Windows doesn't trust SignPath.io signature

[sdwheeler]

Now that Pandoc is code signed on Windows, I can't run it anymore. The event log error states:

pandoc.exe that did not meet the Enterprise signing level requirements or violated code integrity policy (Policy ID:{33a59c90-229d-41cf-8295-5afede1e9352}).

There is no SignPath root certificate. How do we get that certificate installed?

[jgm]

Is anyone else experiencing this? The latest Windows msi has been downloaded over 73,000 times, and this is the first report I've had of problems.

(Btw, pandoc has always been code signed, but we switched recently to a certificate from SignPath, which provides free certificates to open source projects.)

I can check with SignPath support if it's a general problem.

[sdwheeler]

I reported it to my IT Security team. I didn't get a response, but it appears that they deployed the SignPath cert chain. So this is resolved for me. I now have the following certs installed:

PSParentPath : Microsoft.PowerShell.Security\Certificate::LocalMachine\Root
Thumbprint   : 7D11F24157EB620FC9FE4DC0717B9EF6455AEEEE
Subject      : CN=SignPath Foundation, O=SignPath Foundation, L=Lewes, S=Delaware, C=US
NotAfter     : 9/7/2027 12:23:55 PM
NotBefore    : 1/28/2026 1:39:00 AM

PSParentPath : Microsoft.PowerShell.Security\Certificate::LocalMachine\Root
Thumbprint   : 4EFC31460C619ECAE59C1BCE2C008036D94C84B8
Subject      : CN=GlobalSign Code Signing Root R45, O=GlobalSign nv-sa, C=BE
NotAfter     : 3/17/2045 7:00:00 PM
NotBefore    : 3/17/2020 7:00:00 PM

PSParentPath : Microsoft.PowerShell.Security\Certificate::LocalMachine\AuthRoot
Thumbprint   : 4EFC31460C619ECAE59C1BCE2C008036D94C84B8
Subject      : CN=GlobalSign Code Signing Root R45, O=GlobalSign nv-sa, C=BE
NotAfter     : 3/17/2045 7:00:00 PM
NotBefore    : 3/17/2020 7:00:00 PM

PSParentPath : Microsoft.PowerShell.Security\Certificate::LocalMachine\CA
Thumbprint   : 2F3378BB37E11F54A13BEEE387365E52DAD398B2
Subject      : CN=GlobalSign GCC R45 CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
NotAfter     : 7/27/2038 7:00:00 PM
NotBefore    : 6/18/2024 10:25:11 PM