mozilla-releng / mozilla-releng/scriptworker-scripts
signingscript: sign_authenticode_file can't check if MSIX is already signed
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 16
- Forks
- 38
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 14
Description
Since https://github.com/mozilla-releng/winsign/pull/23 , winsign supports signing MSIX files with makemsix. signingscript checks whether a file is already signed with winsign.osslsigncode.is_signed(), which is not effective with the Zip-based MSIX. winsign should probably expose a generic is_signed() function that can check PE/MSI via winsign.osslsigncode.is_signed() or MSIX via winsign.makemsix.is_signed() (which does not yet exist).
osslsigncode just can't make sense of the file, is_signed() always returns False, so I don't think this causes any issues.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at signingscript/src/signingscript/sign.py around line 1290, then inspect winsign.osslsigncode.is_signed() and the winsign.makemsix module. Done means the signing check can distinguish already-signed PE/MSI files from MSIX files and use the appropriate winsign path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100