallerDir there's only one file to sign even if there's two scripts.

Greetings,
Martijn

Op 27-8-2025 om 21:25 schreef Pairi Daiza:

  Hi,

>> Okay thanks, but what is your question?

My question is: so as with previous version "innosetup-6.3.3" which correctly, I want to receive 2 different E32 files.

>> I don't know where the 'beta_x86' and 'beta_x64' postfixes come from.

I've added 'beta_x86' and 'beta_x64' postfixes to better show the result from the 4 different scripts.

My Inno Script x64 and x86 are different, not much but different !

- notepad3_x64_setup_beta.iss    90.613 bytes    SHA-256 08b7c4021ba4823f220764d62684dd305973141e289e1c160a8a730549c8fe63

- notepad3_x86_setup_beta.iss    90.603 bytes    SHA-256 73c0ca58499dc4f65fcd63b1381d92f4d920ebdcdba893de102be1a0ed52c6ef

>> The part with numbers and letters is the first 10 characters of the SHA256 of the file to sign.

Using exactly the same scripts, the generated .E32 file: "uninst-6.5.1-6dadf32301.e32", where 2 different files and the previous version "innosetup-6.4.3"  ?

Best regards,

hpwamr

On Wednesday, 27 August 2025 at 20:02:04 UTC+2 Pairi Daiza wrote:

Hello Martijn, 

Since years, I'm using external batch files to digital sign all my Inno Setup files with100% success rate.

From version "innosetup-6.3.3", I've added the signing of the "Uninstall" files to my signing batch files still with 100% success rate.

With each run, I always produce 2 versions ("x86" and "x64") of Inno Setup files.

To use the external tool for the "Uninstall" file, i use those settings:

- SignedUninstaller=yes
- SignedUninstallerDir=.\Resources\Uninstaller

With each run, 2 new different E32 files ("x86" and "x64") are created in folder "Uninstall.

Today I've upgraded to "innosetup-6.5.1.

Everything works fine, BUT NOT the batch signing of the E32 uninstall files.

With each run, 2 new identical E32 files ("x86" and "x64") are created in folder "Uninstall", with as result that now in total stay only 1 E32 file (the second file is not added but replace the first one) and that broken my signing batch files.

In picture, the content of older "Uninstall.

Thanks in advance for your attention.

Best regards,

hpwamr

--
You received this message because you are subscribed to the Google Groups "innosetup" group.
To unsubscribe from this group and stop receiving emails from it, send an email to innosetup+...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/innosetup/e702325c-eded-4e35-a830-a12d648027f2n%40googlegroups.com.

[Gavin Lambert]

On Thursday, August 28, 2025 at 6:02:04 AM UTC+12 Pairi Daiza wrote:

Since years, I'm using external batch files to digital sign all my Inno Setup files with100% success rate.

From version "innosetup-6.3.3", I've added the signing of the "Uninstall" files to my signing batch files still with 100% success rate.

With each run, I always produce 2 versions ("x86" and "x64") of Inno Setup files.

To use the external tool for the "Uninstall" file, i use those settings:

- SignedUninstaller=yes
- SignedUninstallerDir=.\Resources\Uninstaller

The point of using SignedUninstaller rather than SignTool is when you're required for some reason to manually sign the files (perhaps you keep the HSM or token in a safe).  As such, as Martijn said, a goal is to produce the smallest number of files that need to be signed and preserve them so that they never need to be signed again, and only rarely need a new file.  There are a few different factors that require a new file; most of your script content doesn't matter for that.  (The SetupIconFile is one thing that does, which may explain why you were historically getting different files per application, if these were previously set to unique icons.)

If you're able to fully automate code signing, then you should do so with SignTool instead.  This will still try to avoid signing the uninstaller too much if you've also set up the SignedUninstallerDir to a shared location (this is usually not recommended in this case), but it lets you sign the uninstaller, the application executables, and the resulting installer, all from your Inno compile with no need for a wrapper script (though you still may want to use a script for other reasons).

Otherwise, if you want to continue using SignedUninstallerDir only, you should sign that file with generic details (e.g. don't use an application-specific /d description) since it may be used by multiple applications.  Or you will need to use separate directories for each application if you want to uniquely sign their uninstallers.

You can read more about this here: Inno Setup Help.

[Gavin Lambert]

On Thursday, August 28, 2025 at 7:25:05 AM UTC+12 Pairi Daiza wrote:

 My Inno Script x64 and x86 are different, not much but different !

- notepad3_x64_setup_beta.iss    90.613 bytes    SHA-256 08b7c4021ba4823f220764d62684dd305973141e289e1c160a8a730549c8fe63

- notepad3_x86_setup_beta.iss    90.603 bytes    SHA-256 73c0ca58499dc4f65fcd63b1381d92f4d920ebdcdba893de102be1a0ed52c6ef

As an aside, you might want to look at using ISPP to build both installers from a single source script (especially if they're not very different), or better yet building a single installer that includes both versions -- for the latter, see the 64BitTwoArch.iss example script included with Inno.

[Pairi Daiza]

Hello,

Thank you very much for your help and detailed information.

I now better understand the workflow of the Signing Uninstallation using an external tool.
I just made a slight modification to my batch file, and the Signing process is now working correctly.

Greetings,

hpwamr