AzureSignTool: signature of bundle make the installation fails. Error 0x80070001: Failed to extract all files from container, erf: 1:2:0

[valvador92]

Instructions

Read the sections above. Delete the Triage, Discussions and support, and Instructions sections and fill out the rest.

Bugs

If this issue is a bug:

• Which version of WiX are you building with?

WiX version 3.11.2.4516

• Which version of Visual Studio are you building with (if any)?

Visual Studio 2017

• Which version of .NET are you building with?

4.8.04084

• If the problem occurs when installing your packages built with WiX, what is the version of Windows the package is running on?

Windows 10

• Describe the problem and the steps to reproduce it.

I am creating a Bundle with Wix with 2 executables.
I am signing those 2 .exe files with AzureSignTool before creating the bundle.
Wix, 1st creates an .msi based on the 1st .exe. I sign this .msi with AzureSignTool.
If I execute this .msi, installation goes fine, publisher is known.
I sign the 2nd .exe
Wix then creates the bundle.exe based on this signed .msi and the 2nd .exe signed file.
If I try to install by using the bundle.exe, it works but I have a warning message saying that the publisher is unknown.
If I sign the bundle.exe and then try to install, I don't have a warning message saying that the publisher is unknown but installation fails...
I am facing this error:
Error 0x80070001: Failed to extract all files from container, erf: 1:2:0

• Describe the behavior you expected and how it differed from the actual behavior.

My program should install the same as with the signed .msi but with the signed bundle.exe file.

Here are the logs:
logs_error_installation.txt

[barnson]

Bundles need special signing: https://wixtoolset.org/documentation/manual/v3/overview/insignia.html

[valvador92]

Thanks for your answer.
I saw this page.
I want to use that:

<PropertyGroup> <SignOutput>true</SignOutput> </PropertyGroup>

  <Target Name="SignBundleEngine">
    <Exec Command="Signtool.exe sign /a &quot;@(SignBundleEngine)&quot;" />
  </Target>
  <Target Name="SignBundle">
    <Exec Command="Signtool.exe sign /a &quot;@(SignBundle)&quot;" />
  </Target>

2 questions:

1. Where should I put this code?
   In Bundle tag, I have this error:
   error CNDL0005 : The Bundle element contains an unexpected child element 'PropertyGroup'.
   error CNDL0005 : The Bundle element contains an unexpected child element 'Target'.

2. Is it possible to use AzureSignTool or is it mandatory to use insignia ?

[valvador92]

I tried
insignia.exe -im "myBundle.exe"

I get this error:
`Windows Installer XML Toolset Inscriber version 3.11.2.4516
Copyright (c) .NET Foundation and contributors. All rights reserved.

Insignia.exe : error INSG0001 : The system cannot open the device or file specified

Exception Type: Microsoft.Tools.WindowsInstallerXml.Msi.MsiException

Stack Trace:
at Microsoft.Tools.WindowsInstallerXml.Msi.Database..ctor(String path, OpenDatabase type)
at Microsoft.Tools.WindowsInstallerXml.Inscriber.InscribeDatabase(String databaseFile, String outputFile, Boolean tidy)
at Microsoft.Tools.WindowsInstallerXml.Tools.Insignia.Run(String[] args)`

[wyrdfish]

I use an imported signing target that calls a powershell script that call out to azuresigntool.

e.g.

  <Target Name="SignBundleEngine" >
		<Exec Command='"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file  "$(MSBuildThisFileDirectory)..\..\..\..\..\utility\signfromkeyvault.ps1" "$(MSBuildThisFileDirectory)@(SignBundleEngine)" "%(SignBundleEngine.Filename)"' />
	</Target>

etc for the four targets.

in a separate Signing.targets file and then in the wixproj import it after the wix targets...

  <Import Project="$(WixTargetsPath)" />
  <Import Project="Signing.targets" />

The powershell file manages authentication and secrets and then calls.

& "$psscriptroot\..\tools\azuresigntool.exe" sign -kvu "$KeyVaultUrl" -kvi "$SigningClientId" -kvs "$SigningSecret" -kvc "$CertificateName" -d "$SigningDescription" -tr "$TimestampServer" -td sha512 -fd sha512 -v "$fileToSign"