<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div>
<div style="font-family:Calibri,sans-serif; font-size:11pt">It may be possible to add an empty key container to the stub with signtool so that it can be filled in after adding the zip without having to extend the length. I believe the PE header is modified
to locate the certificate, so it doesn't necessarily have to be at the end.<br>
<br>
Feel free to investigate this yourself with the wininst stub in Lib\distutils\command. I'll take a look, but may not be able to get to it for a while (file an issue and nosy me if you don't get anywhere, or even if you do and we can support this in newer versions).<br>
<br>
Cheers,<br>
Steve<br>
<br>
Top-posted from my Windows Phone</div>
</div>
<div dir="ltr">
<hr>
<span style="font-family:Calibri,sans-serif; font-size:11pt; font-weight:bold">From:
</span><span style="font-family:Calibri,sans-serif; font-size:11pt"><a href="mailto:p.f.moore@gmail.com">Paul Moore</a></span><br>
<span style="font-family:Calibri,sans-serif; font-size:11pt; font-weight:bold">Sent:
</span><span style="font-family:Calibri,sans-serif; font-size:11pt">ý4/ý18/ý2015 2:58</span><br>
<span style="font-family:Calibri,sans-serif; font-size:11pt; font-weight:bold">To:
</span><span style="font-family:Calibri,sans-serif; font-size:11pt"><a href="mailto:coleb@eyesopen.com">Brian Cole</a></span><br>
<span style="font-family:Calibri,sans-serif; font-size:11pt; font-weight:bold">Cc:
</span><span style="font-family:Calibri,sans-serif; font-size:11pt"><a href="mailto:distutils-sig@python.org">distutils-sig@python.org</a></span><br>
<span style="font-family:Calibri,sans-serif; font-size:11pt; font-weight:bold">Subject:
</span><span style="font-family:Calibri,sans-serif; font-size:11pt">Re: [Distutils] How to sign a exe created with bdist_wininst?</span><br>
<br>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On 17 April 2015 at 16:17, Brian Cole <coleb@eyesopen.com> wrote:<br>
> We've recently converted over to using bdist_wininst for creating our<br>
> Windows .exe installers for our libraries. Unfortunately, whenever we use<br>
> the Windows signtool utility to cryptographically sign our installer it<br>
> appears to corrupt the .exe and it can't be run anymore. The error message<br>
> thrown by Windows is "Setup program invalid or damaged".<br>
><br>
> My best guess at this point is that bdist_wininst is creating a checksum of<br>
> the file somehow and signtool is altering the file in such a way to<br>
> invalidate that checksum. The commands we're using at this point is like<br>
> this:<br>
><br>
> python3.4.exe setup.py bdist_wininst --target-version 3.4 --bitmap OurLogo<br>
> --title OurTitle-OurVersion<br>
> cp DistUtilsSetupFileName.exe OurSetupFileName.exe<br>
> call "C:\program Files (x86)\Microsoft Visual Studio<br>
> 9.0\Common7\Tools\vsvars32.bat"<br>
> signtool sign /n OurCompany /t<br>
> <a href="http://timestamp.verisign.com/scripts/timstamp.dll">http://timestamp.verisign.com/scripts/timstamp.dll</a> /d OurProject /du<br>
> OurWebsite OurSetupFileName.exe<br>
><br>
> Anyone know of a way to cryptographically sign an .exe installer from<br>
> bdist_wininst?<br>
<br>
The wininst format is a stub Windows executable, with some ini-format<br>
data and a zipfile appended (in that order). I don't know where<br>
signtools adds the signature, but if it's at the end, then that won't<br>
work (as it's necessary for the zip data to be the *last* thing in the<br>
file - zipfile format supports prepending data but not appending it as<br>
the central directory is defined as being at a fixed offset from the<br>
end of the file).<br>
<br>
There may also be a length or checksum in the ini data, I'd have to<br>
check the source to confirm that. <pause> Just checked, no it doesn't<br>
- the full details are here:<br>
<a href="https://hg.python.org/cpython/file/bc1a178b3bc8/PC/bdist_wininst/install.c">https://hg.python.org/cpython/file/bc1a178b3bc8/PC/bdist_wininst/install.c</a><br>
<br>
So basically, I don't think it's possible to sign (or otherwise<br>
modify) wininst executables.<br>
Paul<br>
_______________________________________________<br>
Distutils-SIG maillist - Distutils-SIG@python.org<br>
<a href="https://mail.python.org/mailman/listinfo/distutils-sig">https://mail.python.org/mailman/listinfo/distutils-sig</a><br>
</div>
</span></font>
</body>
</html>