All geek questions in one place

"SignTool Error: Access Denied" during TFS 2010 Build

I get a "SignTool Error: Access Denied" message when I try to sign a file. When I use cmd admin, everything works fine. However, this process will be used during the TFS 2010 build process, and using the InvokeProcess task with signtool gives the same access denied message as a command line other than the administrator.

Additional Information:

After following these instructions, I have the following files:

  • Myca.cer
  • Myca.pvk
  • MySPC.cer
  • MySPC.pvk
  • Myspc.pfx

MyCA is in my trusted root certificate authorities. I imported MySPC.pfx into personal certificates, following the tips here: SignTool error: access denied

To do the signing, I use the MySPC.pfx fingerprint that was imported into the Personal section, so my signtool command looks like this:

sign / sha1 1e9d7b5ad98552d9c58944e3f3903e6b929f4819 / t http://timestamp.verisign.com/scripts/timestamp.dll "FileName"

Again, this works in administrator mode. This also works when running cmd as an administrator:

sign / f "C: \ Code Signing Non-Release \ MySPC.pfx" / t http://timestamp.verisign.com/scripts/timestamp.dll "FileName"

New to code signing in general, so any help is appreciated.

+4
source share
2 answers

There may be a problem with the permissions of the certificate keys - see http://blog.alner.net/archive/2011/11/18/signing-exes-and-msis-with-signtool-via-tfs-builds.aspx

0
source

I had the same problem, but with TeamCity. Signtool.exe can sign my .msi if it is used on the command line as an administrator, but not from an automatic build.

In Windows Server 2008, R2, and 2012, store certificates are actually stored in this folder:

C: \ ProgramData \ Microsoft \ Crypto \ RSA \ MachineKeys

You will need to provide the user who runs READ access to the build server to this folder.

Once you do this, run it again and you will find that it should work correctly.

0
source

Source: https://habr.com/ru/post/1388637/

More articles:


All Articles