Repository navigation
Release: sign a copy of the exe and write it back in place - #508
Merged
Merged
Conversation
Inside tauri build, ssign's in-place signing failed with "atomically replacing ...netscli-gui.exe: Access is denied (os error 5)": the bundler still holds the patched exe open without delete sharing, so a rename over it is refused. This lost v0.3.4 its Windows build. Sign into a temporary directory with -o and copy the bytes back over the original, which needs only write access, retrying for up to ten seconds. Reproduced on a Windows runner with the real signer and the exe held open without FileShare.Delete: the old wrapper fails with the same error, the new one exits 0 and Get-AuthenticodeSignature reports Valid.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The job summary from #506 gave the v0.3.4 failure: ssign's in-place signing ends in
atomically replacing ...netscli-gui.exe: Access is denied (os error 5). Insidetauri buildthe patched exe is still held open without delete sharing, so ssign's rename over it is refused.The wrapper now signs into a temp directory (
ssign -o) and writes the signed bytes back over the original, which needs only write access, with up to ten one-second retries.Reproduced and verified on a Windows runner (temporary PR #507) with the real signer and the test exe held open without
FileShare.Delete:atomically replacing ... Access is denied. (os error 5), file NotSignedGet-AuthenticodeSignature→ Valid, signed by the Certum certificateOnce merged, re-running the failed v0.3.4 release job picks this up (the wrapper is fetched from the default branch).