Windows requires a digitally signed driver

[qaisjp]

when installing "DokanSetup_redist.exe" in v1.0.0-RC1

I'm on Windows Enterprise 7

[Liryna]

Did you update you windows 7 ?
The drivers are signed SHA1/SHA2, you can see it in the file properties.

[qaisjp]

I'm on a networked computer so I cannot update this computer. There was a recent update to this computer but I'm not sure if that's what you're talking about

[Liryna]

Yes, Thanks this is what I am talking about.

There should be two signature but since your system is not updated it only see the SHA1 that is Microsoft deprecated....since 2016.

[qaisjp]

Okay well I've disabled verification using bcdedit /set nointegritychecks ON... lets hope it works..

[js69]

Is Service Pack 1 installed for that Windows 7? The setup should fail if it isn't but let's verify anyway.

SHA2 for Windows 7 might need this Windows update:
https://technet.microsoft.com/en-us/library/security/3033929

[qaisjp]

No idea if SP1 is installed ... like I said I can't install any updates because updates are managed by my sysadmin.

[js69]

You could post the setup log files, in your %TEMP% there should be Dokan* text files.

[qaisjp]

here are all the logs
Dokan_Library_1.0.0_Bundle_20160303092855_000_Dokan_x64.msi.log.txt
Dokan_Library_1.0.0_Bundle_20160303093340.log.txt
Dokan_Library_1.0.0_Bundle_20160303093340_000_Dokan_x64.msi.log.txt
Dokan_Library_1.0.0_Bundle_20160303093500.log.txt
Dokan_Library_1.0.0_Bundle_20160303093500_000_Dokan_x64.msi.log.txt
Dokan_Library_1.0.0_Bundle_20160303094615.log.txt
Dokan_Library_1.0.0_Bundle_20160303094923.log.txt
Dokan_Library_1.0.0_Bundle_20160303094923_000_Dokan_x64.msi.log.txt
Dokan_Library_1.0.0_Bundle_20160303095118.log.txt
Dokan_Library_1.0.0_Bundle_20160303095118_000_Dokan_x64.msi.log.txt
Dokan_Library_1.0.0_Bundle_20160303092242.log.txt
Dokan_Library_1.0.0_Bundle_20160303092242_000_Dokan_x64.msi.log.txt
Dokan_Library_1.0.0_Bundle_20160303092721.log.txt
Dokan_Library_1.0.0_Bundle_20160303092839.log.txt
Dokan_Library_1.0.0_Bundle_20160303092839_000_Dokan_x64.msi.log.txt
Dokan_Library_1.0.0_Bundle_20160303092855.log.txt

[Liryna]

I question myself about the dokan signature process....
We are using SHA2 certificate to sign SHA1 & SHA2.

I am wondering if we need a SHA1 cert to sign SHA1 and cert SHA2 to sign SHA2.
@js69 do you know something about it ?
Because it is strange that @qaisjp see a mix of SHA1/SHA2.

Our sign script:
https://github.com/dokan-dev/dokany/blob/master/sign.ps1#L3

[qaisjp]

sha1 is for the countersign

if that makes a difference

[js69]

DIFXAPP: ERROR: Unable to start service 'dokan' because of error 0x241

qaisjp: I think you should try to use the fixed driver package mentioned in issue 179:

https://drive.google.com/folderview?id=0B3E9tU82h-RMMmh3RkJFamM4WTA&usp=sharing

[js69]

"I am wondering if we need a SHA1 cert to sign SHA1 and cert SHA2 to sign SHA2."

I don't think so. The only potential issue I would suspect is with non-updated Win 7 if you use a SHA2 cert for anything.

[qaisjp]

The fixed drivers aren't working either.

New set of logs: https://www.dropbox.com/sh/0cvw913y3kloans/AABNdN4Kf7HnKqjq1myC9GMQa?dl=0

[qaisjp]

Okay well I've reverted back to 0.7.3 (and an old version of winssh-fs)... the bug still probably exists for people in the same situation as me though.

[Liryna]

0.7.x will work because there was sign SHA1 before 2016.

This is a Microsoft limitations, I don't think we can do much with it sorry.

[js69]

You could perhaps create a test driver setup signed with your old SHA1-cert to verify that is the reason here.

[js69]

qaisjp, you don't have any chance of installing https://support.microsoft.com/en-us/kb/3033929 on your machine?

[js69]

Some useful info on certificate issues can be found here:

http://www.davidegrayson.com/signing/#kmod

[GrantGatchel]

Installing the Security Update for Windows 7 (KB3033929) helped me:
https://www.microsoft.com/en-us/download/details.aspx?id=46078

[js69]

Liryna, I think on WIn7 we should install KB3033929 as well with the bundle like we do it with the UCRT KB update.

[Liryna]

It seems that we will need to do it yes. it is really strange that even without this patch it cannot validate the SHA1....

[js69]

Liryna, I've implemented KB3033929 installation with the bundle but that's not a final or elegant solution.

The update requires a restart before it becomes active:

Applied execute package: Win71_KB3033929_x64, result: 0x0, restart: Required

Because that restart is not scheduled by WiX Burn before the Dokan driver is installed, users will still see the unsigned driver warning. After restart the driver though is installed correctly because the KB3033929-updated DLLs will then allow SHA256-signed drivers.

Adding the KB3033929 msu files also increases the size of DokanSetup_redist.exe to 110 MB.

Scheduling the restart before Dokan driver installation is only possible with a custom bootstrapper.

As an alternative I'd rather implement a check for install status of KB3033929 and show an error in case it isn't already installed (only relevant for WIn 7).

[Liryna]

@js69 Thank you for the test !
I think your solution of showing an error on Win7 would be the best solution as you said !