search

sassoftware / relic

Relic is a service and a tool for adding digital signatures to operating system packages for Linux and Windows
Apache License 2.0
151 stars 41 forks source link

Help : References to build a appx signer in Java #28

Closed mat1e closed 1 year ago

mat1e commented 1 year ago

Hello,

I saw "relic" is able to sign appx packages. What was your references to develop it ? I want to build a .appx signer in java but I found difficulties to find documentation about how theses types of files are signed.

Any help would be appreciated.

Thank you very much.

mtharp commented 1 year ago

Unfortunately there was very little official documentation that I could find, at least around the signing functionality. I mostly worked off of an existing open-source project https://github.com/facebookarchive/fb-util-for-appx which appears to be defunct (or at least no longer externally published), and by closely inspecting the results of signed packages. There were also a couple issues I've still not been able to figure out and had to work around, especially how compressed BlockMap entries are generated, so I try very hard to preserve the existing entries and only append non-compressed manifests to it.

mat1e commented 1 year ago

Thank you ! A solution was developped in Jsign : https://github.com/ebourg/jsign/issues/81 and is working well.