1830159 - `./mach repackage msix --sign` SignTool Error

Status: RESOLVED FIXED

(Firefox Build System :: Bootstrap Configuration, defect, P3)

Description

[Nick Rishel [:nrishel]]

$ ./mach repackage msix --sign
 0:01.24 Adding files from 'C:/mozilla-source/builds/obj-ff-debug-full\dist\bin'
 0:06.87 AppConstants.sys.mjs display version is '114.0a1' and build ID is '20230426103848': embedded version will be '114.2304.2610.0'
 0:06.87 Read 'MOZ_BRANDING_DIRECTORY' from C:/mozilla-source/mozilla-unified/browser/confvars.sh: browser/branding/unofficial
 0:06.87 Checking buildconfig.html for --with-branding build flag.
 0:06.88 No branding set; Using branding from 'browser/branding/unofficial'.
 0:06.88 Repackaging to: C:/Users/nrishel/.mozbuild/cache/mach-msix/Mozilla.MozillaNightly_114.2304.2610.0_x64.msix
 0:07.68 Adding distribution files from C:/mozilla-source/mozilla-unified/browser/installer/windows/msix/distribution
 0:12.34 Elapsed: 4.64s; From C:/Users/nrishel/.mozbuild/cache/mach-msix/msix-temp-unofficial: Kept 0 existing; Added/updated 6408; Removed 0 files and 0 directories.
Adding configure options from C:\mozilla-source\mozilla-unified\mozconfig
  --with-ccache=sccache
  --enable-unverified-updates
  --enable-warnings-as-errors
  --enable-debug
  --enable-debug-symbols
  --disable-optimize
checking for vcs source checkout... hg
checking for a shell... C:/mozilla-build/msys2/usr/bin/sh.exe
checking for host system type... x86_64-pc-windows-msvc
checking for target system type... x86_64-pc-windows-msvc
checking whether cross compiling... no
checking for Windows SDK... 0x0a00 in 'C:/Users/nrishel/.mozbuild/vs/Windows Kits/10'
checking for Universal CRT SDK... 10.0.17134.0 in 'C:/Users/nrishel/.mozbuild/vs/Windows Kits/10'
 0:18.16 Invoking: 'C:/Users/nrishel/.mozbuild/vs/Windows Kits/10/bin/10.0.17134.0/x64/makeappx.EXE' pack /d C:/Users/nrishel/.mozbuild/cache/mach-msix/msix-temp-unofficial /p C:/Users/nrishel/.mozbuild/cache/mach-msix/Mozilla.MozillaNightly_114.2304.2610.0_x64.msix /overwrite
 0:49.27 Signing with existing self signed certificate: C:/Users/nrishel/.mozbuild/cache/mach-msix/mozilla_corporation_msix_packaging_test_certificate.crt
 0:49.27 Invoking: C:/Windows/System32/WindowsPowerShell/v1.0/powershell.EXE -c 'Get-PfxCertificate -FilePath "C:/Users/nrishel/.mozbuild/cache/mach-msix/mozilla_corporation_msix_packaging_test_certificate.crt" | Select-Object -ExpandProperty Thumbprint'
 0:50.51 Signing with certificate with thumbprint: 8B0BF44F91A36C3DC33F74755E7247EFA56825FD
Done Adding Additional Store
SignTool Error: An unexpected internal error has occurred.
Error information: "Error: SignerSign() failed." (-2147024846/0x80070032)
Error running mach:

    ['repackage', 'msix', '--sign']

The error occurred in code that was called by the mach command. This is either
a bug in the called code itself or in the way that mach is calling it.
You can invoke ``./mach busted`` to check if this issue is already on file. If it
isn't, please use ``./mach busted file repackage`` to report it. If ``./mach busted`` is
misbehaving, you can also inspect the dependencies of bug 1543241.

If filing a bug, please include the full output of mach, including this error
message.

The details of the failure are as follows:

subprocess.CalledProcessError: Command '['C:/Users/nrishel/.mozbuild/vs/Windows Kits/10/bin/10.0.17134.0/x64/signtool.EXE', 'sign', '/a', '/fd', 'SHA256', '/f', 'C:/Users/nrishel/.mozbuild/cache/mach-msix/mozilla_corporation_msix_packaging_test_certificate.pfx', '/p', '193dbfc6-8ff7-4a95-8f32-6b4468626bd0', 'C:/Users/nrishel/.mozbuild/cache/mach-msix/Mozilla.MozillaNightly_114.2304.2610.0_x64.msix']' returned non-zero exit status 1.

  File "C:\mozilla-source\mozilla-unified\python\mozbuild\mozbuild\mach_commands.py", line 2666, in repackage_msix
    repackage_sign_msix(command_context, output, force=False, verbose=verbose)
  File "C:\mozilla-source\mozilla-unified\python\mozbuild\mozbuild\mach_commands.py", line 2695, in repackage_sign_msix
    sign_msix(input, force=force, log=command_context.log, verbose=verbose)
  File "c:\mozilla-source\mozilla-unified\python\mozbuild\mozbuild\repackaging\msix.py", line 1220, in sign_msix
    return _sign_msix_win(output, force, log, verbose)
  File "c:\mozilla-source\mozilla-unified\python\mozbuild\mozbuild\repackaging\msix.py", line 958, in _sign_msix_win
    subprocess.check_call(args, universal_newlines=True)
  File "C:\mozilla-build\python3\lib\subprocess.py", line 373, in check_call
    raise CalledProcessError(retcode, cmd)

Sentry event ID: c6105d4baa32423d8bdd549fe0e8d439
Sentry is attempting to send 0 pending error messages
Waiting up to 2 seconds
Press Ctrl-Break to quit

Comment 1

[Nick Rishel [:nrishel]]

:glandium CC in case this relates to the recent MSVC bootstrapping changes. My guess is a bug present in the SDK no longer hidden by preferring newer versions - 10.0.17134 dating back to 2018 iiuc.

Edit: moving this line under win64-vs2019 per discussion with :glandium fixed the issue, as did disabling the MSVC bootstrapping via ac_add_options --enable-bootstrap=-vs in mozconfig and renaming .mozbuild/vs (to hide the bootstrapped MSVC).

Comment 2

[Nick Rishel [:nrishel]]

Resolved along with Bug 1832467.