Unexpected 1.3.6.1.4.1.311.10.1 contentType Attribute in Multi-Step Code Signing Process #417
Description
Hello,
I'm using osslsigncode in a multi-step process to sign PE executables (EXE/DLL) in our CI/CD pipeline:
osslsigncode extract-data -h sha256 -in <file> -out <digest>osslsigncode sign -pkcs11engine ... -pkcs11module ... -pkcs11cert ... -ac ... -h sha256 -in <digest> -out <signed_digest> -nolegacy -verboseosslsigncode attach-signature -sigin <signed_digest> -CAfile <ca_chain.pem> -h sha256 -in <file> -out <file_signed>
The resulting signed file includes a contentType attribute with OID 1.3.6.1.4.1.311.10.1 (certTrustList) rather than the expected OID 1.3.6.1.4.1.311.2.1.4 (SPC_INDIRECT_DATA_OBJID) normally used for standard Authenticode signatures.
Why This Matters:
- Some antivirus vendors (e.g., Dr.Web) and security tools treat the presence of the
certTrustListOID as suspicious or non-standard for PE signatures. - It deviates from the typical Authenticode format produced by SignTool and what most users expect.
When Using a Single-Step Sign:
If I use osslsigncode sign -certs ... -key ... -in <file> -out <file_signed> directly on the PE file, the signature is formed correctly with SPC_INDIRECT_DATA_OBJID.
However, in the multi-step approach (extracting data, then signing digest, then attaching signature), the resulting signature sets contentType to 1.3.6.1.4.1.311.10.1.
Request:
Please consider enhancing osslsigncode so that multi-step signing produces a standard Authenticode signature with the correct contentType OID for PE files. Perhaps add an option or automatic detection ensuring SPC_INDIRECT_DATA_OBJID is used in multi-step scenarios as well.
How to Reproduce:
osslsigncode extract-data -in unsigned.exe -h sha256 -out digest.binosslsigncode sign -h sha256 -in digest.bin -pkcs11... -out signed_digest.p7osslsigncode attach-signature -in unsigned.exe -sigin signed_digest.p7 -out signed.exe -h sha256- Examine
signed.exeusingopenssl asn1parseor a similar tool, and note thecontentTypeattribute OID.
Expected Behavior:
- A code signature with
SPC_INDIRECT_DATA_OBJID(1.3.6.1.4.1.311.2.1.4), aligning with standard Authenticode.
Actual Behavior:
contentTypeis set to1.3.6.1.4.1.311.10.1(certTrustList).
Thank you for considering this request!