Sign NuGet packages published from Studio using author or repository signing, and sign the assemblies Studio generates, to ensure the security and integrity of processes and libraries.

Package signing is available with the purpose of ensuring the security and integrity of processes and libraries published from Studio.

NuGet offers two ways in which packages can be signed, either by an author or by a repository.

To enforce the use of signed packages, the signatureValidationMode parameter in the Nuget.config file must be set to require. The file is located at %ProgramFiles%\UiPath\Studio. You can do this in one of two ways:

By default, UiPath packages are repository and author-signed. This means that such packages can be downloaded and installed using Manage Packages without having to perform any additional actions. For information on how to add additional trusted authors, repositories, and/or owners, see following sections on this page.

To download, install, and run packages signed with a certain certificate, add the certificate as a trusted source. To do so, modify the nuget.config file in the installation folder, mainly the section <trustedSigners>.

To add a trusted author, you need to open the NuGet.config file located at %ProgramFiles%\UiPath\Studio\NuGet.config. Then, provide the certificatefingerprint and hashAlgorithm. Check this page to get more information about the certificate fingerprint.

Set the allowUntrustedRoot to true or false:

The entry should be similar to the example below:

For more information on adding UiPath as a trusted signer, see Package Signature Verification in the Robot guide.

Adding a trusted repository is done roughly the same as adding an author, with the difference that the serviceIndex must also be added.

Below is an example of a trusted repository added to the NuGet.config file:

A repository may have multiple author-signed packages. In this case, the <owners> tag can be used for allowing only packages signed by trusted authors to be installed.

Add the trusted authors between the <owners> tags, as in the example below:

The package is published as a signed .nupkg file.

Timestamps are a secure way of keeping track of the date and time when a package was signed. To learn more about timestamping in the context of NuGet package signing, check out this link.

If the certificate timestamper is invalid, an error message containing the project name is thrown in Studio after clicking the Publish button. A similar error message is also logged in the Output panel.

Use the Mass Update Command Line tool to sign multiple packages and then publish them to a location.

Studio can sign the assemblies it generates for a project with your own code signing certificate, both in published packages and when you run or debug the project. Environments with application control policies that allow only signed code can then load these assemblies.

Assembly signing requires one of the following signing tools:

The assemblies in the package are signed with the certificate, password, and timestamper from the Certificate signing tab before the package is created. The Sign assemblies option is available only when Sign Tool Path points to an existing file. To pre-fill the certificate path in the Publish window, set Default Publish Certificate in Settings > Locations.

When you publish from the command line, use the --sign-assemblies option together with --cer-path. For more information, refer to About Publishing Automation Projects.

Studio copies the assemblies compiled for the project to the .local_signed folder, signs them, and runs the project from the signed copies. Only the assemblies that changed since the previous run are signed again. The certificate password is stored in Windows Credential Manager. If you cancel the Certificate Password dialog, the execution does not start. The .local_signed folder is not included in published packages.

Signing assemblies when running and debugging is available for projects with the Windows and cross-platform compatibility.