[Solve a problem every day series-0005] WiX Burn How to verify the legitimacy of the chained package

Problem Description:

The project uses WiX burn packaging, which contains multiple MSI internally. Sometimes you encounter the following error

Error 0x80091007:failed to verify hash of Payload:SetupProject1.msi.

Problem Resolution:

First of all, we need to understand the principles of WiX brun verifying its payload, there are two main cases:

1) If the MSI has a digital signature, it is validated against the MSI's digital signature, that is, if the digital signature is not changed, burn does not verify that the contents of the MSI change

2) If the MSI does not have a digital signature, obtain the SHA1 hash of the MSI and verify the hash at the time of installation. In this case, if the content of the MSI changes, it cannot be installed with the burn and must be recompiled.

WIX Brun Source Code (BURN\ENGINE\CACHE.CPP)

StaticHRESULT verifythentransferpayload (__in burn_payload*ppayload, __in_z lpcwstr Wzcachedpath, __in_z lpcwstr Wzunverifiedpayloadpath, __in BOOL fmove) {。。。 //If The payload has a certificate root public key identifier provided, verify the certificate.    if(ppayload->pbcertificaterootpublickeyidentifier) {HR=cacheverifypayloadsignature (Ppayload, Wzunverifiedpayloadpath, hfile); ExitOnFailure1 (HR,"Failed to verify payload signature:%ls", Wzcachedpath); }    Else if(Ppayload->pcatalog)//If catalog files is specified, attempt to verify the file with a catalog file{hr=Verifypayloadwithcatalog (Ppayload, Wzunverifiedpayloadpath, hfile); ExitOnFailure1 (HR,"Failed to verify payload signature:%ls", Wzcachedpath); }    Else if(Ppayload->pbhash)//The payload should has a hash we can use to verify it.{hr= Verifyhash (Ppayload->pbhash, ppayload->Cbhash, Wzunverifiedpayloadpath, hfile); ExitOnFailure1 (HR,"Failed to verify payload hash:%ls", Wzcachedpath); }。。。 }

Workaround:

Understanding the principle of the problem, the method is obvious.

[Solve a problem every day series-0005] WiX Burn How to verify the legitimacy of the chained package