question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Using SignCheck to verify that a file is not signed

See original GitHub issue

Is there a way to verify that a file isn’t signed using SignCheck?

Core-Setup produces a couple of template files, apphost.exe/comhost.dll, that must not be signed, and I’m concerned that slight changes to logic might cause signing to pick it up at some point. If that happens, I want it to break the Core-Setup official build. More info about the templates: https://github.com/dotnet/core-setup/pull/7549.

If that’s not possible (and I suppose it’s fairly niche), would it be possible to add this feature?

@joeloff

/cc @JohnTortugo @MichaelSimons @dleeapho @vitek-karas

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Comments:7 (7 by maintainers)

github_iconTop GitHub Comments

1reaction
joeloffcommented, Aug 22, 2019

OK, from the tools perspective the simplest thing would be to have something similar to the exclusion file, and anything in that file, found to be signed would generate an error. This would give you the same flexibility to specify the parent files/container paths or use the hashed paths for the check.

I can probably look at it tomorrow

1reaction
joeloffcommented, Aug 22, 2019

It’s not supported right now, but I can definitely see the need for this feature.

Are there copies of these files that must be signed as well, e.g. can the installer carry two copies in different folders, one that must be signed and one that shouldn’t be signed?

Read more comments on GitHub >

github_iconTop Results From Across the Web

Check If your running Processes and Files are Digitally Signed
Fig-1: Using sigverif to verify the signature of windows drivers. The windows drivers files not signed by Microsoft.
Read more >
How to check if a file has a digital signature
E.g. with the simple line: signtool verify /pa myfile.exe if %ERRORLEVEL% GEQ 1 echo This file is not signed. (For verbose output, add...
Read more >
Check for dangerous or unsigned Certificates with SigCheck
Check for Unsigned Certificates using SigCheck​​ Sigcheck can show the file version number, timestamp information, and digital signature details, ...
Read more >
Sigcheck - Sysinternals
Sigcheck is a command-line utility that shows file version number, timestamp information, and digital signature details, ...
Read more >
Sigcheck unable to verify catalog signed status on ...
I have run two versions of this file against sigcheck -a -i which should confirm the file is catalog signed as stated but...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found