如何查找WiX RemotePayload的CertificatePublicKey散列

Question

我正在尝试解析WiX RemotePayload散列，但我不确定CertificatePublicKey属性是如何找到的。

举个例子来说，在.NET 4.0包从维克斯3.6源的定义：

<Fragment> 
    <util:RegistrySearchRef Id="NETFRAMEWORK40"/> 

    <WixVariable Id="WixMbaPrereqPackageId" Value="NetFx40Redist" /> 
    <WixVariable Id="WixMbaPrereqLicenseUrl" Value="$(var.NetFx40EulaLink)" /> 

    <PackageGroup Id="NetFx40Redist"> 
     <ExePackage 
      InstallCommand="/q /norestart /ChainingPackage &quot;[WixBundleName]&quot;" 
      RepairCommand="/q /norestart /repair /ChainingPackage &quot;[WixBundleName]&quot;" 
      UninstallCommand="/uninstall /q /norestart /ChainingPackage &quot;[WixBundleName]&quot;" 
      PerMachine="yes" 
      DetectCondition="NETFRAMEWORK40" 
      Id="NetFx40Redist" 
      Vital="yes" 
      Permanent="yes" 
      Protocol="netfx4" 
      DownloadUrl="$(var.NetFx40RedistLink)" 
      Compressed="no" 
      Name="redist\dotNetFx40_Full_x86_x64.exe"> 
     <RemotePayload 
      Size="50449456" 
      Version="4.0.30319.1" 
      ProductName="Microsoft .NET Framework 4" 
      Description="Microsoft .NET Framework 4 Setup" 
      CertificatePublicKey="672605E36DD71EC6B8325B91C5FE6971390CB6B6" 
      CertificateThumbprint="9617094A1CFB59AE7C1F7DFDB6739E4E7C40508F" 
      Hash="58DA3D74DB353AAD03588CBB5CEA8234166D8B99"/> 
     </ExePackage> 
    </PackageGroup> 
    </Fragment> 

从wix36来源的\ src \分机\ NetFxExtension \ wixlib \ NetFx4.wxs

我可以找到SHA1 Hash与fciv -sha1 dotNetFx40_Full_x86_x64.exe ...

58da3d74db353aad03588cbb5cea8234166d8b99 dotnetfx40_full_x86_x64.exe

我能找到一个匹配容易通过CertificateThumbprint属性对话框的文件，或者使用signtool它显示下面的输出

C:\redist>signtool verify /v /ph dotNetFx40_Full_x86_x64.exe 

Verifying: dotNetFx40_Full_x86_x64.exe 
Signature Index: 0 (Primary Signature) 
Hash of file (sha1): 8E8582D10521962F45F33935C38A2412C4F2D4C7 

Signing Certificate Chain: 
    Issued to: Microsoft Root Authority 
    Issued by: Microsoft Root Authority 
    Expires: Thu Dec 31 03:00:00 2020 
    SHA1 hash: A43489159A520F0D93D032CCAF37E7FE20A8B419 

     Issued to: Microsoft Code Signing PCA 
     Issued by: Microsoft Root Authority 
     Expires: Sat Aug 25 03:00:00 2012 
     SHA1 hash: 3036E3B25B88A55B86FC90E6E9EAAD5081445166 

      Issued to: Microsoft Corporation 
      Issued by: Microsoft Code Signing PCA 
      Expires: Mon Mar 07 18:40:29 2011 
      SHA1 hash: 9617094A1CFB59AE7C1F7DFDB6739E4E7C40508F 

The signature is timestamped: Thu Mar 18 21:13:46 2010 
Timestamp Verified by: 
    Issued to: Microsoft Root Authority 
    Issued by: Microsoft Root Authority 
    Expires: Thu Dec 31 03:00:00 2020 
    SHA1 hash: A43489159A520F0D93D032CCAF37E7FE20A8B419 

     Issued to: Microsoft Timestamping PCA 
     Issued by: Microsoft Root Authority 
     Expires: Sun Sep 15 03:00:00 2019 
     SHA1 hash: 3EA99A60058275E0ED83B892A909449F8C33B245 

      Issued to: Microsoft Time-Stamp Service 
      Issued by: Microsoft Timestamping PCA 
      Expires: Thu Jul 25 15:11:15 2013 
      SHA1 hash: 4D6F357F0E6434DA97B1AFC540FB6FDD0E85A89F 

SignTool Error: The signing certificate is not valid for the requested usage. 
     This error sometimes means that you are using the wrong verification 
     policy. Consider using the /pa option. 

Number of files successfully Verified: 0 
Number of warnings: 0 
Number of errors: 1 

什么工具可以为CertificatePublicKey提供的哈希？

编辑：没有使用热量，我想了解哈希来自哪里。

编辑：我知道这是如何的WiX源代码做了，我也可以执行
heat payload file -out file.wxs，但我在寻找一些外部工具，它可以提供期望的散列（ES），而不使用热。这只是为了满足我的好奇心。

Answer 1

如果你看看加热工具的源代码，它使用Microsoft.Tools.WindowsInstallerXml.Cab.Interop.NativeMethods.HashPublicKeyInfo函数来生成CertificatePublicKey。

byte[] publicKeyIdentifierHash = new byte[128]; 
uint publicKeyIdentifierHashSize = (uint)publicKeyIdentifierHash.Length; 

Microsoft.Tools.WindowsInstallerXml.Cab.Interop.NativeMethods.HashPublicKeyInfo(
    certificate.Handle, 
    publicKeyIdentifierHash, 
    ref publicKeyIdentifierHashSize); 

StringBuilder sb = new StringBuilder(((int)publicKeyIdentifierHashSize + 1) * 2); 
for (int i = 0; i < publicKeyIdentifierHashSize; ++i) 
{ 
    sb.AppendFormat("{0:X2}", publicKeyIdentifierHash[i]); 
} 

this.PublicKey = sb.ToString(); 

可以明显地使用此代码来生成对Public Key fingerprints指纹或根据维基页面，您还可以使用命令行

ssh-keygen -lf /path/to/key.pub 

问题是生成SSH-凯基酒馆文件符合规定与RFC4716从证书，这是我被难倒的地方。

个人而言，我只是用热命令行：

heat.exe payload PATH_TO_FILE -o Output.wxs 

，而不用担心实际上做它是什么，它的作品！ :)

Answer 2

你可以找到所有你在文件属性对话框的签名信息：

1. 在文件属性对话框中，单击签名选项卡。

2. 点击详情，然后点击'查看证书'。

3. 像'公钥'这样的属性可以在'Details'选项卡上找到。

4. 如果需要此公钥的哈希值，那么你可以使用你的标准哈希工具使用“复制到文件”按钮和散列该文件得到它。

   我错了，'复制到文件'不会导出选定的属性，而是导出整个证书。您可以将该值复制并粘贴到散列程序或十六进制编辑器中，以获得散列值。