ZXPSignCmd sign process is broken (segmentation fault)

[Alex White]

Looks like the ZXP sign process is broken both on macOS and Windows.

• macOS: Signing process ends with: [1] 21894 segmentation fault ./ZXPSignCmd -sign mypassword -tsa
• Window: just fails with no error

1. Command that fails:  ./ZXPSignCmd -sign "/Users/admin/Desktop/extension/dist/cep" "/Users/admin/Desktop/extension/dist/zxp/com.my.extension.cep.zxp" "/Users/admin/Desktop/extension/lib/.tmp/com.my.extension.cep-cert.p12" mypassword -tsa http://timestamp.digicert.com/
2. None of the environments nor macOS nor Windows has changed. It just worked yesterday and today it's not.
3. ZXPSignCmd has proper executable rights
4. Tried changing timestamp servers
5. Tried using different network connection
6. Verified with different repos/tools
7. Tested on ARM/x64 macOS, ARM/x64 Windows. All fail to sign
8. Confirmed the same behavior by many devs

[JohnColombo]

As @ErinF noted, a new Windows build with a fix is now available and a fixed version for Mac is in progress. Marking this issue as Started.

- John, After Effects Engineering Team 

[JohnColombo]

Hi @avi23837866f7yk,

Thank you for reporting this issue. A fix for Windows was deployed this morning: https://github.com/Adobe-CEP/CEP-Resources/tree/master/ZXPSignCMD/4.1.3. 

This is an existing thread on this, so I'll be merging this thread into it for easier future communication.

Cheers,

- John, After Effects Engineering Team  

[alexey_9904]

Thank you! Amazingly that the fix was applied just 12 minutes after I encountered this issue on Windows. Impeccable.

[Chris Hocking]

Amazing! Thanks Adobe Team!!

[markusbergelt]

Thanks for the windows fix!

[CHL1]

We recently encountered this issue in our Windows ZXP build pipeline, which signs the ZXP with the tool. The symptom is a crash of the tool and Windows error code -1073741819.

We use the TSA http://timestamp.digicert.com. Removing the TSA from the command line call resolves the issue, indicating the problem lies in the code dealing with TSA.

While the issue is resolved with the 4.1.3 build, it is recommended that the tool be enhanced with more diagnostic capabilities and provides verbose logging. Additionally, the tool (exe) file should include regular file metadata indicating the build number.

Finally, many thanks to the Adobe team for providing a swift fix. Great job indeed.

[Alex White]

Adobe released a new update of ZXPSignCMD, both for macOS and Windows, which is available here:

https://github.com/Adobe-CEP/CEP-Resources/tree/master/ZXPSignCMD/4.1.3

I think the issue is completely solved now. 🙂

[Justin Taylor-Hyper Brew]

Awesome! Bolt CEP has been updated with both of the new ZXPSignCmd builds for Win and Mac so both can use the DigiCert TSA.

[JohnColombo]

Hi all,

As noted by others, the fix for this issue has been released in a new version of ZXPSignCmd for all platforms: https://github.com/Adobe-CEP/CEP-Resources/tree/master/ZXPSignCMD/4.1.3.

Thanks again for all the details you've reported, as they were critical to our understanding of the issue and getting a fix delivered quickly.

Cheers,

- John, After Effects Engineering Team  

[erinferinferinf]

If anyone on this thread happens to have a paid certificate (and not just self-sign) I'm curious to see if the fix will get certificates working again properly, too.

[Chris Hocking]

Are you able to provide instructions on how exactly you would self-sign? We code-sign/sign/notorise our Mac and Windows app, but I have no idea how that works in relation to CEP plugin signing? Happy to try if you can provide more instructions?

[erinferinferinf]

Are you able to provide instructions on how exactly you would self-sign? We code-sign/sign/notorise our Mac and Windows app, but I have no idea how that works in relation to CEP plugin signing? Happy to try if you can provide more instructions?

So, CEP "plugins" are not compiled, so they don't need to be notorised like an app, or code-signed in the Windows equivalent workflow.

In order to turn a CEP directory into a ZXP file for installation, there's a lightweight timestamping process.

The signing instructions are in this guide. We've tested self-signing extensively, I'm more interested in signing with a paid certificate. At least one person on github claims this is now possible again.