VBS files inside nupkg fail to sign

[jmecosta]

Hi

Up to 40MB seems to work, but then i included a further tool and

sign code trusted-signing C:\prod\Oss\CxxSonarQubeRunner\BuildDrop\Pck\CxxSonarQubeRunner.3.6.1.nupkg -tse https://neu.codesigning.azure.net -tsa ACCOUNT -tscp PROFILE --timestamp-url http://timestamp.acs.microsoft.com --timestamp-digest SHA256 --file-digest SHA256 --publisher-name LocalSigning
fail: Sign.Core.IDataFormatSigner[0]
Signing failed with error -2146889723.
fail: Sign.Core.IDataFormatSigner[0]
Signing failed with error -2146889723.
fail: Sign.Core.IDataFormatSigner[0]
Signing failed with error -2146889723.
fail: Sign.Core.IDataFormatSigner[0]
Signing failed with error -2146889723.
fail: Sign.Core.IDataFormatSigner[0]
Signing failed with error -2146889723.
fail: Sign.Core.IDataFormatSigner[0]
Signing failed with error -2146889723.
fail: Sign.Core.IDataFormatSigner[0]
Signing failed with error -2146889723.
fail: Sign.Core.IDataFormatSigner[0]
Failed to sign. Attempts exceeded.
fail: Sign.Core.IDataFormatSigner[0]
Signing failed with error -2146889723.
fail: Sign.Core.IDataFormatSigner[0]
Failed to sign. Attempts exceeded.
fail: Sign.Core.IDataFormatSigner[0]
Signing failed with error -2146889723.
fail: Sign.Core.IDataFormatSigner[0]
Failed to sign. Attempts exceeded.
fail: Sign.Core.ISigner[0]
Failed to sign. Attempts exceeded.

Is there a limit here? or i have missed something

this is the file im trying to sign : https://github.com/jmecosta/CxxSonarQubeRunner/releases/download/3.6.1/CxxSonarQubeRunner.3.6.1.nupkg

thank you

[dlemstra]

This tool will recursively sign your files. You can get more information when you add --verbosity information. You will then see that it fails to sign a .vbs file. I think in your case you probably want to use the --file-list option to specify which files will need to be signed.

It looks like we need the patch from this PR: vcsjones/AzureSignTool#258. Ran some tests and this seems to fix the signing issue of .vbs files.

[jmecosta]

hum, so you are singning the files inside? since im doing that already to avoid double signatures.

so probably what i would be more looking for would be a option not to sign things inside the nupkg

[dlemstra]

You can avoid that with the --file-list where you specify a file that contains filters of the files that you want to sign.

[jmecosta]

ok, and from the help you dont have a way to skip signed file, so i need to preprocess the all nuget before to find the files to exclude and include - i have create a own wrapper which seems very similar to this, with the added logic that 1, it skips signed dlls (flag, can be turn off) since this will reduce the overall cost. 2, generate the CER file for the nuget to make it easy to upload to nuget.org. and 3, it seems 4x faster to sign a simple dll.

Did some time measures and this tool takes

PS C:\Users\User> AzureTrustedSignTool sign --file FileToBeSigned.dll --accountname Account --profilename Profile --verbose --resignalreadysigned
11:41:52 info: BatchSignTool[0] "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe" sign /v /debug /fd SHA256 /tr "http://timestamp.acs.microsoft.com" /td SHA256 /dlib "C:\Users\User.dotnet\tools.store\azuretrustedsigntool\1.2.5\azuretrustedsigntool\1.2.5\tools\net8.0\any\dlib\Azure.CodeSigning.Dlib.dll" /dmdf "FileToBeSigned.dll.json" "FileToBeSigned.dll"
11:41:52 info: BatchSignTool[0] Sign Output: Trusted Signing
11:41:52 info: BatchSignTool[0] Sign Output: Version: 1.0.60
11:41:52 info: BatchSignTool[0] Sign Output: "Metadata": {
11:41:52 info: BatchSignTool[0] Sign Output: "Endpoint": "https://neu.codesigning.azure.net",
11:41:52 info: BatchSignTool[0] Sign Output: "CodeSigningAccountName": "Account",
11:41:52 info: BatchSignTool[0] Sign Output: "CertificateProfileName": "Profile",
11:41:52 info: BatchSignTool[0] Sign Output: "CorrelationId": "LocalSigning",
11:41:52 info: BatchSignTool[0] Sign Output: "ExcludeCredentials": []
11:41:52 info: BatchSignTool[0] Sign Output: }
11:41:52 info: BatchSignTool[0] Sign Output: Submitting digest for signing...
11:41:53 info: BatchSignTool[0] Sign Output: OperationId 07a0551c-d279-4024-80c2-9abbd3ac2aa9: InProgress
11:41:53 info: BatchSignTool[0] Sign Output: Signing completed with status 'Succeeded' in 0.8649634s
11:41:54 info: BatchSignTool[0] Sign Output: Successfully signed: FileToBeSigned.dll
11:41:54 info: BatchSignTool[0] Sign Output: Number of files successfully Signed: 1
11:41:54 info: BatchSignTool[0] Sign Output: Number of warnings: 0
11:41:54 info: BatchSignTool[0] Sign Output: Number of errors: 0
11:41:54 info: BatchSignTool[0] Sign FileToBeSigned.dll successfully.
11:41:54 info: BatchSignTool[0] Signed : FileToBeSigned.dll : Time elapsed: 2040 ms
11:41:54 info: BatchSignTool[0] Time Total: 2040 ms

PS C:\Users\JCosta1> Measure-Command {sign code trusted-signing FileToBeSigned.dll -tse https://neu.codesigning.azure.net -tsa Account -tscp Profile --timestamp-url http://timestamp.acs.microsoft.com --timestamp-digest SHA256 --file-digest SHA256 --publisher-name LocalSigning}

Days : 0
Hours : 0
Minutes : 0
Seconds : 8
Milliseconds : 519
Ticks : 85195410
TotalDays : 9.86057986111111E-05
TotalHours : 0.00236653916666667
TotalMinutes : 0.14199235
TotalSeconds : 8.519541
TotalMilliseconds : 8519.541

suggestion, the error messages that ive posted in the entry, should include the file that fails to sign. i think that would already give a very good hint whats going on. Also by default loging all files being signed wouldnt be a bad idea

also, the original command was to sign the "blablafile.nupkg", and knowing about the --file-list it seems a bit confusing the logic of signing everything inside when you dont have a switch to disable it,imo

but anyway, thanks for the help. i can workaround my problem for the time being. thanks