[Libreoffice-bugs] [Bug 68198] All files of the following extensions: EXEs, DLLs, SYS, DRV, OCX, SCR, and CPL should be signed

[bugzilla-daemon at bugs.documentfoundation.org]

https://bugs.documentfoundation.org/show_bug.cgi?id=68198

--- Comment #5 from Mike Kaganski <mikekaganski at hotmail.com> ---
Testing version 7.1.0.1 x64 installed from TDF MSI, I see these files unsigned
(which are recognized by MS signtool):

help\a11y-toggle.js
help\fuzzysort.js
help\help.js
help\help2.js
help\hid2file.js
help\languages.js
help\paginathing.js
help\polyfills.js
help\prism.js
program\pyuno.pyd
program\soffice.com
program\unopkg.bin
program\unopkg.com
program\python-core-3.8.4\bin\python.exe
program\python-core-3.8.4\lib\libcrypto-1_1.dll
program\python-core-3.8.4\lib\libssl-1_1.dll
program\python-core-3.8.4\lib\pyexpat.pyd
program\python-core-3.8.4\lib\select.pyd
program\python-core-3.8.4\lib\unicodedata.pyd
program\python-core-3.8.4\lib\winsound.pyd
program\python-core-3.8.4\lib\_asyncio.pyd
program\python-core-3.8.4\lib\_ctypes.pyd
program\python-core-3.8.4\lib\_decimal.pyd
program\python-core-3.8.4\lib\_elementtree.pyd
program\python-core-3.8.4\lib\_msi.pyd
program\python-core-3.8.4\lib\_multiprocessing.pyd
program\python-core-3.8.4\lib\_overlapped.pyd
program\python-core-3.8.4\lib\_queue.pyd
program\python-core-3.8.4\lib\_socket.pyd
program\python-core-3.8.4\lib\_ssl.pyd
program\python-core-3.8.4\lib\distutils\command\wininst-10.0-amd64.exe
program\python-core-3.8.4\lib\distutils\command\wininst-10.0.exe
program\python-core-3.8.4\lib\distutils\command\wininst-14.0-amd64.exe
program\python-core-3.8.4\lib\distutils\command\wininst-14.0.exe
program\python-core-3.8.4\lib\distutils\command\wininst-6.0.exe
program\python-core-3.8.4\lib\distutils\command\wininst-7.1.exe
program\python-core-3.8.4\lib\distutils\command\wininst-8.0.exe
program\python-core-3.8.4\lib\distutils\command\wininst-9.0-amd64.exe
program\python-core-3.8.4\lib\distutils\command\wininst-9.0.exe
share\Scripts\javascript\ExportSheetsToHTML\exportsheetstohtml.js
share\Scripts\javascript\HelloWorld\helloworld.js
share\Scripts\javascript\Highlight\ButtonPressHandler.js
share\Scripts\javascript\Highlight\ShowDialog.js

The script I used for testing:

> del sertcheck.log
> 
> for /R "C:\Program Files\LibreOffice" %%f in (*.*) do (
>   echo ### %%~ff >> sertcheck.log
>   "C:\Program Files (x86)\Windows Kits\10\App Certification Kit\signtool.exe" verify /pa "%%~ff" >> sertcheck.log 2>&1
> )

These include some .JS files, and some .PYD; no idea how relevant are they. The
script also produces lots of "SignTool Error: This file format cannot be
verified because it is not recognized" for files like TXT and PNG, but those
errors are of course irrelevant.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/libreoffice-bugs/attachments/20210115/6bb8a3c8/attachment-0001.htm>