Certificate is invalid for large MSI

[gabe4797]

I have an MSI that is 1.4 GB and the process shows successful signing, but then when I look at the file it says "This digital signature is not valid." I have an almost identical project but it results in a 1.2GB MSI and it signs and verifies correctly. If I sign the 1.4GB file with signtool.exe, it works. I had seen a previous discussion about how after using signtool, jsign might work, but that does not seem to be the case here. Is there a limitation to the size of file that can be processed correctly?

[ebourg]

If signtool is able to sign the file then this is a Jsign bug. I've never tested with such a big file. Is your installer public and available somewhere? Otherwise if you could send it to [email protected] with WeTransfer I'll investigate.

[ebourg]

Investigating further... signtool computes a different hash because it insert a MsiDigitalSignatureEx entry which contains a hash of the files metadata. AFAIK this file is optional, and Jsign doesn't generate it due to a limitation of Apache POI (the API doesn't expose the metadata required to compute the hash). But maybe something specific in this installer make the MsiDigitalSignatureEx file mandatory. I'll check that.

[ebourg]

After injecting the MsiDigitalSignatureEx entry from the file signed by signtool into an unsigned file then signed by jsign, the hashes match but the signature is still invalid :(

[ebourg]

I have identified the issue, the MSI file contains unallocated sectors in the mini FAT and Apache POI doesn't compute the size of the mini FAT properly. This was partially fixed a few years ago but your file exposes a different case that wasn't covered.

For more info: apache/poi#182

[ebourg]

The fix as been submitted to Apache POI apache/poi#731

[gabe4797]

Thank you very much for your help!