Comments (4)
The computed checksum is the expected value of the checksum field if it was correct. AFAIK the checksum field is never used to ensure the integrity of the executable, so its value doesn't really matter.
from jsign.
Thanks for confirming that.
I also noticed that the checksum field is not covered by the signature so it is not a problem for signature verification if it is not updated.
However, it seems that some applications actually do check the checksum field and refuses to run if it is incorrect. I haven't fully confirmed this is the case yet but it would explain an issue that we see.
I was thinking that perhaps you know or don't know the status of the checksum calculation code? My thinking is that if it is not needed for the signature verification then maybe it is not tested as much and there could be some issue there?
Cheers,
from jsign.
However, it seems that some applications actually do check the checksum field and refuses to run if it is incorrect. I haven't fully confirmed this is the case yet but it would explain an issue that we see.
If there are applications checking this field then I agree it's important to ensure it's right.
I was thinking that perhaps you know or don't know the status of the checksum calculation code? My thinking is that if it is not needed for the signature verification then maybe it is not tested as much and there could be some issue there?
There might be corner cases not properly handled, I haven't tested this sufficiently to garantee it's perfect.
from jsign.
I found that the checksum calculation only works if the file size is less than 64 KB. I will submit a pull request for fixing the checksum calculation and also so it works with larger files.
from jsign.
Related Issues (20)
- Jar Signing with Safenet Etoken - not working? HOT 15
- jca/jarsigner IllegalArgumentException with private and public algorithm mismatch when specifying algorithm in Google Cloud KMS keyalias HOT 2
- Dead URL in POM HOT 1
- --replace option not working for msix installer HOT 5
- More replace options HOT 6
- Contradictory error message if no storepass is provided HOT 2
- Signature verification failed, the private key doesn't match the certificate HOT 8
- Doubt about Google HSM changes
- Support for Office files HOT 1
- Unsupported File ".exe" HOT 10
- Support for Oracle OCI Vault HOT 19
- BattlEye validation issue due to missing intermediate certificates HOT 16
- AzureKeyVault JCA provider requires list aliases permission - Unable to retrieve Azure Key Vault certificate aliases HOT 10
- Unable to retrieve the certificate chain from Azure Trusted Signing (socket write error) HOT 24
- jarsigner error: java.lang.RuntimeException: java.security.KeyStoreException: Unable to retrieve Azure Key Vault certificate aliases HOT 1
- Certificate chain not found with jarsigner and Azure Key Vault HOT 26
- Error with a Yubikey FIPS in PIV mode: The parameters in the data field are incorrect HOT 6
- apksigner & jsign with AWS? HOT 8
- Support AWS KMS Key Aliases HOT 3
- Access Denied for jsign when using from Github Action Role HOT 7
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from jsign.