RFR: 8326447: jpackage creates Windows installers that cannot be signed [v2]

[Alexey Semenyuk]

On Sat, 22 Feb 2025 04:10:17 GMT, Alexander Matveev <almatvee at openjdk.org> wrote:

> maybe bug in our embed code

The code has been the same since the first release of jpackage.

> do we know when it was introduced and figure out root cause

Quote from the bug description:

> JDK 21.0.2 (Temurin)
>
> A DESCRIPTION OF THE PROBLEM :
> I have recently upgraded from Java 18 to Java 21, and noticed that there has been a change in jpackage which is causing signtool (the Microsoft code signing tool) to fail when signing the installer. Even though the installer .exe can be run on the system, the signtool command fails with:
> 
> SignTool Error: SignedCode::Sign returned error: 0x800700C1
> 
> This rather cryptic message refers to ERROR_BAD_EXE_FORMAT. Note that the same build run with Java 18 produces an .exe installer which does not have this problem.
> 
> If I compare the .exe produced by Java 21 with that produced by Java 18 with dumpfile and pestudio, I notice two differences:
> 
> 1. There is a 'version' section containing application name and version information in the Java 18 installer which is no longer present
> 2. The linker version has changed from 1.27 to 1.37

Maybe something is off with the toolchain used to assemble Temurin JDK 21.

I used pestudio to inspect the value of the linker's version in PE headers of Open JDK binaries from Oracle. A few releases I inspected have something like "Microsoft Linker 14.36".
I did the same for `msiwrapper.exe` from Temurin JDK21 (OpenJDK21U-jdk_x64_windows_hotspot_21.0.2_13.zip). The linker version is "Microsoft Linker 14.37". For Temurin JDK18 (OpenJDK18U-jdk_x64_windows_hotspot_18.0.2.1_1.zip) the linker version is "Microsoft Linker 14.27".

> 2. The linker version has changed from 1.27 to 1.37

Maybe the submitter meant the linker version changed from 14.27 to 14.37?

Anyway, they didn't complain about the Oracle variant of OpenJDK. If this is linker version-specific issue SignTool test may pass with Oracle OpenJDK and fail with other variants built with different toolchains.

-------------

PR Comment: https://git.openjdk.org/jdk/pull/23732#issuecomment-2676030459