Affinity V2 files, MSIX versions, on Windows: Are they supposed to have digital signatures?

[walt.farrell]

I've recently installed the Foxit PDF Reader, and was surprised today when exporting a PDF from Publisher 2 and requesting viewing of the exported file, that Foxit complained that it was being invoked by an app without a digital signature.

Note: This screenshot is from Publisher 2.1 beta, but 2.0.4 gets the same warning.

I've looked at all 3 apps using File Explorer, and checked their Properties, and none of them in 2.0 or 2.1 beta (.1790) are digitally signed.

Is that an intended change from V1 and the MSI-based installers?

 

[DWright]

Hi @walt.farrell,

This seams to be an issue with Foxit Reader not being able to accept a preview file from the sandboxed MSIX version of Publisher as Acrobat Reader does not have this issue and Foxit reader can open the PDF file directly without any errors.

[walt.farrell]

1 hour ago, DWright said:

Hi @walt.farrell,

This seams to be an issue with Foxit Reader not being able to accept a preview file from the sandboxed MSIX version of Publisher as Acrobat Reader does not have this issue and Foxit reader can open the PDF file directly without any errors.

Yes, that's what is happening. But it's a security check that is failing, because the application is not signed. Perhaps Acrobat Reader does not perform that check.

My question is, are the applications supposed to be signed? Because if they are supposed to be signed, then something is broken in the build process for the MSIX apps.

[DWright]

Standard PDF normally do not have a digital signatures applied, I have tested this with the exe version of Publisher and Foxit reader reports not issues with the PDF when using the preview so this points to a issue with how the preview is pass from the sandbox location I will check with our QA team to see if this is an expected behaviour with the preview.

[walt.farrell]

16 minutes ago, DWright said:

Standard PDF normally do not have a digital signatures applied, I have tested this with the exe version of Publisher and Foxit reader reports not issues with the PDF when using the preview so this points to a issue with how the preview is pass from the sandbox location I will check with our QA team to see if this is an expected behaviour with the preview.

It is not complaining about the PDF. It is complaining about the application passing it the PDF, and saying that the application is not signed, which could be a vector for a malware attack.

Do the Developers intend that the .exe files installed by the MSIX packages have digital signatures, like the .exe files installed by the EXE/MSI packages have? If the .exe files installed by the MSIX are supposed to be signed, then something is wrong with the build or the install process, as they are not ending up signed.

[DWright]

I have logged this with our developers for further investigation 

[walt.farrell]

Thanks, @Red Sands. I know the installers are signed, but was surprised the contents aren't (unlike the contents of the MSI installers). And with at least one third-party application having complained about this, I thought it was worth checking.