clickonce - SignTool 验证 .application 和 .manifest 文件的等效项？

Question

我正在使用signtool.exe v6.2.9200.20527 来支持/tr 和/td 开关。在以下示例中，0961...35d2 是当前用户的个人 > 证书存储中 SHA256 代码签名证书的 SHA1 指纹。

示例 1:使用 SHA256 摘要进行代码签名，无时间戳。

c:signtool.exe sign /fd sha256 /sha1 0961...35d2 CertificateCheck.exe
c:signtool.exe verify /all /pa CertificateCheck.exe

File: CertificateCheck.exe
Index  Algorithm  Timestamp
========================================
0      sha256     None

Successfully verified: CertificateCheck.exe

示例 2:使用 SHA1 摘要进行代码签名，无时间戳。

c:signtool.exe sign /fd sha1 /sha1 0961...35d2 CertificateCheck.exe
c:signtool.exe verify /all /pa CertificateCheck.exe

File: CertificateCheck.exe
Index  Algorithm  Timestamp
========================================
0      sha1       None

Successfully verified: CertificateCheck.exe

示例 3:使用 SHA256 摘要和 SHA1 摘要以及时间戳进行双重签名。

c:signtool.exe sign /fd sha256 /sha1 0961...35d2 /tr http://timestamp.globalsign.com/scripts/timstamp.dll /td sha256 CertificateCheck.exe
c:signtool.exe sign /as /fd sha1 /sha1 0961...35d2 /tr http://timestamp.globalsign.com/scripts/timstamp.dll /td sha1  CertificateCheck.exe
c:signtool.exe verify /all /pa CertificateCheck.exe

File: CertificateCheck.exe
Index  Algorithm  Timestamp
========================================
0      sha256     RFC3161
1      sha1       RFC3161

使用signtool verify/v我还可以查看证书详细信息和证书信任链...

c:signtool.exe verify /all /pa /v CertificateCheck.exe

Verifying: CertificateCheck.exe
Signature Index: 0 (Primary Signature)
Hash of file (sha256): 6774...B2D1

Signing Certificate Chain:
    Issued to: GlobalSign
    Issued by: GlobalSign
    Expires:   Sun Mar 18 20:00:00 2029
    SHA1 hash: D69B...76AD

        Issued to: GlobalSign CodeSigning CA - SHA256 - G2
        Issued by: GlobalSign
        Expires:   Fri Aug 02 20:00:00 2019
        SHA1 hash: 4E34...36FF

            Issued to: Example Company Pty Ltd
            Issued by: GlobalSign CodeSigning CA - SHA256 - G2
            Expires:   Fri May 11 02:17:24 2018
            SHA1 hash: 0961...35D2

The signature is timestamped: Wed May 06 13:51:05 2015
Timestamp Verified by:
    Issued to: GlobalSign Root CA
    Issued by: GlobalSign Root CA
    Expires:   Fri Jan 28 22:00:00 2028
    SHA1 hash: B1BC...829C

        Issued to: GlobalSign Timestamping CA - G2
        Issued by: GlobalSign Root CA
        Expires:   Fri Jan 28 22:00:00 2028
        SHA1 hash: C0E4...5B71

            Issued to: GlobalSign TSA for Standard - G2
            Issued by: GlobalSign Timestamping CA - G2
            Expires:   Tue Mar 03 10:00:00 2026
            SHA1 hash: 19E1...65B6

Signature Index: 1
Hash of file (sha1): CFA4...7863

Signing Certificate Chain:
    Issued to: GlobalSign
    Issued by: GlobalSign
    Expires:   Sun Mar 18 20:00:00 2029
    SHA1 hash: D69B...76AD

        Issued to: GlobalSign CodeSigning CA - SHA256 - G2
        Issued by: GlobalSign
        Expires:   Fri Aug 02 20:00:00 2019
        SHA1 hash: 4E34...36FF

            Issued to: Example Company Pty Ltd
            Issued by: GlobalSign CodeSigning CA - SHA256 - G2
            Expires:   Fri May 11 02:17:24 2018
            SHA1 hash: 0961...35D2

The signature is timestamped: Wed May 06 13:51:06 2015
Timestamp Verified by:
    Issued to: GlobalSign Root CA
    Issued by: GlobalSign Root CA
    Expires:   Fri Jan 28 22:00:00 2028
    SHA1 hash: B1BC...829C

        Issued to: GlobalSign Timestamping CA - G2
        Issued by: GlobalSign Root CA
        Expires:   Fri Jan 28 22:00:00 2028
        SHA1 hash: C0E4...5B71

            Issued to: GlobalSign TSA for Standard - G2
            Issued by: GlobalSign Timestamping CA - G2
            Expires:   Tue Mar 03 10:00:00 2026
            SHA1 hash: 19E1...65B6


Successfully verified: CertificateCheck.exe

Number of signatures successfully Verified: 2
Number of warnings: 0
Number of errors: 0

我们还使用 Mage.exe 和 SignTool.exe 的组合对 ClickOnce .application 和 .manifest 文件进行双重签名，但 SignTool verify 似乎不适用于 .application 和 .manifest 文件:

c:signtool.exe verify /all /pa /v CertificateCheck.application

Verifying: CertificateCheck.application
SignTool Error: This file format cannot be verified because it is not recognized.

Number of signatures successfully Verified: 0
Number of warnings: 0
Number of errors: 1

c:signtool.exe verify /all /pa /v CertificateCheck.exe.manifest

Verifying: CertificateCheck.exe.manifest
SignTool Error: This file format cannot be verified because it is not recognized.

Number of signatures successfully Verified: 0
Number of warnings: 0
Number of errors: 1

我们可以在支持 XML 的编辑器中打开 .manifest 和 .application 文件，以查看实际上已添加 Base64 编码的签名，但是否有与 SignTool verify 等效的工具可以让我查看签名和/或证书从命令行附加的信任链？或者我只是驾驶错误？我想这样做，以便我们可以向构建脚本添加测试步骤。

更多信息...

好吧，这似乎是一个与版本相关的问题。

我收集了几个不同版本的 SignTool 来尝试各种事情。 v5 系列有各种验证/ list 开关，而我遇到的 v6 系列都没有。另一方面，v6 系列支持 SHA2 证书和算法，而 v5 系列不太喜欢它们。

使用signtool.exe v5.2.3790.2568，我可以通过以下方式检查强名称(应用程序身份):

signtool verify /manifest /snonly /v CertificateChecker.application
Successfully verified: CertificateChecker.application

Number of files successfully Verified: 1
Number of warnings: 0
Number of errors: 0

但是如果我尝试显示证书信任链(并且其中有 SHA256 证书)，则会出错:

signtool verify /manifest /pa /v CertificateChecker.application
SignTool Error: CryptVerifyManifestFile returned error: 0x800B0004
        The subject is not trusted for the specified action.
Signing Certificate Chain:
    Issued to: GlobalSign
    Issued by: GlobalSign
    Expires:   2029-03-18 8:00:00 PM
    SHA1 hash: D69B...76AD

        Issued to: GlobalSign CodeSigning CA - SHA256 - G2
        Issued by: GlobalSign
        Expires:   2019-08-02 8:00:00 PM
        SHA1 hash: 4E34...A36FF

            Issued to: Example Pty Ltd
            Issued by: GlobalSign CodeSigning CA - SHA256 - G2
            Expires:   2018-05-11 2:17:24 AM
            SHA1 hash: 0961...A35D2

File is not timestamped.
SignTool Error: File not valid: CertificateChecker.application

Number of files successfully Verified: 0
Number of warnings: 0
Number of errors: 1

所以我留下了原始问题的一个变体:是否有 SignTool verify 替代 ClickOnce .application 和 .manifest 文件...并支持 SHA256？

Answer 1

mage.exe Manifest Generation and Editing Tool

mage -s CertificateCheck.application

我还不知道如何通过 CLI 进行验证。