Failing to sign the Windows build on Linux

[pablolmiranda]

• Version: "^5.12.1"

• Target: Windows

We are building a Windows Desktop version using a Linux environment. We correctly build the app, but when electron-builder tries to sign it, the following error happens:

Error: Signing failed with SIGBUS
    at Error (native)
    at ChildProcess.<anonymous> (/home/pablolm/app/node_modules/signcode-tf/index.js:155:16)
    at emitTwo (events.js:106:13)
    at ChildProcess.emit (events.js:191:7)
    at maybeClose (internal/child_process.js:852:16)
    at Process.ChildProcess._handle.onexit (internal/child_process.js:215:5)
From previous event:
    at WinPackager.<anonymous> (/home/pablolm/app/node_modules/electron-builder/src/winPackager.ts:132:43)
    at next (native)
From previous event:
    at tsAwaiter (/home/pablolm/app/node_modules/electron-builder/src/util/awaiter.ts:10:47)
    at Object.build (/home/pablolm/app/node_modules/electron-builder/src/builder.ts:192:52)
    at Object.<anonymous> (/home/pablolm/app/node_modules/electron-builder/src/build-cli.ts:27:28)
    at Module._compile (module.js:541:32)
    at Object.Module._extensions..js (module.js:550:10)
    at Module.load (module.js:458:32)
    at tryModuleLoad (module.js:417:12)
    at Function.Module._load (module.js:409:3)
    at Module.runMain (module.js:575:10)
    at run (bootstrap_node.js:352:7)
    at startup (bootstrap_node.js:144:9)
    at bootstrap_node.js:467:3

We are using osslsigncode 1.7.1 ( latest ), wine-1.9.9 and mono 4.2.3.

Any idea what is creating the error?

[develar]

Known issue. And you are first user who reported about it ;)

[aulvi]

@develar Glad to know it's a "real" issue. Any timeline for resolution, anything I can do to help move this along? Also, any work-arounds for signing in the interim would be welcomed, thanks!

Oh also, this is with electron-builder 5.14.2, osslsigncode 1.7.1, wine 1.8, mono 4.4.1 on a ubuntu vm.

[develar]

Workaround — use free Appveyour CI to build and sign. I don't have a lot of free time, but this issue is planned to be fixed soon.

[aulvi]

@develar Thanks for the update. Is there a working branch/pr for this issue? I'd love to contribute but don't want to step on any toes.

I will also investigate Appveyor, just a bummer since I literally just got the builds working for Travis, now I gotta throw it away 😄 Also likely not free since the project in question is not oss.

[develar]

On Travis you can build win on OS X — sign works. Please see https://github.com/electron-userland/electron-builder/blob/master/.travis.yml#L20 (all except git lfs pull) how to install wine on OS X Travis agent.

[develar]

If you can investigate why osslsigncode fails on Linux — please help, issue is planned to fix, but work not yet started.

[pisys]

osslsigncode fails when trying to dual sign. By default, it first signs with -h sha1 (which works) and then tries to sign the sha1-signed file with -h sha256 -nest -in file-signed.exe -out file-signed.exe (which fails). The actual problem is that it passes the same file reference for -in and -out. osslsigncode obviously cannot handle that and terminates with SIGBUS (bus error).

To workaround this I add "signingHashAlgorithms" : "sha1" to my win-specific build parameters. So electron-builder won't dual sign which I think we don't need at all since electron does not work on platforms older than Win7. Correct me if I'm wrong.

[develar]

@pisys Thanks for investigation!

we don't need at all since electron does not work on platforms older than Win7. Correct me if I'm wrong.

win10 requires sha256

[pisys]

Ok, then "signingHashAlgorithms" : "sha256" should be enough (as a workaround).

Anyway, why is signing done before packaging (see winPackager.ts#L105-106). Shouldn't it be the other way round? Windows tells me that the package is not signed.

When I disable signing by electron-builder and sign the built .exe manually, then Windows sees the signature.

[develar]

Anyway, why is signing done before packaging (see winPackager.ts#L105-106).

Because we must sign all — app exe, update exe, installer exe.

When I disable signing by electron-builder and sign the built .exe manually,

Please try 5.16.0 I guess your workaround is not honoured (but since 5.16.0 some change was done to sign all on the electron-builder side).

[pisys]

Yeah, thx! Works there.