Cross-platform ZXP Signing Compatibility Known Issue and Workaround 2024

[erinferinferinf]

The problem: ZXP files signed on macOS are failing when installed and run on Windows machines, and vice versa. On Windows, this may mean that the installed panel appears blank, or only functions as expected with debug mode enabled.

Expected Behavior: Historically ZXP files signed by ZXPSignCmd may be installed and used succesfully on both macOS and Windows, regardless of which platform they were signed on.

The Workaround

For the time being, the work around is to sign ZXPs on the platform they are expected to be run on. Sign ZXPs for use with macOS on a macOS machine, and ZXPs intended for Windows on Windows devices.

FAQ

Q. Which versions of Creative Cloud apps are affected?

A. We're not sure. It could be related to Creative Cloud desktop app 6.4. It may only be for 2025 versions of dektop apps. Please help us report this issue by letting us know in this thread.

Q. Will I need to maintain two different listings on the Adobe Exchange Marketplace?

A. We're still investigating this.

Q. I don't have two computers handy for signing two ZXPs, what are my options?

A. If you have a Mac, you can run a Windows virtual machine. If you have a Windows machine, there are cloud-based macOS virtual machine options available.

If you sign a ZXP on a virtual machine and find it still doesn't work, please let us know in this thread.

Q. Is a fix on the way?

A. Due to other important maintence, it may be some time before we have a fix.

[RorohikoKris]

I ran a few quick tests - I used my CEPSparker 'starter' and generated a small CEP panel with some basic functionality in it. Built a ZXP on Mac, and built another ZXP on Windows, and tried to use it on InDesign 2025, and saw no issues.Mac-built ZXP works fine on Windows. Windows-built ZXP works fine on Mac. 

These use a self-signed certificate (created on Mac), and I am installing with Anastasyi's Extension Manager.

What I assume might be the most important tidbit in my tests is that my default CEP version is 6.1 - old, old, but works fine for basic extensions.

The things that need to be verified are

Try building for CEP 12, 11, 10,... and see if that makes the difference
Try creating the certificate on Mac vs on Windows and see if that makes a difference
Could it be a problem with thr Creative Cloud Deskop (rather than the ZXP or ZXP Installer)? 
Creative Cloud app - ID, Illy,...
....

My Wild Guess based on the very limited info we have would be that maybe somewhere in the process something is being line-ending irresponsible and changing line endings on what seem to be text files, and that might be enough to invalidate the signature. That would cause this 'symmetric' behavior, where Mac-created stuff is broken on Win and vice versa. Just a wild guess though -without being able to make the issue happen for me, I am guessing stuff from a position of ignorance.

I currently don't have the time to put a lot of hours into this, so I am just adding my small data point to the pool...



It looks like a hairy issue, and we probably need a systematic exploration of the problems space which is a fair bit of effort. 

[Justin Taylor-Hyper Brew]

I agree with Kirs, I've tested a decent amount and haven't seen this issue. My guess would be on a different version of ZXPSignCmd, different TimeStampServer, or a cert signed ZXP rather than self-signed which is what I use. I've listed all relevant details of my testing below, hope that helps

Build on Windows test on Mac

• Build and Signed ZXP on Windows 11 23H2 with Bolt CEP
  • Uses ZXPSignCmd.exe 4.1.1 Win 64bit
  • With TSA http://timestamp.digicert.com/
• Tested on Mac M2 Ventura 13.6.7
  • Installed with ZXP Installer by aescripts 1.8.582
  • With playerDebugMode set to off on all versions (CEP 11 & 12)
  • Launches correctly for After Effects & Premiere Pro on 2024 & 2025
• Tested on Mac Intel Sonoma 14.4.1
  • Installed with ZXP Installer by aescripts 1.8.582
  • With playerDebugMode set to off on all versions (CEP 11 & 12)
  • Launches correctly for After Effects & Premiere Pro on 2024 & 2025

Build on Mac test on Windows

• Build and Signed ZXP on Mac M2 Ventura 13.6.7 with Bolt CEP
  • Uses ZXPSignCmd 4.1.2 Mac 64bit
  • With TSA http://timestamp.digicert.com/
• Tested on Windows 11 23H2
  • Installed with ZXP Installer by aescripts 1.8.337
  • With playerDebugMode set to off on all versions (CEP 11 & 12)
  • Launches correctly for After Effects & Premiere Pro on 2024 & 2025

[ErinF]

Thankfully, this is looking harder to reproduce than we first feared! 

Here are some additional tips from an Alex W.:

1. Delete all  .DS_Store and __MACOSX folders/files inside your extension directory/subdirectories.
2. Make sure that you don't have any symlinks inside your folders. Some node modules use symlinks, so it's the best to look for symlinks inside the node_modules  folder and get rid of those.

It's important to do #1 above if you're planning on distributing in Adobe's Marketplaces, because the developer portal will reject your ZXP upload. (While you're at it, delete any zero byte files, as these are also not allowed.)

As for #2 above, generally speaking, in CEP development it's best to avoid symlinks whenever possible. 

Alex. W adds; 

...it was `temp`  module. I've solved the symlink issue by using version 0.8.4 
(Package manager: `yarn`)

[erinferinferinf]

I have another update from engineering and I've updated my Readme here.

When CEP attempts to load a plugin in the host application, it relies on a library called ZXPSignLib to verify the plugin package's signature. If the plugin package is installed via UPIA – or an installer that uses UPIA, such as "ZXPInstaller", the signature verification fails, preventing the plugin from loading.

During the installation of the plugin package via UPIA if the plugin contains any symbolic links (symlinks), these links are extracted as regular text files containing the path to the original file, instead of including the actual content of the original file.

As part of the signature verification process, ZXPSignLib replaces the symlinks in the extension directory with the actual files they point to. Since plugins are installed in system space, ZXPSignLib requires administrator privileges to perform this operation. When the host application is run in administrator mode, the symlinks are correctly replaced with the original files, resolving the issue. Once this happens, the signature verification succeeds, and the extension can be loaded successfully—even if the application is later launched by a non-administrative user.

When plugins were installed via ExManCmd, ZXPSignLib's signature verification process was also executed as part of installation process. ExManCmd ran with elevated permissions, which allowed ZXPSignLib to properly replicate the symlinks at the time of installation, preventing the issue from occurring at the time of loading the extension.

[ErinF]

I saw another report from a developer:

User reported that extensions do not load in Premiere Pro on Windows (tried 2023 and 2024 versions).  Extension behaves like it has a broken signature (won’t load at all). If PlayerDebugMode is set to 1, extension panel will show up, but it will be blank.

We tested with my extensions (Watchtower, Chronicler, Excalibur), also Storyblocks and Adobe built-in extensions: Frame.io and Learning Panel.

None of them did load.

If user opens Premiere Pro in Admin mode, extensions will work. However drag’n’drop functionality is blocked, doesn’t work.

On After Effects extensions load correctly, in regular mode, drag’n’drop works.

I remember I had a user report like that almost 5 years ago and it was due node.js modules not loading up.  Removing <Parameter>--enable-nodejs</Parameter> from extension’s manifest, would solve the issue, but no nodejs features.

That said, we didn’t find a solution to have nodejs enabled.

User just wrote me this:

Recalling the need in the past to set C:\Program Files\Adobe\Adobe Premiere Pro 2024\CEPHtmlEngine to admin mode (or at least start as admin mode) I went back in and saw that I had previously done this with pr2024

So I turned off start as admin (for CEPHtmlEngine) and then restarted Pr normally. And I’m seeing that Frame.io Storyblocks, and Watchtower are all working correctly. And that watch tower is now allowing drag and drop from explorer

So he had CEPengine with admin mode on and that didn’t play well.