Windows 10 update sign verification error

[brandonhilkert]

• Version: 18.6.2

• Updater: 2.1.2

• Target: Windows 10

I'm having trouble getting the code verification to pass on a Windows 10 update. Any insight would be super helpful. I tried to run the same command in a PS and it looks like it's valid and has the same thumbprint as the running program. Is there something else I can check to understand why this might be happening?

I'm using the following script to release:

WIN_CSC_LINK=./.bark-electron-win.p12 CSC_LINK=./.bark-electron.p12 build -mw --x64 --ia32 --em.main=build/main.js --publish always

[2017-06-09 17:09:09:0931] [info] Sign verification failed, installer signed with incorrect certificate: {
  "SignerCertificate": {
    "FriendlyName": "",
    "IssuerName": {
      "Name": "CN=DigiCert SHA2 High Assurance Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US",
      "Oid": "System.Security.Cryptography.Oid"
    },
    "NotAfter": "/Date(1528372800000)/",
    "NotBefore": "/Date(1496361600000)/",
    "PrivateKey": null,
    "PublicKey": {
      "Key": "System.Security.Cryptography.RSACryptoServiceProvider",
      "Oid": "System.Security.Cryptography.Oid",
      "EncodedKeyValue": "System.Security.Cryptography.AsnEncodedData",
      "EncodedParameters": "System.Security.Cryptography.AsnEncodedData"
    },
    "SerialNumber": "05675754F4B0E04A8123129B44A65D92",
    "SubjectName": {
      "Name": "CN=\"Bark Technologies, Inc\", O=\"Bark Technologies, Inc\", L=Richmond Hill, S=Georgia, C=US",
      "Oid": "System.Security.Cryptography.Oid"
    },
    "SignatureAlgorithm": {
      "Value": "1.2.840.113549.1.1.11",
      "FriendlyName": "sha256RSA"
    },
    "Thumbprint": "BC5BF06603F25DBFAF1DAD0A697D691043355171",
    "Version": 3,
    "Issuer": "CN=DigiCert SHA2 High Assurance Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US",
    "Subject": "CN=\"Bark Technologies, Inc\", O=\"Bark Technologies, Inc\", L=Richmond Hill, S=Georgia, C=US"
  },
  "TimeStamperCertificate": null,
  "Status": 0,
  "StatusMessage": "Signature verified."
}
[2017-06-09 17:09:09:0946] [error] Error: Error: New version 1.0.4 is not signed by the application owner: {
  "SignerCertificate": {
    "FriendlyName": "",
    "IssuerName": {
      "Name": "CN=DigiCert SHA2 High Assurance Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US",
      "Oid": "System.Security.Cryptography.Oid"
    },
    "NotAfter": "/Date(1528372800000)/",
    "NotBefore": "/Date(1496361600000)/",
    "PrivateKey": null,
    "PublicKey": {
      "Key": "System.Security.Cryptography.RSACryptoServiceProvider",
      "Oid": "System.Security.Cryptography.Oid",
      "EncodedKeyValue": "System.Security.Cryptography.AsnEncodedData",
      "EncodedParameters": "System.Security.Cryptography.AsnEncodedData"
    },
    "SerialNumber": "05675754F4B0E04A8123129B44A65D92",
    "SubjectName": {
      "Name": "CN=\"Bark Technologies, Inc\", O=\"Bark Technologies, Inc\", L=Richmond Hill, S=Georgia, C=US",
      "Oid": "System.Security.Cryptography.Oid"
    },
    "SignatureAlgorithm": {
      "Value": "1.2.840.113549.1.1.11",
      "FriendlyName": "sha256RSA"
    },
    "Thumbprint": "BC5BF06603F25DBFAF1DAD0A697D691043355171",
    "Version": 3,
    "Issuer": "CN=DigiCert SHA2 High Assurance Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US",
    "Subject": "CN=\"Bark Technologies, Inc\", O=\"Bark Technologies, Inc\", L=Richmond Hill, S=Georgia, C=US"
  },
  "TimeStamperCertificate": null,
  "Status": 0,
  "StatusMessage": "Signature verified."
}
    at C:\Users\Brandon\AppData\Local\Programs\Bark\resources\app.asar\node_modules\electron-updater\src\NsisUpdater.ts:65:15
    at Generator.next (<anonymous>)
    at FSReqWrap.CB [as oncomplete] (C:\Users\Brandon\AppData\Local\Programs\Bark\resources\app.asar\node_modules\fs-extra-p\node_modules\fs-extra\lib\remove\rimraf.js:57:5)
From previous event:
    at NsisUpdater.doDownloadUpdate (C:\Users\Brandon\AppData\Local\Programs\Bark\resources\app.asar\node_modules\electron-updater\out\NsisUpdater.js:120:11)
    at C:\Users\Brandon\AppData\Local\Programs\Bark\resources\app.asar\node_modules\electron-updater\src\AppUpdater.ts:246:25
    at Generator.next (<anonymous>)
From previous event:
    at NsisUpdater.downloadUpdate (C:\Users\Brandon\AppData\Local\Programs\Bark\resources\app.asar\node_modules\electron-updater\out\AppUpdater.js:289:11)
    at Immediate.setImmediate (C:\Users\Brandon\AppData\Local\Programs\Bark\resources\app.asar\build\main.js:52:23)
    at runCallback (timers.js:651:20)
    at tryOnImmediate (timers.js:624:5)
    at processImmediate [as _immediateCallback] (timers.js:596:5)

[brandonhilkert]

Per #1187 (comment), I do see a publisher in the app-update.yml and it matches the CN above.

[brandonhilkert]

I was able to get the update to work by setting "forceCodeSigningVerification": false, but I wouldn't mind leaving it on, especially since I'll be signing with an EV cert shortly. Thanks!

[MariaDima]

@brandonhilkert, what value is reported in your app-update.yml on your installation folder?

Is it \ " Bark Technologies, Inc \ ".
I might be wrong, but maybe the \ " cause the problem.

[I put the extra "spaces" because if I put \ next to ", it does not post it as I would like.]

Please execute the following commands using powershell and post the output:

• Get-AuthenticodeSignature 'path_to_your_executable' | where {$_.Status.Equals([System.Management.Automation.SignatureStatus]::Valid)}
• Get-AuthenticodeSignature 'path_to_your_executable' | where {$_.SignerCertificate.Subject.Contains('CN="Bark Technologies, Inc"')}

[brandonhilkert]

One note, in the win section of the config, I was using publisherName, which I think could be left out (if i'm not mistaken) and it'll come from the certificate? If so, maybe that's the better path to resolve such subtleties?

In app-update.yml, it was reported as Bark Technologies, Inc with no slashes or escaped double quotes.

Here's the requested output:

PS C:\Users\Brandon\AppData\Local\Programs\Bark> Get-AuthenticodeSignature .\Bark.exe | where {$_.Status.Equals([System.
Management.Automation.SignatureStatus]::Valid)}


    Directory: C:\Users\Brandon\AppData\Local\Programs\Bark


SignerCertificate                         Status                                 Path
-----------------                         ------                                 ----
BC5BF06603F25DBFAF1DAD0A697D691043355171  Valid                                  Bark.exe


PS C:\Users\Brandon\AppData\Local\Programs\Bark> Get-AuthenticodeSignature .\Bark.exe | where {$_.SignerCertificate.Subj
ect.Contains('CN="Bark Technologies, Inc"')}


    Directory: C:\Users\Brandon\AppData\Local\Programs\Bark


SignerCertificate                         Status                                 Path
-----------------                         ------                                 ----
BC5BF06603F25DBFAF1DAD0A697D691043355171  Valid                                  Bark.exe

[brandonhilkert]

I now remember why I added it to package.json. Without it, I got:

Error: Cannot extract publisher name from code signing certificate, please file issue. As workaround, set win.publisherName: Error: PKCS#12 MAC could not be verified. Invalid password?
    at Object.p12.pkcs12FromAsn1 (/Users/bhilkert/Dropbox/code/bark-desktop/node_modules/node-forge/lib/pkcs12.js:475:13)
    at Lazy.<anonymous> (/Users/bhilkert/Dropbox/code/bark-desktop/node_modules/electron-builder/src/winPackager.ts:73:41)
    at Generator.next (<anonymous>)
    at Generator.tryCatcher (/Users/bhilkert/Dropbox/code/bark-desktop/node_modules/bluebird/js/release/util.js:16:23)
    at PromiseSpawn._promiseFulfilled (/Users/bhilkert/Dropbox/code/bark-desktop/node_modules/bluebird/js/release/generators.js:97:49)
    at Promise._settlePromise (/Users/bhilkert/Dropbox/code/bark-desktop/node_modules/bluebird/js/release/promise.js:574:26)
    at Promise._settlePromise0 (/Users/bhilkert/Dropbox/code/bark-desktop/node_modules/bluebird/js/release/promise.js:614:10)
    at Promise._settlePromises (/Users/bhilkert/Dropbox/code/bark-desktop/node_modules/bluebird/js/release/promise.js:693:18)
    at Promise._fulfill (/Users/bhilkert/Dropbox/code/bark-desktop/node_modules/bluebird/js/release/promise.js:638:18)
    at /Users/bhilkert/Dropbox/code/bark-desktop/node_modules/bluebird/js/release/nodeback.js:42:21
    at /Users/bhilkert/Dropbox/code/bark-desktop/node_modules/graceful-fs/graceful-fs.js:78:16
    at tryToString (fs.js:449:3)
    at FSReqWrap.readFileAfterClose [as oncomplete] (fs.js:436:12)
    at Object.p12.pkcs12FromAsn1 (/Users/bhilkert/Dropbox/code/bark-desktop/node_modules/node-forge/lib/pkcs12.js:475:13)
    at Lazy.<anonymous> (/Users/bhilkert/Dropbox/code/bark-desktop/node_modules/electron-builder/src/winPackager.ts:73:41)
    at Generator.next (<anonymous>)
    at /Users/bhilkert/Dropbox/code/bark-desktop/node_modules/graceful-fs/graceful-fs.js:78:16
    at tryToString (fs.js:449:3)
    at FSReqWrap.readFileAfterClose [as oncomplete] (fs.js:436:12)
    at Lazy.<anonymous> (/Users/bhilkert/Dropbox/code/bark-desktop/node_modules/electron-builder/src/winPackager.ts:78:15)
    at Generator.next (<anonymous>)
    at /Users/bhilkert/Dropbox/code/bark-desktop/node_modules/graceful-fs/graceful-fs.js:78:16
    at tryToString (fs.js:449:3)
    at FSReqWrap.readFileAfterClose [as oncomplete] (fs.js:436:12)

[MariaDima]

The value in the app-update.yml (Bark Technologies, Inc), should have passed the validation.

Which value did you add in package.json?
If a value is added there, then it "overrides" the value in the app-update.yml.

[develar]

1. Error about inability to detect publisher name is fixed now (pre release) but no way to detect if EV used.

[develar]

@MariaDima https://github.com/electron-userland/electron-builder/blob/master/packages/electron-updater/src/NsisUpdater.ts#L90 So, we are not aware that CN value can be quoted. But it is quoted since comma is used in the value.

[develar]

@brandonhilkert thanks for early report and sorry for inconvenience — fix will be released tomorrow.

[brandonhilkert]

Absolutely. No problem at all. Look forward to the fix 👍🏼

…

------------------------------------ http://brandonhilkert.com

On Sun, Jun 11, 2017 at 3:33 PM, Vladimir Krivosheev < ***@***.***> wrote: @brandonhilkert <https://github.com/brandonhilkert> thanks for early report and sorry for inconvenience — fix will be released tomorrow. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1641 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAtbFNaivncmrI5rBuYoDAj-yShR0Ooqks5sDEETgaJpZM4N1-Om> .