Using SignCheck to verify that a file is not signed
See original GitHub issueIs there a way to verify that a file isn’t signed using SignCheck?
Core-Setup produces a couple of template files, apphost.exe
/comhost.dll
, that must not be signed, and I’m concerned that slight changes to logic might cause signing to pick it up at some point. If that happens, I want it to break the Core-Setup official build. More info about the templates: https://github.com/dotnet/core-setup/pull/7549.
If that’s not possible (and I suppose it’s fairly niche), would it be possible to add this feature?
Issue Analytics
- State:
- Created 4 years ago
- Comments:7 (7 by maintainers)
Top Results From Across the Web
Check If your running Processes and Files are Digitally Signed
Fig-1: Using sigverif to verify the signature of windows drivers. The windows drivers files not signed by Microsoft.
Read more >How to check if a file has a digital signature
E.g. with the simple line: signtool verify /pa myfile.exe if %ERRORLEVEL% GEQ 1 echo This file is not signed. (For verbose output, add...
Read more >Check for dangerous or unsigned Certificates with SigCheck
Check for Unsigned Certificates using SigCheck Sigcheck can show the file version number, timestamp information, and digital signature details, ...
Read more >Sigcheck - Sysinternals
Sigcheck is a command-line utility that shows file version number, timestamp information, and digital signature details, ...
Read more >Sigcheck unable to verify catalog signed status on ...
I have run two versions of this file against sigcheck -a -i which should confirm the file is catalog signed as stated but...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
OK, from the tools perspective the simplest thing would be to have something similar to the exclusion file, and anything in that file, found to be signed would generate an error. This would give you the same flexibility to specify the parent files/container paths or use the hashed paths for the check.
I can probably look at it tomorrow
It’s not supported right now, but I can definitely see the need for this feature.
Are there copies of these files that must be signed as well, e.g. can the installer carry two copies in different folders, one that must be signed and one that shouldn’t be signed?