My first script - and I have problems with code signing

J

Juergen Terpe

Well-known member
I must be doing something wrong, but I cannot find my mistake. With my local signing everything worked fine. What I did so far:

1.) I have a CPD key file created using my identifier as "Developer" with the "SigningKeys" script and have exported it to my local file system as described in the documentation.
2.) I created a folder structure as defined in the documentation: src/scripts/CreateHubblePaletteFromOSC.js and doc/scripts/CreateHubblePaletteFromOSC/CreateHubblePaletteFromOSC.html for a small documentation of the script.
3.) I used the "CodeSign" script to create a signature for the javascript file and this xsgn file is stored beside the js file.
4.) I created a new zip archive from the folder structure, so the archive has two folders contained "src" and "doc".
5.) I renamed the archive to 20220910-PixInsightUtilities-Package.zip
6.) I created the update.xri xml file as described in the documentation.
7.) I created the sha1 checksum using "openssl sha1 20220910-PixInsightUtilities-Package.zip" on my Mac and added it to the update.xri package element.
8.) I used the "CodeSign" script again to create a signature for the update.xri file.
9.) Finally, I uploaded everything to a folder on my local website and started testing it.

I did this multiple times today and after signing I never changed the file content or file name. But I always get the following error, when running "Check for updates":

Repository URL : https://www.ideviceapps.de/PixInsight/Utilities/
Signature : <* unavailable *>
Available packages : 0
Selected packages : 0
Error log:

https://www.ideviceapps.de/PixInsight/Utilities/: Parsing repository update information: Invalid signature

I reread all documentation and did all these things more than 10 times today always trying to find some potential issues in my workflow, but without success. Can someone please point me to the right way?

Here is the update xri file, it must be something simple:

<xri version="1.0">
<description>
<p>
A collection of PixInsight scripts for image processing. The following scripts are
currently contained:
- CreateHubblePaletteFromOSC: Creates a Hubble palette image from a linear image captured
using a One shot camera using dual narrowband filters.
</p>
</description>
<platform os="all" arch="noarch" version="1.8.9.1:1.10.1">
<package fileName="20220910-PixInsightUtilities-Package.zip" sha1="59d5b823fed0f9f866e3a16abe20523f39bc42dd" type="script" releaseDate="20220910">
<title>
PixInsight Utility scripts
</title>
<description>
<p>This installs an initial snapshot of the PixInsight Utility scripts. </p>
<p>Copyright (c) 2022 Juergen Terpe, All Rights Reserved. </p>
</description>
</package>
</platform>
</xri>
<Signature developerId="5858402076314077" timestamp="2022-09-10T16:06:31.889Z" encoding="Base64">rZc2nBsfN2jlph3TKRzPLU1rZD8dOHDNRC1jsSjKZzC/9TsKRycfhzWNo8lGGKQzUdo5j7YRynYuyrr2t3RQBg==</Signature>

Thanks in advance!
 
Did you install the latest updates?

Bernd
Updates.png
 
Thanks for your response, Mike. I changed the version range this morning and removed the doc part, code signed everything again, but nothing helped. Maybe, there is some more information in the log files or so. At least "curl https://www.ideviceapps.de/PixInsight/Utilities/updates.xri" downloads the repository information, so it is not an access restriction. Not sure how to continue here...
Okay, network issues will correctly be shown as HTTP error 303 or 404, so the file must really be parsed. Not sure if the problem is inside the xri file or inside the archive.
 
Last edited:
Maybe, I misunderstood a small part of the documentation?

Just to be sure that my estimation is right. Now after endless trial and errors I used my local signing key and tested everything again with it using "Feature scripts" and it worked. Finally, I also tested it with the "Manage Repositories", but this time I used again my local signing key file - which was used in "SubmitCPD" too. Using this key file everything worked as expected and while "Check for Updates" my script showed my official identifier which differs from my local id. Was my mistake to recreate a new signing key based on my identifier listed in "lscpd" and I need to reuse my local signing key which now matches to my CPD certificate?
 
Unfortunately, this does not work. When using my local signing key it only works on my machine, which is what I would expect to be honest. A friend tested this for me and it did not work: invalid signature.
However, when I create a new signing key based on my CPD identifier and use it for signing the script and the updates.xri file I'm also getting an invalid signature error. Now I'm running out of ideas.
 
When you generated the keys file to submit with your CPD application did you check the "Local signing identity" checkbox?
 
You must log in or register to reply here.
Back
Top