Azure Artifact Signing with AI

[sasha]

Hello!

We recently switched to the AAS for our signing needs. A part of signing is done by our build scripts using signtool.exe. Another part is performed by Advanced installer.

One thing I noticed with AAS is that on occasion, signtool.exe will simply hang. It will never exit (I've not tried beyond a few hours). To combat this I've implemented a retry logic with killing the signtool process after some timeout.

I think I noticed the same issue with Advanced Installer as well. I saw it sitting with zero CPU load for about 30 minutes. I suspect it experienced the same hang. Perhaps some sort of retry after a timeout would be good to implement in Advanced Installer as well.

[Catalin]

Hello Sasha,

This happens from Advanced Installer probably for the exact same reason, as we also use signtool for signing purposes.

I've been able to find some recent thread going on regarding this issue, but no official statement from Microsoft so far.

signtool hangs at "Submitting digest for signing..."

Perhaps some sort of retry after a timeout would be good to implement in Advanced Installer as well.

I will discuss this with the developer in charge of AAS support. Ideally, though, this should be something Microsoft fixes on their end, hopefully sometimes soon.

The AAS is highly used, so if this was a common scenario, most likely more people would have reported it. However, since that does not seem to be the case, it makes me think that perhaps this is a corner case scenario. In this case, it would be helpful to find the culprit and perhaps open a ticket to the AAS support team (if they have any?).

Best regards,
Catalin

[sasha]

Thanks, Catalin.

The issue mentioned in the thread you linked is exactly what I see. Our Jenkins agents are hosted in Azure. Maybe there is some strange interaction.
I agree, this is something that MSFT should ultimately fix. Meanwhile - workarounds

[Catalin]

You are always welcome, Sasha!

Best regards,
Catalin