search

vcsjones / AzureSignTool

SignTool Library and Azure Key Vault Support
MIT License
267 stars 85 forks source link

AzureSignTool incorrectly detect unsigned files as signed #240

Open Crypt32 opened 5 months ago

Crypt32 commented 5 months ago

sometimes AzureSignTool incorrectly detects unsigned file as signed and skips such file from signing. The issue appears under the following conditions:

  1. -s switch is used
  2. file being signed contains a certificate, PKCS7 (signed or unsigned) bag as a content, embedded resource, etc
  3. embedded certificate contains Code Signing EKU

The root cause is because the X509Certificate.FromSignedFile .NET API is flawed and description is misleading. More details in my blog post about this particular issue: https://www.pkisolutions.com/blog/azuresigntool-incorrectly-identifies-unsigned-files-as-signed/