You are here

Does PortableApps Launcher check authenticodes?

11 posts / 0 new
Last post
vf2nsr
vf2nsr's picture
Offline
Last seen: 7 years 5 months ago
Developer
Joined: 2010-02-13 17:10
Does PortableApps Launcher check authenticodes?

Hi All,

Need some help. I am presently stymied with trying to update one of my apps AquaSnap.

Author apparently added authenticode to his program. When I try to run it via launcher it will not load, same with Gord and even developer himself. However when he removes the authenticode all works as it was before and as expected.

So basically my questions is is the launcher checking and if so what is it checking? Otherwise I lost.

John T. Haller
John T. Haller's picture
Offline
Last seen: 3 hours 52 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Nothing

The launcher does nothing with Authenticode. It just launches the EXE with the parameters and environment you configure it to. Most of our apps are digitally signed (Firefox, LibreOffice, etc) as are our own launchers and installers for said apps.

Is AquaSnap checking its own internal signature? Is there a chance the publisher is signing it incorrectly? It should be signed using an SHA-256 security certificate but signed with an SHA-1 hash. Otherwise it'll break on many versions of Windows. We found that out the hard way a while back. A quick check seems to show it is being signed as such.

Sometimes, the impossible can become possible, if you're awesome!

vf2nsr
vf2nsr's picture
Offline
Last seen: 7 years 5 months ago
Developer
Joined: 2010-02-13 17:10
Thanks John

I will double check with him I have been in talks with him for 22 days and Gord as well here is what he had said.

Hi, I just made some testing on my side and it seems to be caused by the Authenticode signature that we added to our exe and dll files
if I remove these signature your launcher is able to run AquaSnap
is your launcher checking the signature before running the application?

“Be who you are and say what you feel because those who mind don't matter and those who matter don't mind.” Dr. Seuss

Gord Caswell
Gord Caswell's picture
Offline
Last seen: 4 months 1 week ago
DeveloperModerator
Joined: 2008-07-24 18:46
Explorer

I did some testing on this for vf2nsr before he posted here, and the following is what I was able to determine:

  1. When run from the publisher's portable package using Windows Explorer, the app runs as expected.
  2. When the same is run from Q-Dir Portable, it still runs as expected
  3. When attempting to run from a simple launcher (using only ProgramExecutable), the base app doesn't run whatsoever

I'm not sure what to try next.

vf2nsr
vf2nsr's picture
Offline
Last seen: 7 years 5 months ago
Developer
Joined: 2010-02-13 17:10
Thanks Gord

Same results as me and then Gregory stated he ran it with launcher with his app not having authenticode, just seems odd. I appreciate. I have tried it also on 7 and 10.

“Be who you are and say what you feel because those who mind don't matter and those who matter don't mind.” Dr. Seuss

Gord Caswell
Gord Caswell's picture
Offline
Last seen: 4 months 1 week ago
DeveloperModerator
Joined: 2008-07-24 18:46
Doesn't make sense

See, and that doesn't make sense - Authenticode simply adds a digital signature to the file, which doesn't have anything to do with physically running the file (Ok, technically running an installer is blocked by default when a signature isn't supplied, but that's a separate issue).

vf2nsr
vf2nsr's picture
Offline
Last seen: 7 years 5 months ago
Developer
Joined: 2010-02-13 17:10
Which is why

I am seeking out help from you John as well as anyone else. (BTW I Sent john fwd of our email with all the info) Is it possible that our authenticode for
launcher is interfering with his?

“Be who you are and say what you feel because those who mind don't matter and those who matter don't mind.” Dr. Seuss

John T. Haller
John T. Haller's picture
Offline
Last seen: 3 hours 52 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
New Test

I compiled a dead simple NSI file with:

Name "AquaSnapTest"
OutFile "AquaSnapTest.exe"
Caption "AquaSnapTest"
VIProductVersion "0.0.0.1"
SilentInstall Silent
AutoCloseWindow True
RequestExecutionLevel user

LoadLanguageFile "${NSISDIR}\Contrib\Language files\ENGLISH.nlf"

Section "Main"
	Exec "$EXEDIR\AquaSnap.Daemon.exe"
SectionEnd

This also causes AquaSnap to fail to start. This means it's definitively not something with the PortableApps.com Launcher code causing the issue. Likely it's one of the programming libraries in use by the developer (Qt, etc) if the developer themself is not checking for the Authenticode signature. This error was introduced in version 1.6.0 of AquaSnap and exists in 1.6.1 as well.

For the publisher to test with: https://portableapps.com/downloads/temp/AquaSnapTest.7z

Sometimes, the impossible can become possible, if you're awesome!

vf2nsr
vf2nsr's picture
Offline
Last seen: 7 years 5 months ago
Developer
Joined: 2010-02-13 17:10
Thanks John

Will get this to him ASAP appreciate, so this shows why when he does not sign it it works as expected?

“Be who you are and say what you feel because those who mind don't matter and those who matter don't mind.” Dr. Seuss

John T. Haller
John T. Haller's picture
Offline
Last seen: 3 hours 52 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Launch

All this does is run AquaSnap.Daemon.exe when placed in the same directory. That's it. It doesn't affect environment variables, paths, or anything else.

Sometimes, the impossible can become possible, if you're awesome!

vf2nsr
vf2nsr's picture
Offline
Last seen: 7 years 5 months ago
Developer
Joined: 2010-02-13 17:10
Ahh ok

Thanks again, the really odd thing is if you just run the AquaSnap.Daemon.exe direct from the folder by running it with no launcher it behaves properly.

I truly appreciate all your help, I been wracking my brain over it two days, then reached out to the Developer as well as Gord and only after then did I post it here at Gord's suggestion

“Be who you are and say what you feel because those who mind don't matter and those who matter don't mind.” Dr. Seuss

Log in or register to post comments