owasp-modsecurity / owasp-modsecurity/ModSecurity
IIS MSI installers not following MS standard for digital signature
@victorhora is already working on this.
Since Jan 11, 2019.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
Our friends from Apache Lounge (@SteffenAL) have reported that the ModSecurity IIS build/msi installer seems to be missing proper digital signatures leading to error / warning messages on modern versions of Windows.
This demands further investigation to see where it happens, workarounds and additional steps recommended for a future release.
To Reproduce
Steps to reproduce the behaviour:
When I download I get a big warning from IE, see attached pic.
The other problem with not signed .msi's is: when I double click on the .msi, I get in the Event viewer: ActivateApplicationForContractByExtensionIdAsUserWithHost of the app Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy!App for the Windows.Protocol contract failed with This app can't be activated by the Built-in Administrator.
Expected behavior
The MSI installer should ideally be digitally signed as per best practices to avoid warnings / errors such as the ones reported here.
Server (please complete the following information):
- ModSecurity version (and connector): 2.9.3 32b/64bit msi installers
- WebServer: IIS?
- OS (and distro):
Additional context
Do not know if this also happens with Win10 or other server editions.
The MSIs are already digitally signed with PGP signatures as available here and here.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.