Pathname with spaces errors as if not quoted on Cygwin

[drew-512]

Hello again @ebourg -- many thanks for your efforts making jsign as an alternative to the pain known as signtool!

I seem to have come across an issue where jsign isn't processing quoted arguments properly? Importantly, this same exact script invokes jsign properly if instead of "Winter Wonders" it's a product name with no spaces.

This is the Cygwin .sh invocation:

"${THIS_DIR}/sign/jsign.cmd" --replace --storepass XXXXXX\
    --name "${TARGET_DESC}" --url "https://www.soundspectrum.com/" \
    --tsaurl "http://timestamp.sectigo.com" \
    --storetype YUBIKEY  --alias "X.509 Certificate for PIV Authentication" "${TARGET_FILE}"

And this is the output from set -x

+ '_DISTS/Winter Wonders/installer/sign/jsign.cmd' --replace --storepass XXXXXX--name 'Winter Wonders component' --url https://www.soundspectrum.com/ --tsaurl http://timestamp.sectigo.com --storetype YUBIKEY --alias 'X.509 Certificate for PIV Authentication' '_DISTS\Winter Wonders\installer\Winter Wonders\Arcade.dll'
'C:\Users\drew\soundspectrum.dev\_DISTS\Winter' is not recognized as an internal or external command,
operable program or batch file.

What you're seeing is a Cyu

[ebourg]

many thanks for your efforts making jsign as an alternative to the pain known as signtool!

You're welcome :)

I seem to have come across an issue where jsign isn't processing quoted arguments properly?

Did you try escaping the spaces with \ ? You may also try using simple quotes instead of double quotes.

If it doesn't work you can also use a filelist file, that's a text file with the name of a file to sign on each line. The filelist file has to be prefixed with @ (this requires the latest development snapshot which can be downloaded from the GitHub Actions):

jsign --storetype YUBIKEY [...] @filelist.txt

Also, but that's unrelated to this issue, you can replace the YUBIKEY storetype with PIV, this one works natively with the Yubikey and doesn't require the PKCS#11 library to be installed.