Inno Setup signing issue

[Mike Friedrich]

I am using Inno Setup  6.3.3 with code signing and getting this error:

The contents of the signed file  uninst.e32.tmp  differ unexpectedly from the original file. Compile aborted. The signtool.exe reported success. Iscc.exe exits with 2.

Anyone go an an idea what this error means and possibly how to fix?

[Eivind Bakkestuen]

Exclude the folder with the binaries from antivirus/malware detection; its probably interfering with file access.

--
You received this message because you are subscribed to the Google Groups "innosetup" group.
To unsubscribe from this group and stop receiving emails from it, send an email to innosetup+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/innosetup/f2f3b3bf-8162-45bf-9ba4-5350286678dan%40googlegroups.com.

[Mike Friedrich]

I cannot do that. That would be a security risk. But why are you thinking that could help? Are you thinking an AV tool would manipulate executables on disk like an actual virus? It certainly did not produce any alerts. It think an AV exception is not a good idea here.
I am rather thinking of a bug in the source code regarding the memory compare or a bug about not reporting an error reading one of the files (like sharing violation / file locked). Any ideas in that regards? I will try to find out more once i can reproduce it and actually capture the signed file giving the problem. A simple rerun did not reproduce the issue.

[Gavin Lambert]

On Thursday, August 1, 2024 at 1:28:49 AM UTC+12 Mike Friedrich wrote:

I cannot do that. That would be a security risk. But why are you thinking that could help? Are you thinking an AV tool would manipulate executables on disk like an actual virus? It certainly did not produce any alerts. It think an AV exception is not a good idea here.

It's the only thing that works.  Compiling an installer (or signing one) is a process that involves writing an executable file to disk and then modifying it to add the actual installation payload and other operations such as signing.  AV tools will often detect that an executable file has been written and then intercept and scan it, blocking further access to the file.  If they're written well, subsequent operations will eventually complete and things will still work, but just slow down compilation.  If they're not written well, subsequent operations will just fail.  They are usually not written well.

There is no security risk in setting an exclusion on that folder, provided that you perform a manual scan on the folder before you run or distribute any of the files therein.