-
|
I have an MSI that is 1.4 GB and the process shows successful signing, but then when I look at the file it says "This digital signature is not valid." I have an almost identical project but it results in a 1.2GB MSI and it signs and verifies correctly. If I sign the 1.4GB file with signtool.exe, it works. I had seen a previous discussion about how after using signtool, jsign might work, but that does not seem to be the case here. Is there a limitation to the size of file that can be processed correctly? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 10 replies
-
|
If signtool is able to sign the file then this is a Jsign bug. I've never tested with such a big file. Is your installer public and available somewhere? Otherwise if you could send it to [email protected] with WeTransfer I'll investigate. |
Beta Was this translation helpful? Give feedback.
-
|
Investigating further... signtool computes a different hash because it insert a MsiDigitalSignatureEx entry which contains a hash of the files metadata. AFAIK this file is optional, and Jsign doesn't generate it due to a limitation of Apache POI (the API doesn't expose the metadata required to compute the hash). But maybe something specific in this installer make the MsiDigitalSignatureEx file mandatory. I'll check that. |
Beta Was this translation helpful? Give feedback.
-
|
After injecting the MsiDigitalSignatureEx entry from the file signed by signtool into an unsigned file then signed by jsign, the hashes match but the signature is still invalid :( |
Beta Was this translation helpful? Give feedback.
-
|
I have identified the issue, the MSI file contains unallocated sectors in the mini FAT and Apache POI doesn't compute the size of the mini FAT properly. This was partially fixed a few years ago but your file exposes a different case that wasn't covered. For more info: apache/poi#182 |
Beta Was this translation helpful? Give feedback.
-
|
The fix as been submitted to Apache POI apache/poi#731 |
Beta Was this translation helpful? Give feedback.
-
|
Thank you very much for your help! |
Beta Was this translation helpful? Give feedback.
-
|
Jsign has been updated to use the latest release of Apache POI, and it now works perfectly to sign your sample file. |
Beta Was this translation helpful? Give feedback.
-
|
I have verified it is now working properly. Thank you for your help! |
Beta Was this translation helpful? Give feedback.
The fix as been submitted to Apache POI apache/poi#731