adxpublisher generated web installer throws a security error

Add-in Express™ Support Service
That's what is more important than anything else

adxpublisher generated web installer throws a security error
adxpublisher generated web installer throws a security error 
Posts 1 - 10 of 13
First | Prev. | 1 2 | Next | Last 
Subscribe
Frank Horenberg




Posts: 20
 Joined: 2022-08-03
Hi!

We have had an issue with the web installer of our application that we generate using the adxpublisher.

After creating and publishing the executable for the latest version, we get the following error when trying to update.

"Security error: The security key doesn’t match the signature of ‘version_info.xml’.Task name: ParseXML."

The artifacts are in their respective folders.
There is a new xml node entry for the new version in the version_info.xml.
The "DigestValue" and "Signature" values have changed in the "Signature" xml node of the version_info.xml.

The only thing we can pinpoint as a potential cause is that the code signing certificate we signed the artifacts with was renewed (with a different password) since the previous release.

Which are the scenarios that the above error can occur?
Posted 03 Jan, 2024 09:29:05 Top
Andrei Smolin


Add-in Express team


Posts: 18833
 Joined: 2006-05-11
Hello Frank,

Make sure that you select the "Sign 'version_info.xml' file" check box; see Deployment | Common in Preferences.

Regards from Poland (GMT+1),

Andrei Smolin
Add-in Express Team Leader
Posted 04 Jan, 2024 11:31:48 Top
Frank Horenberg




Posts: 20
 Joined: 2022-08-03
Hi Andrei,

Thank you for replying to my question.

We do not use the UI to publish the web installer setup file. We have a script that executes all the necessary build scripts and then in the end executes the adxpublisher. 

& $RootPath/src/Zivver.OfficePlugin.Installer/Publisher/adxpublisher.exe /OutputType=ClickTwice /ConfigFile=$configFileDefault;


In the adxpublisher.exe.config, we have set the "signVersionInfo" setting to true. I would assume that if we had not set that, then the Signature xml node would not be in the xml file, or the DigestValue and/or SignatureValue values would not have changed on every new version being added.. 

<add key="signVersionInfo" value="true" />



As a reference, I am posting the configuration file that has we use for publishing the web installers. 


<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <configSections>
    <sectionGroup name="publish.Settings" type="System.Configuration.ApplicationSettingsGroup, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
      <section name="clickOnce.Settings" type="System.Configuration.AppSettingsSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
      <section name="clickTwice.Settings" type="System.Configuration.AppSettingsSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
    </sectionGroup>
  </configSections>
  <startup useLegacyV2RuntimeActivationPolicy="true">
    <supportedRuntime version="v4.0" />
  </startup>
  <publish.Settings>
    <clickTwice.Settings>
      <!-- Required. If set to true, the downloader will cause the UAC dialog to show up. Default - false. -->
      <add key="requiresElevation" value="false" />

      <!-- Required. The path and file name of the .MSI file containing an installer of your add-in, e.g. "D:MyProjectMyProject.msi". -->
      <add key="installerFile" value="......inReleaseInstalleren-USZivver.OfficePlugin.Installer.msi" />

      <!-- Required. The publishing Location. A file share or an FTP server. E.g.  "D:MyProjectMSIPublish", "\ServerApplicationName", "ftp://ftp.domain.com/ApplicationName". -->
      <add key="publishingLocation" value="......	empPublishedInstallers" />

      <!-- Required. A URL or UNC path that specifies the location from which users download and run the installer, e.g. "http://www.domain.com/ApplicationName" or "\ServerApplicationName". -->
      <add key="installationUrl" value="https://{URL_POINTING_TO_VERSION_INFO_FOLDER}" />

      <!-- Optional. A list of URLs or UNC paths (separated with ";") that specifies locations from which users can download and run the installer -->
      <add key="additionalInstallationURLs" value="" />

      <!-- The "code-sign" is the certificate used for web-installer verification. -->
      <!-- Either user certificateFile and certificatePassword, or certificateSubjectName and certificateThumbprint -->

      <!-- Required. The path and file name of the certificate file, e.g. "d:MyKeysmykey.pfx" -->
      <add key="certificateFile" value=".code-sign.pfx" />

      <!-- Optional. A password for the certificate file specified by 'certificateFile'. -->
      <add key="certificatePassword" value="" />

      <!-- Required. The name of the subject of the signing certificate. Specifies the name of the subject of the signing certificate, e.g. "My Company" -->
      <add key="certificateSubjectName" value="" />

      <!-- The thumbprint of the signing certificate. Must be installed in the Windows certificate store -->
      <add key="certificateThumbprint" value="" />

      <!-- Required. If true, the SHA1 hash algorithm is used for signing of binary files. It can be used together with the SHA256 algorithm. Default - true. -->
      <add key="sha1Enabled" value="true" />

      <!-- Required. If true, the SHA256 hash algorithm is used for signing of binary files. It can be used together with the SHA1 algorithm. Default - false. -->
      <add key="sha256Enabled" value="true" />

      <!-- Optional. The URL of the time stamp server. -->
      <add key="timestampUrl" value="http://timestamp.digicert.com" />

      <!-- Optional. The URL of the time stamp server that supports RFC 3161 timestamps. -->
      <add key="timestampSHA256Url" value="http://timestamp.digicert.com" />

      <!-- Optional. The edition name of the instalation, e.g. "Public".-->
      <add key="edition" value="Public" />

      <!-- Optional. A list of editions supported by the installation (separated with ";"), e.g. "Public;Test"-->
      <add key="supportedEditions" value="Public" />

      <!-- Required. The file name of the downloader file, e.g. "myproject".-->
      <add key="downloaderFileName" value="zivver.officeplugin" />

      <!-- Optional. The path and file name of the custom action assembly containing a ClickTwice module, e.g. "D:MyProjectCustomActionMyActions.dll". -->
      <add key="customActionAssembly" value="......inReleaseinstallerActionZivver.OfficePlugin.Installer.UI.dll" />

      <!-- Optional. The full name of the class that inherits the ADXClickTwiceModule class, e.g MyNamespace.MyCustomActionClass. -->
      <add key="customActionClass" value="Zivver.OfficePlugin.Installer.UI.InstallerUIModule" />

      <!-- Optional. The name of an icon file, e.g. "test.ico". If this attribute is specified, the corresponding file must be located in the folder specified in 'projectOutputDirectory'. The icon is used for the app visible in the Start menu of Windows Explorer as well as in the "Uninstall or change a program" list ("Add / Remove Programs" in Windows XP).  -->
      <add key="iconFileName" value="..Resourcesicon.ico" />

      <!-- Required. A list of application names (separated with ";") that must be re-started when the add-in is registered, e.g. "Excel;Word;Internet Explorer"  -->
      <add key="targetApplicationNames" value="Outlook" />

      <!-- Optional. Specifies if the Windows installer UI will be shown during installation. Default - false. -->
      <add key="quietModeDuringInstall" value="false" />

      <!-- Optional. Specifies if the Windows installer UI will be shown during uninstallation. Default - true. -->
      <add key="quietModeDuringUninstall" value="true" />

      <!-- Optional. Specifies if the downloader's windows will be shown during the download process. Default - true. -->
      <add key="showDownloaderWindow" value="true" />

      <!-- Optional. If true, shows the warning if the host application(s) is running. Default - true. -->
      <add key="showRunningApplicationsWarning" value="true" />

      <!-- Optional. Specifies sets of buttons available for 'ShowRunningApplicationsWarning' dialog. Supported values: YesNoCancel, OkCancel, Ok. Default - YesNoCancel. -->
      <add key="showRunningApplicationsDialogButtons" value="YesNoCancel" />

      <!-- Optional. If true, the 'version_info.xml' file will be signed with the specified certificate. Default - false. -->
      <add key="signVersionInfo" value="true" />

      <!-- Optional. Specifies a string to be returned by CheckForUpdates/CheckForMSIUpdates() if a new version of the add-in is available. If there's no new version, CheckForUpdates/CheckForMSIUpdates() returns an empty string. -->
      <add key="checkForUpdateReturnString" value="" />

      <!-- Optional. A list of prerequisites (separated with ";"), e.g. "Microsoft.Net.Framework.3.5.SP1;Microsoft.Windows.Installer.3.1" -->
      <add key="prerequisites" value=".NETFramework,Version=v4.5" />

      <!-- Optional. Specifies the folder location containing prerequisites, e.g. "C:Program Files (x86)Microsoft SDKsWindows7.0ABootstrapper" -->
      <!-- <add key="bootstrapperDirectory" value="c:Program Files (x86)Microsoft SDKsClickOnce Bootstrapper" /> -->
      <add key="bootstrapperDirectory" value="" />

      <!-- Optional. If true, setup.exe installing the prerequisites listed in 'prerequisites' will be generated. Setting to true is required to install prerequisites. If no prerequisites are used, can be set to false. Default - false.-->
      <add key="createSetupExe" value="false" />

      <!-- Optional. If true, setup.exe for each supported culture will be generated. Default - false.-->
      <add key="generateMultiLanguagePrerequisites" value="false" />

      <!-- Optional. If true, prerequisites will be downloaded from the vendor's web site, otherwise, prerequisites will be copied to the location specified by 'publishingLocation'. Default - false. -->
      <add key="downloadFromVendorWebSite" value="true" />

      <!-- Optional. If true, prerequisites will be downloaded from the location set in the 'prerequisitesCustomLocation' value. Default - false. -->
      <add key="downloadFromCustomLocation" value="false" />

      <!-- Optional. Specifies the URL containing the installation prerequisites. -->
      <add key="prerequisitesCustomLocation" value="" />

      <!-- Optional. Specifies the command line that run before the publish process starts. -->
      <add key="preBuildCommandLine" value="" />

      <!-- Optional. Specifies the command line that run after the publish process finishes. -->
      <add key="postBuildCommandLine" value="" />

      <!-- Optional. If true, the downloader checks for hashes of all downloaded files. Default - true.-->
      <add key="enableHashChecking" value="true" />

      <!-- Optional. If true, the downloader removes previous versions of the product. Default - true.-->
      <add key="removePreviousVersions" value="true" />

      <!-- Optional. Specifies the text of the downloader window. -->
      <add key="downloaderWindowTitle" value="" />

      <!-- Optional. Specifies the static part of the progress text in the downloader window. -->
      <add key="downloaderProgressText" value="Downloading..." />

      <!-- Optional. Specifies the custom error text of the downloader application. -->
      <add key="downloaderErrorMessage" value="" />

      <!-- Optional. Specifies the error url of the downloader application. -->
      <add key="downloaderErrorUrl" value="" />

      <!-- Optional. If true, the dynamic installation url will be generated whenever the updater starts, e.g. http://mydomain-01jan2017.commyapp -->
      <add key="enableDynamicUrl" value="false" />

      <!-- Optional. Specifies the first static part of the dynamic installation url, e.g. 'mydomain-' -->
      <add key="dynamicUrlDomainPrefix" value="" />

      <!-- Optional. Specifies the second static part of the dynamic installation url, e.g. '.com' -->
      <add key="dynamicUrlDomainSuffix" value="" />

      <!-- Optional. Specifies the url path of the dynamic installation url, e.g. 'myapp' -->
      <add key="dynamicUrlPath" value="" />

      <!-- Optional. Specifies the dynamic part of the dynamic installation url, e.g. '01jan2017'. Supported values: month, year. Default - year. -->
      <add key="dynamicUrlPeriod" value="month" />

      <!-- Optional. If true, the custom action assembly will be loaded by the downloader. Default - true. -->
      <add key="enableCAForDownloader" value="false" />

      <!-- Optional. If true, the custom action assembly will be loaded by the updater. Default - false. -->
      <add key="enableCAForUpdater" value="false" />

      <!-- Optional. If true, the updater application will be included in the ClickTwice installation. Default - false. -->
      <add key="auEnabled" value="false" />

      <!-- Optional. Specifies when the updater checks for updates. Supported values: start, close, background. Default - start. -->
      <add key="auCheckForUpdatesOn" value="start" />

      <!-- Optional. Specifies how often the updater checks for updates. This option is used when 'auCheckForUpdatesOn' is 'background'. Default - 1 hour. -->
      <add key="auCheckForUpdatesInterval" value="1" />

      <!-- Optional. Specifies the time unit of the 'auCheckForUpdatesInterval' option. Supported values: minutes, hours, days. Default - hours. -->
      <add key="auCheckForUpdatesTimeUnit" value="hours" />

      <!-- Optional. If true, the updater starts at Windows startup. This option is used when 'auCheckForUpdatesOn' is 'background'. Default - true. -->
      <add key="auRunAtWindowsStartup" value="true" />

      <!-- Optional. If true, the updater will be unloaded if no update is available. This option is used when 'auCheckForUpdatesOn' is 'start'. Default - false. -->
      <add key="auUnloadUpdaterAfterCheckForUpdates" value="false" />

      <!-- Optional. Specifies when the updater renew notification about available updates. Default - 1 day. -->
      <add key="auRemindInterval" value="1" />

      <!-- Optional. Specifies the time unit of the 'auRemindInterval' option. Supported values: hours, days, weeks. Default - days. -->
      <add key="auRemindTimeUnit" value="days" />

      <!-- Optional. Specifies how often the updater warns about started Office applications. Default - 5 minutes. -->
      <add key="auRunningAppWarningInterval" value="5" />

      <!-- Optional. Specifies how often the updater notifies about the new available version of the software. Default - 10 minutes. -->
      <add key="auNewVersionWarningInterval" value="10" />

      <!-- Optional. If true, ClickTwice will try to download the new version of the updater application if there are any problems with the upodater start. Default - true. -->
      <add key="auUpdaterAutoDownload" value="true" />

      <!-- Optional. If true, the user can unload the updater application via the 'Exit' option of the updater notify icon. Default - false. -->
      <add key="auAllowUserExit" value="false" />

      <!-- Optional. If true, the application icon is shown in the updater window. Default - true. -->
      <add key="auShowAppIcon" value="true" />

      <!-- Optional. If true, the updater window is shown in the Windows TaskBar. Default - false. -->
      <add key="auShowInTaskBar" value="false" />

      <!-- Optional. If true, the updater shows notifications in the system tray. Default - true. -->
      <add key="auAllowTrayNotifications" value="true" />

      <!-- Optional. If true, the updater notify icon is always visible in the system tray. Default - false. -->
      <add key="auAlwaysShowTrayIcon" value="false" />

      <!-- Optional. If true, the 'Skip this version' button is displayed in the updater window. Default - true. -->
      <add key="auShowSkipButton" value="true" />

      <!-- Optional. If true, the updater window can be displayed by the double-click, sigle-click is used by default. Default - false. -->
      <add key="auUseDoubleClickForNotifyIcon" value="false" />

      <!-- Optional. If true, the updater log file is created whenever the updater starts. Default - true. -->
      <add key="auGenerateUpdaterLog" value="true" />

      <!-- Optional. Specifies the location of the updater log file, e.g. 'c:Users[UserName]AppDataLocalTempmyproject'. Supported templates: ProgramFilesX64Folder, RoamingAppDataFolder, DesktopFolder, PersonalFolder, InternetCacheFolder, LocalAppDataFolder, AppDataFolder, DocumentsFolder, MyDocumentsFolder, -->
      <!-- ProfileFolder, UserProfileFolder, ProgramFilesFolder, CommonProgramDataFolder, PublicDesktopFolder, ProgramFilesX64CommonFolder, ProgramFilesCommonFolder, Temp, TempFolder. Default - $(Temp)$(ProjectName) -->
      <add key="auUpdaterLogLocation" value="$(Temp)$(ProductName)" />

      <!-- Optional. Specifies the location of the updater window on the screen. Supported values: screenCenter, systemTray. Default - systemTray. -->
      <add key="auUpdaterWindowPosition" value="systemTray" />

      <!-- Optional. If true, the updater will install updates silently. Default - false. -->
      <add key="auSilentUpdateMode" value="false" />

      <!-- Optional. If true, the updater will write information about update process in the system log. Default - false. -->
      <add key="auWriteToSystemLog" value="true" />

      <!-- Optional. If true, the updater will hide MSI UI during update process. Default - false. -->
      <add key="auQuietUpdateMode" value="false" />

      <!-- Optional. If true, the updater will display 'Update Complete' dialog if the update process succeeded. Default - false. -->
      <add key="auShowUpdateCompleteDialog" value="false" />

      <!-- The FTP-related settings below apply only if 'installationURL' specifies the FTP path to which users go to install the application. -->
      <add key="ftpAnonymous" value="true" />
      <add key="ftpUserName" value="" />
      <add key="ftpPassword" value="" />
      <add key="ftpPassiveMode" value="false" />
    </clickTwice.Settings>
  </publish.Settings>
</configuration>


Looking forward to your reply!

Kind regards,
Frank
Posted 05 Jan, 2024 09:55:10 Top
Andrei Smolin


Add-in Express team


Posts: 18833
 Joined: 2006-05-11
Hello Frank,

Make sure that the add-in files are *not* modified after you signed the add-in; that's the usual cause of this issue. According to our guys, the error message means you've re-signed the add-in after it was published.

Regards from Poland (GMT+1),

Andrei Smolin
Add-in Express Team Leader
Posted 05 Jan, 2024 11:22:00 Top
Frank Horenberg




Posts: 20
 Joined: 2022-08-03
Hi Andrei,

We are aware of this. We do not sign the artifacts again after they are published. The adxpublisher command is the only command used on the artifacts from the build step.

Is there any other way that this error can be shown? Could the renewal of the code signing certificate or the changed password affect it in any way?

Looking forward to your reply!

Kind regards,
Frank
Posted 08 Jan, 2024 10:16:55 Top
Andrei Smolin


Add-in Express team


Posts: 18833
 Joined: 2006-05-11
Frank Horenberg writes:
We do not sign the artifacts again after they are published.


The error suggests that you do this.
Frank Horenberg writes:
After creating and publishing the executable for the latest version, we get the following error when trying to update.


Do you use a link to the new version?

Regards from Poland (GMT+1),

Andrei Smolin
Add-in Express Team Leader
Posted 10 Jan, 2024 12:37:30 Top
Frank Horenberg




Posts: 20
 Joined: 2022-08-03
Hi Andrei,

Thank you for your reply, but I am still not clear as to what might have gone wrong, so I have still some questions.

Are you saying that the only way to get this error is when the exe and msi files are re-signed with a different certificate after the adxpublisher has signed them already?

What do you mean by "use a link for the new version"?


Kind regards,
Frank
Posted 11 Jan, 2024 08:42:16 Top
Andrei Smolin


Add-in Express team


Posts: 18833
 Joined: 2006-05-11
Hello Frank,

I still try to understand the scenario.
In what way you update your add-in? Do you call {the add-in module}.CheckForUpdates()?
After you sign the new version, do you replace all the files on your server, including version_info.xml?

Regards from Poland (GMT+1),

Andrei Smolin
Add-in Express Team Leader
Posted 11 Jan, 2024 14:57:18 Top
Frank Horenberg




Posts: 20
 Joined: 2022-08-03
Hi Andrei,

The way we check for an update is this:

If IsMSINetworkDeployed() and IsMSIUpdatable() are both true, then we get the CheckForMSIUpdates() and get the URL to launch the update with LaunchMSIUpdates()

After we create and sign the new version, we place the artifacts created (folders named with the language code (1031,1033,1036,1043) and their contents) and the version_info.xml, to the folder in our server.

Looking forward to your reply!

Kind regards,
Vasily[B]
Posted 12 Jan, 2024 10:43:55 Top
Andrei Smolin


Add-in Express team


Posts: 18833
 Joined: 2006-05-11
Hello Vasily,

1) Check whether you get the new downloader, not the old one. I suppose you can find it in downloaded files.
2) If you get the new downloader version, please send me a link to the new update; send it to support@add-in-express.com; make sure your email contains a hyperlink to this topic. I'll install the new build and check the registry and the files. I suppose I won't need to start the host application and even if I'll do this, I won't need to access any other functionality of your add-in. If needed, I'm ready to sign any reasonable NDA; this will just require some extra time.

Regards from Poland (GMT+1),

Andrei Smolin
Add-in Express Team Leader
Posted 12 Jan, 2024 15:51:39 Top

Posts 1 - 10 of 13
First | Prev. | 1 2 | Next | Last