Comments (9)
Do you mean that the signature is invalid, or the file gets corrupted and can no longer be installed? What is your version of Windows 10?
from jsign.
The signature comes up as invalid (and the CA certificate is installed in the system truststore, and it used to work before). The installer can still be run, so the file is not corrupted.
It's Windows 10 Enterprise 2015 LTSB, version 10.0 (Build 10240)
from jsign.
Could you try the same command but targeting a .exe file instead? Is the signature also invalid?
from jsign.
Yes, signing an .exe file still seems to work as normal (I tried signing with digest algorithms SHA-1 and SHA-256, the SHA-1 one is not recognized as signed, but I think this is due to Windows 10 stopped accepting SHA-1 as a digest algorithm. With SHA-256 the signature shows up as valid).
from jsign.
MSI-files.zip
I attached a ZIP file with some samples:
sample-unsigned.msi is an unsigned MSI
then there is signed versions of this file with digest algorithms SHA-1 and SHA-256 signed by a certificate issued directly from a root CA (-root.msi) and ones signed by a certificate issued by a sub CA (-sub.msi)
The CA certificates are also included in the ZIP file along with a keystore containing the certs (alias code00001 is the one signed by the root, and code00003 signed by the sub, this is the sample keystore distributed with SignServer, store password is "foo123"
from jsign.
I retried signing the sample file with Jsign 5.0 and the signature is still invalid.
But there may be an issue with the MSI file actually, because signtool fails to sign it:
C:\dev\jsign>signtool sign /v /fd sha256 /f jsign-core\src\test\resources\keystores\keystore.p12 /p password sample-unsigned.msi
The following certificate was selected:
Issued to: Jsign Code Signing Test Certificate 2022 (RSA)
Issued by: Jsign Code Signing CA 2022
Expires: Mon Nov 10 20:15:33 2042
SHA1 hash: 6FD90E92283AF2B39C26DDCEA31B14958F9A1BCF
Done Adding Additional Store
SignTool Error: An unexpected internal error has occurred.
Error information: "Error: SignerSign() failed." (-2146885630/0x80092002)
osslsigncode signs it but reports an error and the signature is invalid as well:
C:\dev\jsign>osslsigncode sign -spc jsign-core\src\test\resources\keystores\jsign-test-certificate-full-chain.spc -key jsign-core\src\test\resources\keystores\privatekey.pkcs1.pem -pass password -in sample-unsigned.msi -out sample-signed.msi
Unable to load provider: legacy
Warning: Legacy mode disabled
Failed to read stream data
Failed to read stream data
Succeeded
from jsign.
It looks like the sample file contains two empty entries (@_StringData
and @_Tables
) that are causing the issue. If removed signtool accepts to sign the file, and osslsigncode no longer prints a warning.
If you try again signing a valid MSI file with Jsign 5.0 the signature should be valid.
from jsign.
If I take the minimal.msi
file used by the tests and add an empty entry, signtool accepts to sign it. So there is something else related to these entries that is causing the issue.
from jsign.
@mlundblad Do you remember how your sample file was generated?
from jsign.
Related Issues (20)
- jca/jarsigner IllegalArgumentException with private and public algorithm mismatch when specifying algorithm in Google Cloud KMS keyalias HOT 2
- Dead URL in POM HOT 1
- --replace option not working for msix installer HOT 5
- More replace options HOT 6
- Contradictory error message if no storepass is provided HOT 2
- Signature verification failed, the private key doesn't match the certificate HOT 8
- Doubt about Google HSM changes
- Support for Office files HOT 1
- Unsupported File ".exe" HOT 10
- Support for Oracle OCI Vault HOT 19
- BattlEye validation issue due to missing intermediate certificates HOT 16
- AzureKeyVault JCA provider requires list aliases permission - Unable to retrieve Azure Key Vault certificate aliases HOT 10
- Unable to retrieve the certificate chain from Azure Trusted Signing (socket write error) HOT 24
- jarsigner error: java.lang.RuntimeException: java.security.KeyStoreException: Unable to retrieve Azure Key Vault certificate aliases HOT 1
- Certificate chain not found with jarsigner and Azure Key Vault HOT 26
- Error with a Yubikey FIPS in PIV mode: The parameters in the data field are incorrect HOT 6
- apksigner & jsign with AWS? HOT 8
- Support AWS KMS Key Aliases HOT 3
- Access Denied for jsign when using from Github Action Role HOT 7
- sign more than one file with API (YUBIKEY) HOT 22
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from jsign.