Windows aarch64 sign_verification not running signtool.exe correctly

[andrew-m-leonard]

https://ci.adoptium.net/job/build-scripts/job/release/job/sign_verification/816/console

C:/Users/jenkins/workspace/build-scripts/release/sign_verification@tmp/durable-a56db375/script.sh: line 12: /cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.16299.0/arm64/signtool.exe: Accessing a corrupted shared library
Error: executable not Signed: unpacked/jre/jdk-21.0.3+1-jre/bin/j2pcsc.dll

signing_verify job has to find the signtool.exe it then uses to verify the exe/dlls, on cross compiled aarch64 it looks like it's finding the wrong one...?

[andrew-m-leonard]

I've just done a search on node build-azure-win2022-x64-1 and signtool.exe is available in these places, we ideally need the most recent version that is supported for the machine architecture adding to the PATH, so probably latest Windows kit with matching arm64/x64 to the node arch:

/cygdrive/c/Program Files (x86)/Microsoft SDKs/Windows/v7.1A/Bin/signtool.exe
/cygdrive/c/Program Files (x86)/Microsoft Visual Studio/Shared/NuGetPackages/microsoft.windows.sdk.buildtools/10.0.22621.756/bin/10.0.22621.0/arm64/signtool.exe
/cygdrive/c/Program Files (x86)/Microsoft Visual Studio/Shared/NuGetPackages/microsoft.windows.sdk.buildtools/10.0.22621.756/bin/10.0.22621.0/x64/signtool.exe
/cygdrive/c/Program Files (x86)/Microsoft Visual Studio/Shared/NuGetPackages/microsoft.windows.sdk.buildtools/10.0.22621.756/bin/10.0.22621.0/x86/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/App Certification Kit/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.15063.0/arm/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.15063.0/arm64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.15063.0/x64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.15063.0/x86/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.16299.0/arm/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.16299.0/arm64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.16299.0/x64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.16299.0/x86/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.17134.0/arm/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.17134.0/arm64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.17134.0/x64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.17134.0/x86/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/arm/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/arm64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/x64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/x86/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.18362.0/arm/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.18362.0/arm64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.18362.0/x64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.18362.0/x86/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.19041.0/arm/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.19041.0/arm64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.19041.0/x64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.19041.0/x86/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.20348.0/arm/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.20348.0/arm64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.20348.0/x64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.20348.0/x86/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.22000.0/arm/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.22000.0/arm64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.22000.0/x64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.22000.0/x86/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.22621.0/arm/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.22621.0/arm64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.22621.0/x64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/10.0.22621.0/x86/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/arm/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/arm64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/x64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/10/bin/x86/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/8.1/bin/arm/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/8.1/bin/x64/signtool.exe
/cygdrive/c/Program Files (x86)/Windows Kits/8.1/bin/x86/signtool.exe

[steelhead31]

I think I can fix this bit of the pipeline script to manage which signtool it uses..

    def windowsKitPath = "/cygdrive/c/'Program Files (x86)'/'Windows Kits'"
   def files = sh(script:"find ${windowsKitPath} -type f -path */${arch}/signtool.exe", \
                  returnStdout:true).split("\\r?\\n|\\r")
   // Return the first one we find
   if (files.size() == 0 || files[0].trim() == "") {
       println "ERROR: Unable to find signtool.exe in ${windowsKitPath}"
       exit 2
   } else {
       def signtool = files[0].trim()
       println "Found signtool: ${signtool}"
       return signtool 
   }

[steelhead31]

I've done some investigation on test-win11-aarch64-1, the arm64 version of signtool in version 17763 of the devkit appears to be corrupt, or bugged in some way, the latest version is ok..  test-win11-aarch64-2 has a different issue, relating to permissions on version 17763 of signtool...