search

mtrojnar / osslsigncode

OpenSSL based Authenticode signing for PE/MSI/Java CAB files
Other
729 stars 124 forks source link

"Warning: MsiDigitalSignatureEx stream doesn't exist" harmless? #401

Closed estan closed 3 weeks ago

estan commented 4 weeks ago

Sorry if this is a noob question, but after a signing an .msi with osslsigncode, verification with osslsigncode gives the above warning.

We're only signing the .msi once, no nested signatures as far as I know.

I'd just like to know whether we should be worried about this warning or not, whether it's something that Windows verification could care about. I suspect not, but I'm honestly no expert with these things :)

signtool.exe /pa /debug on the .msi comes out clean.

There looks to be a flag -add-msi-dse to osslsigncode, but I'm not sure if we should use it.

Apologies if GitHub issues is not the right place for questions. I did spend some time googling MsiDigitalSignatureEx but not really coming up with anything, so hoping one of you experts might know @mtrojnar @olszomal.

estan commented 4 weeks ago

I just tried adding -add-msi-dse and the warning disappears, and signtool.exe /pa /debug on the .msi still comes out clean.

olszomal commented 3 weeks ago

Have a look at this description and Issue #262

estan commented 3 weeks ago

Thanks, from that I take it that the warning is harmless, but I'll add the -add-msi-dse flag just to avoid it.