Signing an Uninstaller externally

NSIS v3.08 added support for !uninstfinalize. This command requires that a code signing tool could be run by makensis. This is not always the case.

If only an outer workflow for signing is available, first run makensis to create and export the uninstaller. After signing the uninstaller, re-run makensis to create the installer using the already existing uninstaller.

For a real world use case, please see the smartmontools installer and the related signpath workflow.

Example

Name "Installer"
OutFile "install.exe"
RequestExecutionLevel user
InstallDir "$DESKTOP\nsis-test"
 
Section
  MessageBox MB_OK "Installing..."
  CreateDirectory "$INSTDIR"
  SetOutPath "$INSTDIR"
!ifdef IMPORT_UNINST
  ; Use file from 'makensis -DEXPORT_UNINST'
  File "uninstall.exe"
!else
  WriteUninstaller "uninstall.exe"
!endif
SectionEnd
 
!ifdef EXPORT_UNINST
  ; Copy file for 'makensis -DIMPORT_UNINST'
  !uninstfinalize 'echo copy /Y "%1" uninstall.exe&copy /Y "%1" uninstall.exe >nul'
!endif
 
!ifndef IMPORT_UNINST ; Only if 'WriteUninstaller' is used
Section "Uninstall"
  MessageBox MB_OK "Uninstalling..."
  call un.Uninstall
SectionEnd
 
Function un.Uninstall
  Delete "$INSTDIR\uninstall.exe"
  RMDir "$INSTDIR"
FunctionEnd
!endif

Then run:

 makensis -DEXPORT_UNINST installer.nsi
 run_outer_signing_workflow_on uninstall.exe
 makensis -DIMPORT_UNINST installer.nsi

The above uses Windows cmd syntax to copy the file. Enhance the export code as follows to enable builds also on a POSIX system:

!ifdef EXPORT_UNINST
  ; Export the uninstaller for 'makensis -DIMPORT_UNINST'
  !system 'exit 256' STATUS ; POSIX systems truncate STATUS to 8 bit
  !if ${STATUS} = 256 ; Assume native build
    !uninstfinalize 'echo copy /Y "%1" uninstall.exe&copy /Y "%1" uninstall.exe >nul'
  !else ; Assume cross build
    !uninstfinalize 'cp -fv "%1" uninstall.exe'
  !endif
!endif ; EXPORT_UNINST