Support for MSI files about signify HOT 7 OPEN

I will certainly look into it.

from signify.

This issue is caused by the fact that msi files have a different structure, currently not supported by signify.

from signify.

MSI files have OLE2 structure I managed to get the signed data using olefile library and then reading part with digital signature

with OleFileIO(self.fname) as ole:
    # https://github.com/decalage2/olefile
    if not ole.exists("\x05DigitalSignature"):
        return
    # get properties from the stream:
    with ole.openstream("\x05DigitalSignature") as fh:
        b_data = fh.read()
data = structures.AuthenticodeSignedData.from_envelope(b_data)

from signify.

MSI files are not PEFiles so that means they have to be inspected differently, but it is possible once you get to the actual signature data the validation could be similar. Same goes for CAB files and MSIX files I think.

from signify.

data = structures.AuthenticodeSignedData.from_envelope(b_data)

@crowley285 This feature doesn't seem to be in the newest signify. Unclear How to do this in the latest.

from signify.

@jgstew it's located in the base class for AuthenticodeSignedData in signify/pkcs7/signeddata.py
i'm importing it by:
from signify.authenticode import structures

from signify.

ah, now I see: https://github.com/ralphje/signify/blob/master/signify/pkcs7/signeddata.py#L73

Using .explain_verify() on it gives the error:

(<AuthenticodeVerificationResult.UNKNOWN_ERROR: 5>, AttributeError("'NoneType' object has no attribute 'get_fingerprinter'"))

This seems to be because it is not doing it as a signedpe file to start with, doesn't like jumping into it.

If instead:

        with ole.openstream("\x05DigitalSignature") as fh:
            pefile = SignedPEFile(fh)
            print(pefile.explain_verify())

Then I get the error: (<AuthenticodeVerificationResult.NOT_SIGNED: 2>, SignedPEParseError('The PE file does not contain a certificate table.'))

This makes some sense. I think from_envelope is probably the right way to do this, but it gets stuck due to there not being an actual PE file involved to parse first.

from signify.