How to code sign an XML file for Windows 8 Store apps

Question

In order to use certain capabilities in Windows 8 Apps (ie documentsLibrary), the developer must EV Code Sign an XML file from Microsoft using SHA2, as per the dashboard information:

Certain specialized apps can only be submitted from developer accounts which have undergone additional proof of identity verification. This EV status is obtained by downloading and signing an XML file with an EV code-signing certificate. Most developer accounts do not need this additional status.

http://msdn.microsoft.com/en-us/library/windows/apps/jj863494.aspx

In addition, apps that declare the documentsLibrary capability can only be submitted from developer accounts which can demonstrate they have acquired an Extended Validation (EV) code signing certificate from a certificate authority (CA). EV status is confirmed by downloading and signing an XML file provided by the Windows Store portal with a valid EV code-signing certificate obtained through Symantec or Digicert.

I have the XML file, and a certificate from Symantec, however I cannot find any documentation on how to code sign an XML file. The closest I can find is an article on the symantec website about signtool.exe

https://knowledge.verisign.com/support/code-signing-support/index?page=content&actp=CROSSLINK&id=SO20528

But when I try to use signtool with Microsoft's XML file I get the error "This file format cannot be signed because it is not recognized".

So my question is, how do I sign this XML file with my certificate so I can upload my app to the store?

Answer 1

Please try this tool to sign your xml file: http://www.signfiles.com/xml-signer/ Signtool from Windows SDK can only sign binary files, like executables or dlls by adding additional section to the file.

Answer 2

As MSDN suggest, you should use Code Signing Tool for Xml.

Usage for Token:

SignXml.exe TOKEN SHA256 {publicCert.cer} {signable xml} 

Usage for Pfx:

SignXml.exe PFX SHA256 {cert.pfx} {publicCert.cer} {signable xml}

If you have no .pfx file and only .pvk, use this tool to convert: pvk2pfx.exe (from Windows Platform SDK).

Exmaple: pvk2pfx.exe -pvk myCertificate.pvk -spc myCertificate.cer -pfx myCertificate.pfx -po pa$$word