dotnet / dotnet/sign

Signing in GitHub Action fails with obscure error code

Open
#1,043 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C#
Stars
581
Forks
116
Avg merge
1d 2h
Merged PRs (30d)
8

Description

**Describe the bug**
I need to sign an application built with the Rust framework Tauri. It has a GitHub Action that supports arbitrary commands for signing Windows executables. I've set it up to call this tool through a Powershell script.

I have tested the script locally and by calling it directly in a GitHub action. Both cases work fine. When I call the Azure CLI inside the Powershell script, it can log in fine as well. But the sign tool fails with an error -2147012894. This only happens when called by Tauri, not when I call the script directly.

For technical reasons, I have to use client id and client secret as environment variables for login. I cannot say if other methods work. I have confirmed that the variables are present and the values are valid.

**Repro steps**
I cannot point you to our internal repo, unfortunately. And I don't have a personal Azure account to set up a working example.

To set this up, build a Tauri application on GitHub using [this action](https://github.com/tauri-apps/tauri-action). Configure the app to use this sign tool as a [custom sign command](https://v2.tauri.app/distribute/sign/windows/#custom-sign-command).

**Expected behavior**
Signing works also for Tauri applications.

**Actual behavior**
Signing fails with error -2147012894

**Additional context**
Logs from a run:
```
info: Sign.Core.ISigner[0]
Submitting D:\a\my-app\my-app\target\x86_64-pc-windows-msvc\release\wix\x64\wix\WixUIExtension.dll for signing.
info: Sign.Core.ISigner[0]
SignAsync called for D:\a\my-app\my-app\target\x86_64-pc-windows-msvc\release\wix\x64\wix\WixUIExtension.dll. Using C:\Users\runneradmin\AppData\Local\Temp\lu4c4tah.z2w\xqvyglkm.dll locally.
info: Sign.Core.IDataFormatSigner[0]
Signing SignTool job with 1 files.
info: Sign.Core.IDataFormatSigner[0]
Signing C:\Users\runneradmin\AppData\Local\Temp\lu4c4tah.z2w\xqvyglkm.dll.
fail: Sign.Core.IDataFormatSigner[0]
Signing failed with error -2147012894.
info: Sign.Core.IDataFormatSigner[0]
Performing attempt #2 of 3 attempts after 5 s.
info: Sign.Core.IDataFormatSigner[0]
Signing C:\Users\runneradmin\AppData\Local\Temp\lu4c4tah.z2w\xqvyglkm.dll.
fail: Sign.Core.IDataFormatSigner[0]
Signing failed with error -2147012894.
info: Sign.Core.IDataFormatSigner[0]
Performing attempt #3 of 3 attempts after 11.1803398 s.
info: Sign.Core.IDataFormatSigner[0]
Signing C:\Users\runneradmin\AppData\Local\Temp\lu4c4tah.z2w\xqvyglkm.dll.
fail: Sign.Core.IDataFormatSigner[0]
Signing failed with error -2147012894.
fail: Sign.Core.IDataFormatSigner[0]
Failed to sign. Attempts exceeded.
fail: Sign.Core.ISigner[0]
Failed to sign. Attempts exceeded.
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the custom sign command used by the Tauri GitHub Action and compare its environment with the direct PowerShell and Azure CLI runs described in the report. Trace the signing entry point and logging around error -2147012894; done means reproducing the failure with a minimal workflow or identifying an actionable cause.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, github-actions, powershell, rust, tauri
Domain
cli, devops, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.