What is "checksum" vs. "checksum (computed)"? about jsign HOT 4 CLOSED

The computed checksum is the expected value of the checksum field if it was correct. AFAIK the checksum field is never used to ensure the integrity of the executable, so its value doesn't really matter.

from jsign.

Thanks for confirming that.

I also noticed that the checksum field is not covered by the signature so it is not a problem for signature verification if it is not updated.

However, it seems that some applications actually do check the checksum field and refuses to run if it is incorrect. I haven't fully confirmed this is the case yet but it would explain an issue that we see.

I was thinking that perhaps you know or don't know the status of the checksum calculation code? My thinking is that if it is not needed for the signature verification then maybe it is not tested as much and there could be some issue there?

Cheers,

from jsign.

However, it seems that some applications actually do check the checksum field and refuses to run if it is incorrect. I haven't fully confirmed this is the case yet but it would explain an issue that we see.

If there are applications checking this field then I agree it's important to ensure it's right.

I was thinking that perhaps you know or don't know the status of the checksum calculation code? My thinking is that if it is not needed for the signature verification then maybe it is not tested as much and there could be some issue there?

There might be corner cases not properly handled, I haven't tested this sufficiently to garantee it's perfect.

from jsign.

I found that the checksum calculation only works if the file size is less than 64 KB. I will submit a pull request for fixing the checksum calculation and also so it works with larger files.

from jsign.