While investigating authenticode, I have come across a few edge cases that Windows reports as signed, that this library fails to parse. Here's one of them: a signature that doesn't use signed_attrs/Authenticated Attributes of the SignerInfo. Instead, the signature is done directly over the embedded content. Here's the sample: no_signed_attrs.exe.zip. And here's a sample of how the SignerInfo is generated (econtent_bytes is the EmbeddedContent serialized as DER):
SignerInfo {
version: CmsVersion::V1,
sid: SignerIdentifier::IssuerAndSerialNumber(isn_from_cert(end_cert)),
digest_alg: digest_alg.ref_to_owned(),
signed_attrs: None,
signature_algorithm: ALG_RSA.ref_to_owned(),
signature: OctetString::new(signing_key.sign(&econtent_bytes).to_vec()).unwrap(),
unsigned_attrs: None,
}
When parsing with authenticode-rs, it fails with the following error: AttributeCertificateAuthenticodeError(InvalidSignature(EmptyAuthenticatedAttributes)).