1

In Inno Setup, my sign tool is defined as:

cmd /k "C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\signtool.exe" sign /t http://timestamp.comodoca.com /n "My Company" $f

Prepending cmd /k (as suggested at Inno Setup - Signing fails with "Sign Tool failed with exit code 0x1") reveals that there is not actually a problem with the sign tool itself, but rather how Inno Setup is calling it, generating the following message:

'C:\Program' is not recognized as an internal or external command, operable program or batch file.

Clearly, it's chopping off the path to signtool at the first space, even though I put it in quotes. I even tried replacing the quotes with $q to see if that made any difference. (It didn't.) I would think this is improper behavior for the parser to dishonor the quotes, since the instructions clearly say to paste the exact text you'd use on the command line, and the example itself includes quotation marks (https://revolution.screenstepslive.com/s/revolution/m/10695/l/563371-signing-installers-you-create-with-inno-setup).

Everything works beautifully from the command line. For some reason, Inno Setup just isn't properly calling signtool.

ADDED 2020-07-14:

Inno Setup's example, copied from their website:

"C:\Program Files\Microsoft Platform SDK for Windows Server 2003 R2\Bin\signtool.exe" sign /f "C:\MY_CODE_SIGNING.PFX" /t http://timestamp.comodoca.com/authenticode /p MY_PASSWORD $f

My version, used without the cmd /k:

"C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\signtool.exe" sign /t http://timestamp.comodoca.com /n "My Company" $f

As you can see, we use quotes in the same manner. I will check for updates - I probably should have done that first. When I get some time, I'll revert the signtool definition and see if maybe the update fixes it.

Also, I should have been more clear. I am new to Inno Setup and it didn't occur to me to clarify this. I am compiling via Inno Script Studio. It occurs to me that there's some possibility this has to do with a behavior in a specific version of Script Studio and not the compiler itself, but I don't know enough about the inner workings to do any more than speculate.

Martin Prikryl
  • 188,800
  • 56
  • 490
  • 992
technonaut
  • 484
  • 3
  • 12
  • That's actually how `cmd` works. If you want to test a command like this, you have to wrap it whole to double quotes: `cmd /k ""C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\signtool.exe" sign /t http://timestamp.comodoca.com /n "My Company" $f"` – So I believe you have introduced a new problem with `cmd /k` and your original problem with signtool was different. – I have updated my answer to that question with this information. – Martin Prikryl Jul 14 '20 at 05:49
  • I added clarification to hopefully demonstrate that I correctly followed the example and used the proper format. – technonaut Jul 14 '20 at 11:42
  • So did you try the `cmd /k ""C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\signtool.exe" sign /t http://timestamp.comodoca.com /n "My Company" $f"`? – Martin Prikryl Jul 14 '20 at 12:48
  • I just experientially confirmed this as a BUG in Inno Script Studio 2.3.0, because after upgrading to 2.4.0, the problem magically went away. I can now use my original signtool definition without error. – technonaut Jul 14 '20 at 17:19
  • Martin, yes, I did, and, interestingly, it worked. Removing the cmd /k and leaving the line enclosed in the extra set of quotes doesn't work, though - you get error code 87. I've not used it long enough to know much about its inner workings yet unfortunately. It's fixed in 2.4.0 though. – technonaut Jul 14 '20 at 19:22

2 Answers2

1

Having done a bit more tinkering, I'm now fairly certain this must be a bug with Inno Setup. I implemented a work-around as follows:

  1. Open a command window with elevated privileges
  2. Change to a directory I created with no space in the name: cd \bin
  3. Create a 'spaceless' symbolic link to the directory where signtool.exe is located: mklink /d "Windows10SDK" "C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64"
  4. Enter new sign tool definition that uses the symbolic link:

C:\bin\Windows10SDK\signtool.exe sign /t http://timestamp.comodoca.com /n "My Company" $f

And that's it! Because there is no longer a space character in the path to signtool.exe, Inno Setup now performs the signing correctly and everything works beautifully.

I'll report this as a bug and update if needed.

technonaut
  • 484
  • 3
  • 12
  • I have spaces in my paths and I can use signtool. Have you made sure you wrapped your parameters with suitable quotes? – Andrew Truckle Jul 14 '20 at 07:53
  • Hi Andrew, yes. I just added additional text that better demonstrates I've correctly followed Inno Setup's example on their website. Unless their example is actually wrong, then I've done it correctly as near as I can tell. – technonaut Jul 14 '20 at 11:31
0

I use:

#define SignedDesc "$q" + MSA + "$q"
#define SignedPfx "$qd:\My Certificate\2018\My Certificate.pfx$q"
#define SignedTimeStamp "$qhttp://timestamp.verisign.com/scripts/timestamp.dll$q"
#define SignedPw "$q~~~~~~~$q"

SignTool=SignTool /d {#SignedDesc} /du $q{#AppURL}$q /f {#SignedPfx} /p {#SignedPw} /t {#SignedTimeStamp} /v $f

My sign tool is configured as:

$qC:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86\Signtool.exe$q sign $p

You have to use $q which is a quote mark.

Andrew Truckle
  • 17,769
  • 16
  • 66
  • 164
  • But the `$q` is useful only when defining the sign tool on iscc command line. When you define the sign tool in the IDE, you can use literal double quotes without any problem, cannot you? – Martin Prikryl Jul 14 '20 at 08:25
  • @MartinPrikryl Maybe. But I am often building from command line so maybe that is why. The point is, I can compile within Inno or Command Line and I can sign and I do have spaces and it is not an issue for me. So I don't see why there is a bug reported in Inno. – Andrew Truckle Jul 14 '20 at 10:02
  • Thanks Andrew. As my post indicated, I tried it with $q to no avail. This could be a version-specific issue. – technonaut Jul 14 '20 at 11:34