search

adoptium / jmc-build

Contains the Adoptium specific source code overrides and build pipeline script for the Java Mission Control project.
Apache License 2.0
22 stars 9 forks source link

Digital signature invalid on Windows #51

Open johanjanssen opened 10 months ago

johanjanssen commented 10 months ago

I was notified by security that I used a tool with an invalid signature on Windows. I've tried both 8.2 and 8.3.

Would be great if this can be fixed for future versions.

JMC invalid signature

gdams commented 10 months ago

Can someone show me the output of:

signtool verify /pa /v <app>
johanjanssen commented 10 months ago

Tested with JMC 8.3:

 .\signtool.exe verify /pa /v 'C:\temp\JDK Mission Control\jmc.exe'

Verifying: C:\temp\JDK Mission Control\jmc.exe

Signature Index: 0 (Primary Signature)
Hash of file (sha1): 49973BE351B250FD818DFB44C2FD50BE1E62F45B

Signing Certificate Chain:
    Issued to: DigiCert Assured ID Root CA
    Issued by: DigiCert Assured ID Root CA
    Expires:   Mon Nov 10 01:00:00 2031
    SHA1 hash: 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

        Issued to: DigiCert SHA2 Assured ID Code Signing CA
        Issued by: DigiCert Assured ID Root CA
        Expires:   Sun Oct 22 13:00:00 2028
        SHA1 hash: 92C1588E85AF2201CE7915E8538B492F605B80C6

            Issued to: Eclipse.org Foundation, Inc.
            Issued by: DigiCert SHA2 Assured ID Code Signing CA
            Expires:   Thu May 19 00:59:59 2022
            SHA1 hash: 899BF5E9EE7FD5AA2F4DDAB20FD9632ABDC58A64

The signature is timestamped: Tue Apr 19 17:03:12 2022
Timestamp Verified by:
    Issued to: USERTrust RSA Certification Authority
    Issued by: USERTrust RSA Certification Authority
    Expires:   Tue Jan 19 00:59:59 2038
    SHA1 hash: 2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E

        Issued to: Sectigo RSA Time Stamping CA
        Issued by: USERTrust RSA Certification Authority
        Expires:   Tue Jan 19 00:59:59 2038
        SHA1 hash: 02D65B95E28370C1570095FA88F923DD937FAD8F

            Issued to: Sectigo RSA Time Stamping Signer #2
            Issued by: Sectigo RSA Time Stamping CA
            Expires:   Fri Jan 23 00:59:59 2032
            SHA1 hash: 951137101D882F31BD513F949ADA4C68AD8C08F5

SignTool Error: WinVerifyTrust returned error: 0x80096010
        The digital signature of the object did not verify.

Number of files successfully Verified: 0
Number of warnings: 0
Number of errors: 1