Legend

ZXPSignCmd sign process is broken (segmentation fault)

Forum|Forum|10 months ago
April 18, 2025
36 replies
4480 views

Looks like the ZXP sign process is broken both on macOS and Windows.

macOS: Signing process ends with: [1] 21894 segmentation fault ./ZXPSignCmd -sign mypassword -tsa
Window: just fails with no error

Command that fails: ./ZXPSignCmd -sign "/Users/admin/Desktop/extension/dist/cep" "/Users/admin/Desktop/extension/dist/zxp/com.my.extension.cep.zxp" "/Users/admin/Desktop/extension/lib/.tmp/com.my.extension.cep-cert.p12" mypassword -tsa http://timestamp.digicert.com/
None of the environments nor macOS nor Windows has changed. It just worked yesterday and today it's not.
ZXPSignCmd has proper executable rights
Tried changing timestamp servers
Tried using different network connection
Verified with different repos/tools
Tested on ARM/x64 macOS, ARM/x64 Windows. All fail to sign
Confirmed the same behavior by many devs

Performance or Stability

Show previous replies

JohnColombo17100380

Community Manager

As @ErinF noted, a new Windows build with a fix is now available and a fixed version for Mac is in progress. Marking this issue as Started.

- John, After Effects Engineering Team

A

avi23837866f7yk

Participating Frequently

Only happens on Windows(on macOS works just fine) - and when used with the "-tsa" option the ZXPSignCmd.exe tool fails to sign my CEP project.

I'm generating a self-sign certificate file as described in this CEP Resource - https://github.com/Adobe-CEP/CEP-Resources/blob/master/ZXPSignCMD/SigningTechNote_CC.pdf as follows:

./ZXPSignCmd.exe -selfSignedCert US CA MyCompany MyCompanyShortName abc123 MyCert.p12

Then, try to to sign my CEP project as follows:

./ZXPSignCmd.exe -sign my-cep/ my_cep_extension.zxp MyCert.p12 abc123 -tsa http://timestamp.digicert.com/

and getting the following error:

Error - the timestamp returned from the chosen TSA could not be verified, so the ZXP created is likely to be rejected by other tools. Please recreate your ZXP with a different trusted TSA

I'll also mention that:

Up until last week(April 25th 2025) it was working fine.
The issue is only reproducible on Windows, on macOS ZXPSignCmd works just fine, with/without the -tsa option.
I tried various other tsa servers URL's - all fails.
Signing without the -tsa option succeeded with no issues.

I also want to ask - is -tsa option is mandatory for my extension to work properly on production environment?

JohnColombo17100380

Community Manager

Hi @avi23837866f7yk,

Thank you for reporting this issue. A fix for Windows was deployed this morning: https://github.com/Adobe-CEP/CEP-Resources/tree/master/ZXPSignCMD/4.1.3.

This is an existing thread on this, so I'll be merging this thread into it for easier future communication.

Cheers,

- John, After Effects Engineering Team

ErinF

Community Manager

I've uploaded a new Windows build here: https://github.com/Adobe-CEP/CEP-Resources/tree/master/ZXPSignCMD/4.1.3

We're still working on a macOS build. It could be up to a week on that.

M

markusbergelt

Participant

So glad I found this thread after days of troubleshooting... Can confirm that no TSA with any version of ZXPSignCmd is working on windows. Signing without TSA works. @Justin Taylor-Hyper Brew Thanks for pointing out that signing without TSA and long lasting certs might not be a good option. Anyway a quick solution is critical, as our build pipeline depends on it.

JohnColombo17100380

Community Manager

Hi all,
Thank you for reporting this and for all the details you've provided. We're actively investigating the root cause of the breakage and will update this thread once we have an update and/or a fix. Our apologies for the frustration this is causing.

- John, After Effects Engineering Team

B

Bart Walczak

Inspiring

Funny, now ZXPSignCmd is working for me with Apple tsa, while ZXPSignCmd-64bit is still coughing up the exception. Well, at least I can use it for Mac signing.

Justin Taylor-Hyper Brew

Community Expert

@Ivan Stepanov I can confirm http://tss.accv.es:8318/tsa works as well on both Intel and ARM MacOS machines, thanks. So must not be an Apple-to-Apple thing.

Regarding Alternative ZXPSignCmd options for Windows. That one does look interesting, Kris Coppieters mentioned it in another thread. Although it would sure be nice to see an open-source alternative, and one that's still maintained.

https://github.com/JuMouren/SignAndPackage

@Bart Walczak The Apple TSA is still working on all our Macs, I think you're running into a different problem. Might want to test in a fresh directory, reset permissions, and those sorts of things.

B

Bart Walczak

Inspiring

@Ivan Stepanov It's a different file every time and every time it fails for me now.

% sudo rm /tmp/zxpsignA2rsTGTwt155N5EB/tmp.zxp
Password:
% ls /tmp/zxpsignA2rsTGTwt155N5EB/tmp.zxp
ls: /tmp/zxpsignA2rsTGTwt155N5EB/tmp.zxp: No such file or directory
% ZXPSignCmd-64bit -sign ... 
libc++abi: terminating due to uncaught exception of type boost::filesystem::filesystem_error: boost::filesystem::copy_file: File exists: "/tmp/zxpsignaH8nusHa0xZtJboh/tmp.zxp",