InstallAware

IA X6

Version 23.07.0.2017
Build 04.13.2017 (Purple Horse)

Dear Nick,

IA X6
Version 23.07.0.2017
Build 04.13.2017 (Purple Horse)

These are correct!

*******
For test purpose, do you have any chance to install IA on a Physical Machine?
I am asking this because I cannot ask you to send me your "pfx key file" ...obviously.

Due the symptoms you described previously, it "may" be possible that the source of your issue is the VM you used to install IA.
VM(s) are generally not the best solution for production purpose. I also use VMs, but for test purpose essentially.

Development tools may not work as expected when used on VMs.

Regards

Installed X6 on my dev machine (Win 10 x64 with AVG Business anti-virus running). Fails on double-signing, so I can't get that far. Problem could be related to source, build, and script files on a network drive rather than local. Will take a little while to move things locally to try again.

Here's something else I tried. I left my executables and assemblies signed but took code signing off of the installer (unchecked 'Sign the package with Authenticode). The installer works as expected. When I manaually sign the installer exe with SignTool.exe, I get the same 'Invalid Handle' error.

Dear Nick,

are you using a SHA-2 code signing certificates?

Regards

SHA-1 (RSA)

FrancescoT wrote:Dear Nick,

are you using a SHA-2 code signing certificates?

Regards

Dear Nick,

I suppose it's the "SHA-1 (RSA)" certificate at root of your issue. IA expects a "SHA-2 code signing certificate".
---
The “Windows Enforcement of Authenticode Code Signing and Timestamping” became effective on January 1, 2016.

>> Starting from version X4, InstallAware full complies with the new "Windows Enforcement of Authenticode Code Signing and Timestamping” <<

This new policy basically mandates the deprecation of SHA-1 code signing certificates, time stamps, and file hashes for Code Signing. The new Microsoft Policy involves SHA-2 code signing certificates, time stamps, and file hashes as part of the updated policy.

https://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-sha1-certificates.aspx

Hope this helps you.

Regards

I misspoke. Our Code Signing Certificate is SHA256. Is this supported by InstallAware?

I was signing the executable/assemblies with default settings which set it to SHA-1

Dear Nick,

SHA256 or SHA-2 are the same. Windows 7 doesn't support SHA-2, this is the reason why your files get then signed as SHA-1. In fact to be conform with the latest "Windows Enforcement", you should use a Win 10 OS. Otherwise your files cannot be double signed and consequently, your signature will be not reconized on recent OS.

I just tried with building a setup package using a Win 7 machine and I don't see any problem. Files get all signed correctly and the generated setup works fine.

If you have any chance to send me a very minimal project that replicates the issue, I'll try to have a look. Maybe there is something that you missed to tell me. Of course, I can only use my code signing certificate to test the behavior.

Regards

I figured that. Upgrading my InstallAware VM to Windows 10 as we speak. Once I can confirm, I'll let you know the issue is resolved.

Thanks

Sorry about the long delay.

I can confirm that building on Windows 10 using our SHA-256 cert and the proper time server (http://timestamp.comodoca.com/rfc3161) works as expected.

Thank you very much.