chocolatey / chocolatey/choco

Build - SignTool Error: The specified timestamp server either could not be reached or returned an invalid response.

Open
#2,293 3 comments 0 reactions 1 assignee Claimed by @gep13 View on GitHub
0 - Triaging Bug Build Automation NO RELEASE NOTES Priority - High Security
Dominant language
C#
Stars
11.5k
Forks
960
PR merge metrics
No merged PRs in 30d

Description

Can't say exactly why, but I was getting an error that didn't make any sense attempting to build this morning.

```sh
[exec] SignTool Error: The specified timestamp server either could not be reached
[exec] or returned an invalid response.
[exec] This may happen if you specify an RFC 3161 timestamp URL but used
[exec] the /t option or you specified a legacy Authenticode timestamp URL
[exec] but used the /tr option.
[exec] SignTool Warning: Signing succeeded, but an error occurred while attempting to
[exec]
[exec] timestamp: C:\codelocal\chocolatey2\code_drop\chocolatey\console\choco.exe
```

It was in https://github.com/chocolatey/choco/blob/master/.build.custom/codeSign.step. It has happily been using `/t http://timestamp.digicert.com`, but it appears maybe Digicert has taken that away as an option for `/t`.

Even though all of the documentation on Digicert appears as if we could still use `/t`, they may have made it only an RFC 3161 type of timestamp url. By the way, I find it weird/somewhat uncomfortable that these timestamp urls do not use TLS.

The fix appears to be to go through the codesign.step file and replace all instances of `/t` with `/tr`.

Is this something you are experiencing as well or is it local to me?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.