Signing error

[Kratzer]

Hello all,

there are a lot of topics here about signing...

But why we get the error only sometimes and sometimes not.

We are building the Setups using Jenkins with self made batch scripts. You can build setup and build process is ok, one minute later signing gives the following error.
But files alre existing on harddisk...you try it the third time and it works.

What could be the reason for this?

(latest Win SDK is installed on the machine)

Best regards,
Bernd



Checking builds status
Build required.

[ DefaultBuild ]
Creating MSI database (en)
Writing Summary Information
Adding merge modules
Creating MSI database (de)
Writing Summary Information
Adding merge modules
Building package (all): D:\G.....\Output\PA.......exe
Preparing files
The digital signing of the APPDIR\P...exe file failed. Error message: 'Done Adding Additional Store

Number of errors: 1

SignTool Error: File not found:
'

Build finished because an error was encountered.

[Daniel]

Hello Bernd,

I'm afraid I cannot say what could be the cause of this sporadic issue. Can you please send us the .aip (project file) and a BATCH file you use to build your project to support at advancedinstaller dot com so we can investigate its settings and test the scenario on our side?

It will be really useful if you could find a pattern when this error occurs, even with a low replication rate.

All the best,
Daniel

[Kratzer]

Hi Daniel,

today the issue happened again… used Process Monitor with a filter on process name beginning with “sign”.

The call to signtool every time it succeeds looks like…

Path C:\Program Files\Windows Kits\8.1\bin\x86\signtool.exe
Command line sign /f "D:\G1_Setup_AI\Projects\DigitalSignature\Versign_CodeSig.pfx" /p "pass" "C:\Users\the_user\AppData\Local\Temp\AFT44AE.dll"

When the call fails AI is calling signtool with:

Path C:\Program Files\Windows Kits\8.1\bin\x86\signtool.exe
Command Line sign /f "D:\G1_Setup_AI\Projects\DigitalSignature\Versign_CodeSig.pfx" /p "pass" ""

Looks like the filename is missing. What’s the reason?

Should I send you aip file?

Best regards
Bernd

[Daniel]

Hello Bernd,

I'm afraid I have no clue why this happens. Please do forward us your .aip (project file) and a bat file (containing the list of command lines you are executing to build the AIP project file) to support at advancedinstaller dot com so we can further run a suite of tests on our side.

All the best,
Daniel

[henrikl]

Is this issue resolved? We have the same problem.

Best regards
Henrik

[Daniel]

Hello Henrik,

I'm not sure this is your case too, but the only thing we discovered was that this issue could appear when trying to sign multiple files. Randomly, when multiple files are selected for signing, the timestamping operation could fail due to a timing issue. Starting with AI 13.1 we added a delay about 100ms between signing attempts in case of a failure.

Did you get this error when using AI 13.1 or a higher version? If so, when this error is thrown can you please manually launch the timestamp URL in a web browser and see if it can be successfully reached?

All the best,
Daniel

[TheM]

Getting the same error with AI 13.4.

Code: Select all

19:54:54 Building package (en): C:\Program Files (x86)\Jenkins\jobs\Build XXXXXXX\workspace\Installation\AdvancedInstall\YYYYYYYYYY.exe 
19:54:54 Preparing files 
19:57:18 The digital signing of the APPDIR\jre\bin\ZZZZZZZZZZZ.exe file failed. Error message: 'Done Adding Additional Store
19:57:18 
19:57:18 Number of errors: 1

19:57:18 SignTool Error: File not found: 
' 
19:57:18  
19:57:18 Build finished because an error was encountered.
19:57:18 Build step 'Advanced Installer' changed build result to FAILURE
19:57:18 Build step 'Advanced Installer' marked build as failure

Was never an issue before. Did not start happening immediately after version 13.4 was installed. Started happening suddenly and frequently. Stops on different files. No changes to the build environment were made prior to this problem surfacing. Problem is intermittent: about half of the build attempts fails on the signing stage.

I found other message on this board indicating that this error is not new, goes back to at least 8.4, no solution was ever found.
http://www.advancedinstaller.com/forums ... hp?t=19659
http://www.advancedinstaller.com/forums ... hp?t=30711

[Daniel]

Hello,

Can you please try to manually launch the timestamp URL in the Internet Explorer web browser and see if it can be successfully reached just after such a signing error occurs? You can find the timestamp URL in your setup project in "Digital Signature" page -> "Timestamp Service URL" field.

Also, can you please send us the .AIP (project file) to support at advancedinstaller dot com so we can investigate its settings and test it?

All the best,
Daniel

[TheM]

Hi Daniel,

Can you please try to manually launch the timestamp URL in the Internet Explorer web browser and see if it can be successfully reached just after such a signing error occurs? You can find the timestamp URL in your setup project in "Digital Signature" page -> "Timestamp Service URL" field.

We use Verisign http://timestamp.verisign.com/scripts/timestamp.dll. I tried putting this into Internet Explorer right now and all I get is 400 error. I have no idea whether signing currently works or not as the problem is intermittent. When the error does occur and I just restart the build, the next one (so far) always succeeded. May look into putting together some sort of automation to try this after the build failure if you tell me how to use this link to extract some useful information I could log.

It seems other people had issues with that timestamp service: http://superuser.com/questions/430515/c ... why#598477

I will try to get approval to send you AIP file.

Regards,

[Daniel]

Hello,

Unfortunately, I'm not aware how you could log the timestamp URL failures. As a workaround you can try to change the timestamp URL (just try to use another URL from our list in "Digital Signatures" page) and see if this helps.

All the best,
Daniel

[Kratzer]

Sorry guys,

but I have to open this issue again.

We use 14.4.2 or 14.6 of AI, the newest plugin for jenkins, MS Signetool from the Win 10 SDK (on Win10) and after some weeks the error did not occur we have it again. On different files, not reproducable.

From 20 setup jobs sometimes 5 sometimes 15 fail due to this error.

Preparing files
The digital signing of the APPDIR\Bin\xxxxxxxx.dll file failed. Error message: 'Done Adding Additional Store

Number of errors: 1

SignTool Error: File not found:
'

As I wrote some months ago looking with filemon has shown that AI calls the signtool without a file name! That's why signtool says "File not Found"

Please investigate this behaviour, continuous integration is not possible with such instability.

Best regards,
Bernd

[Kratzer]

One thing again...

This error does not occur using AI on Desktop with a user is logged in and clicking on the build button.

It always occurs using the command line call via jenkins and your plugin.
Some months ago we used our own batches without the plugin and the error was present every day, after switching to the plugin it had been gone, later it came again.

Now we use your newest plugin with the feature of configuring different AI instances for jenkins and the error is still present.

Best regardfs,
Bernd

[Kratzer]

Hello all,

what could be done to avoid this problem?

BR,
Bernd

[Kratzer]

Have a look at the screenshot from Jenkins build history for a project having these problems.

Solving this problem is really urgent!

[Daniel]

Hello Bernd,

We have tested your scenario several times in a row but never were able to replicate the error. Can you please send us by email to support at advancedinstaller dot com your AIP (project file) which replicates this error and also a screenshot with the settings configured for your Advanced Installer build step of your Jenkins build?

Also, please let us know under which Windows user account does your Jenkins service run.

All the best,
Daniel