starred/terminal
1
0
Fork 0
mirror of https://github.com/microsoft/terminal.git synced 2026-02-04 05:35:20 +00:00
Code Issues 19.0k Packages Projects Releases 20 Wiki Activity

WindowsTerminal.exe and OpenConsole.exe aren't signed #13247

New Issue
Closed
opened 2026-01-31 03:37:41 +00:00 by claunia · 19 comments
claunia commented 2026-01-31 03:37:41 +00:00
Owner
Copy Link

Originally created by @emmett-b on GitHub (Mar 31, 2021).

Windows Terminal version (or Windows build number)

Windows Terminal version 1.6.10571.0

Other Software

No response

Steps to reproduce

Open Sysinternal Process Explorer, enable the "Verified Signer" column and see "(No signature was present in the subject)".

Expected Behavior

I would expect programs from Microsoft to be signed by Microsoft. All other programs from Microsoft installed on my machine are signed.

Actual Behavior

I saw "(No signature was present in the subject)" in Sysinternal Process Explorer's "Verified Signer" column for both WindowsTerminal.exe and OpenConsole.exe

Originally created by @emmett-b on GitHub (Mar 31, 2021). ### Windows Terminal version (or Windows build number) Windows Terminal version 1.6.10571.0 ### Other Software _No response_ ### Steps to reproduce Open Sysinternal Process Explorer, enable the "Verified Signer" column and see "(No signature was present in the subject)". ### Expected Behavior I would expect programs from Microsoft to be signed by Microsoft. All other programs from Microsoft installed on my machine are signed. ### Actual Behavior I saw "(No signature was present in the subject)" in Sysinternal Process Explorer's "Verified Signer" column for both WindowsTerminal.exe and OpenConsole.exe
claunia added the Needs-TriageResolution-Fix-CommittedNeeds-Tag-Fix labels 2026-01-31 03:37:41 +00:00
claunia commented 2026-01-31 03:37:42 +00:00
Author
Owner
Copy Link

@emmett-b commented on GitHub (Mar 31, 2021):

Here's a screenshot from Process Explorer:
image

@emmett-b commented on GitHub (Mar 31, 2021): Here's a screenshot from Process Explorer: ![image](https://user-images.githubusercontent.com/28929018/113076761-0cdd8000-91d0-11eb-81e5-a7728494efa5.png)
claunia commented 2026-01-31 03:37:42 +00:00
Author
Owner
Copy Link

@DHowett commented on GitHub (Mar 31, 2021):

So, Terminal is distributed in a signed container, the msixbundle/individual msix archives. Packaged applications are signed as a single unit, and the signature is recorded as part of the app platform's package manager database. 😄

You can verify the signature on the build artifacts on our Releases page.

@DHowett commented on GitHub (Mar 31, 2021): So, Terminal is distributed in a signed _container_, the `msixbundle`/individual `msix` archives. Packaged applications are signed as a single unit, and the signature is recorded as part of the app platform's package manager database. :smile: You can verify the signature on the build artifacts on our Releases page.
claunia commented 2026-01-31 03:37:42 +00:00
Author
Owner
Copy Link

@emmett-b commented on GitHub (Mar 31, 2021):

@DHowett So is it a bug in Process Explorer?

@emmett-b commented on GitHub (Mar 31, 2021): @DHowett So is it a bug in Process Explorer?
claunia commented 2026-01-31 03:37:43 +00:00
Author
Owner
Copy Link

@DHowett commented on GitHub (Mar 31, 2021):

I believe so.

@DHowett commented on GitHub (Mar 31, 2021): I believe so.
claunia commented 2026-01-31 03:37:43 +00:00
Author
Owner
Copy Link

@emmett-b commented on GitHub (Mar 31, 2021):

Hmmm, let's have Mark Russinovich's take on it? ;)

@emmett-b commented on GitHub (Mar 31, 2021): Hmmm, let's have Mark Russinovich's take on it? ;)
claunia commented 2026-01-31 03:37:43 +00:00
Author
Owner
Copy Link

@DHowett commented on GitHub (Mar 31, 2021):

image

😄

@DHowett commented on GitHub (Mar 31, 2021): ![image](https://user-images.githubusercontent.com/189190/113183236-68802b80-9219-11eb-8d19-5de177ae0b9c.png) :smile:
claunia commented 2026-01-31 03:37:44 +00:00
Author
Owner
Copy Link

@emmett-b commented on GitHub (Mar 31, 2021):

Aren't you referring to an authority as well, in the form of an online article? :D
Sorry if I'm being annoying, hopefully we're just having fun.

@emmett-b commented on GitHub (Mar 31, 2021): Aren't you referring to an authority as well, in the form of an online article? :D Sorry if I'm being annoying, hopefully we're just having fun.
claunia commented 2026-01-31 03:37:44 +00:00
Author
Owner
Copy Link

@DHowett commented on GitHub (Mar 31, 2021):

In general, there are some things about packaged processes (or packaged applications in general) that don't play nicely with the established systems. I know that's not great... but this seems to be the case for every store-deployed signed app on my machine today. There's a signature file at the root of the package that attests to its contents, and a "block map" that is also signed that attests they haven't been tampered with!

image
(Properties dialog -- since I can't actually get Process Explorer to display anything for Verified Signer ☹️; Anyway, no Digital Signatures page!)

However, this guy is here:

image

Indeed, all in good fun!

@DHowett commented on GitHub (Mar 31, 2021): In general, there are some things about packaged processes (or packaged applications in general) that don't play nicely with the established systems. I know that's not _great_... but this seems to be the case for every store-deployed signed app on my machine today. There's a signature file at the root of the package that attests to its contents, and a "block map" that is also signed that attests they haven't been tampered with! ![image](https://user-images.githubusercontent.com/189190/113184097-666a9c80-921a-11eb-8c06-9a5f03418818.png) (Properties dialog -- since I can't actually get Process Explorer to display **anything** for Verified Signer ☹️; Anyway, no Digital Signatures page!) However, this guy is here: ![image](https://user-images.githubusercontent.com/189190/113184167-797d6c80-921a-11eb-9b19-9ef29557894c.png) Indeed, all in good fun!
claunia commented 2026-01-31 03:37:44 +00:00
Author
Owner
Copy Link

@emmett-b commented on GitHub (Mar 31, 2021):

I can't say I fully understand what a packaged process means, but it seems like you're aware of what the problem is and where it lies, so I'll trust you :)
Thanks for your time.

@emmett-b commented on GitHub (Mar 31, 2021): I can't say I fully understand what a packaged process means, but it seems like you're aware of what the problem is and where it lies, so I'll trust you :) Thanks for your time.
claunia commented 2026-01-31 03:37:44 +00:00
Author
Owner
Copy Link

@DHowett commented on GitHub (Mar 31, 2021):

SO! A packaged process is one that has an "identity" and was downloaded from the store or installed from a signed appx or msix file. If you go to Process Explorer and enable the "Package Name" field, you can see the identity for each process.

That identity is used to control access to resources in a more fine-grained way than your user ID/user account ACL. It's part of the store's sandboxing system.

@DHowett commented on GitHub (Mar 31, 2021): SO! A packaged process is one that has an "identity" and was downloaded from the store or installed from a signed `appx` or `msix` file. If you go to Process Explorer and enable the "Package Name" field, you can see the identity for each process. That identity is used to control access to resources in a more fine-grained way than your user ID/user account ACL. It's part of the store's sandboxing system.
claunia commented 2026-01-31 03:37:45 +00:00
Author
Owner
Copy Link

@b-dasass commented on GitHub (Apr 9, 2021):

Hi @DHowett, I understand everything you wrote here.

However, windowsterminalshellext.dll also not signed, and the it is being blocked on my machine because of the missing digital signature.

When I'm casually browsing my file system using File Explorer I'm being prompted by an alert that ddlhost.exe wasn't able to access windowsterminalshellext.dll because it's content cannot be verified, and it's being blocked to prevent any malicious things.

Is this something I need to open an issue for?

@b-dasass commented on GitHub (Apr 9, 2021): Hi @DHowett, I understand everything you wrote here. However, `windowsterminalshellext.dll` also not signed, and the it is being blocked on my machine because of the missing digital signature. When I'm casually browsing my file system using File Explorer I'm being prompted by an alert that `ddlhost.exe` wasn't able to access `windowsterminalshellext.dll` because it's content cannot be verified, and it's being blocked to prevent any malicious things. Is this something I need to open an issue for?
claunia commented 2026-01-31 03:37:45 +00:00
Author
Owner
Copy Link

@zadjii-msft commented on GitHub (Apr 9, 2021):

@b-dasass two questions:

  • How did you install the Terminal? (from the store, from the Releases page, from winget, choco, scoop, etc)
  • What program is displaying the alert about the missing signature?
@zadjii-msft commented on GitHub (Apr 9, 2021): @b-dasass two questions: * How did you install the Terminal? (from the store, from the Releases page, from `winget`, `choco`, `scoop`, etc) * What program is displaying the alert about the missing signature?
claunia commented 2026-01-31 03:37:45 +00:00
Author
Owner
Copy Link

@DHowett commented on GitHub (Apr 9, 2021):

I suspect that the "security" software you're using doesn't respect package signatures and will throw a warning for any packaged shell extension. :/

@DHowett commented on GitHub (Apr 9, 2021): I suspect that the "security" software you're using doesn't respect package signatures and will throw a warning for _any_ packaged shell extension. :/
claunia commented 2026-01-31 03:37:46 +00:00
Author
Owner
Copy Link

@kjake commented on GitHub (Aug 27, 2021):

The executables themselves are in-fact not signed. Microsoft's own App Locker will allow Terminal to install because it is signed, but not run because the executables are not signed. In order for App Locker to allow execution, you would need to either allow the path or file hashes, because there is no Publisher information on the executables.

Proof: https://i.imgur.com/4sembm5.png

@kjake commented on GitHub (Aug 27, 2021): The executables themselves are in-fact _not_ signed. Microsoft's own App Locker will allow Terminal to install because it is signed, but not run because the executables are not signed. In order for App Locker to allow execution, you would need to either allow the path or file hashes, because there is no Publisher information on the executables. Proof: https://i.imgur.com/4sembm5.png
claunia commented 2026-01-31 03:37:46 +00:00
Author
Owner
Copy Link

@DHowett commented on GitHub (Aug 27, 2021):

Thanks! I'm asking the AppLocker team.

@DHowett commented on GitHub (Aug 27, 2021): Thanks! I'm asking the AppLocker team.
claunia commented 2026-01-31 03:37:46 +00:00
Author
Owner
Copy Link

@ad0nis commented on GitHub (Jan 11, 2023):

I feel like you may have closed this too hastily. Sysinternals Process Explorer is standard admin software for troubleshooting issues like this. If their software says your exe is unsigned, and you admit it's unsigned, but insist that the de-facto software is wrong because it's not checking the special way you chose to sign it, you're pretty clearly in the wrong here. Just sign the exe so AAL/AWL can work properly. Either that, or get Mark Russinovich/SysInternals to add checking for your signature type. You also insist that the "Package Name" field will show the proper information, but that is clearly not displayed.

image

Sorry if this all sounds a bit angry, but I just had to spend a very non-zero amount of time checking that my system wasn't infected because my windows terminal was un-signed. Please just sign your exe and save everyone some headaches and hair-pulling.

@ad0nis commented on GitHub (Jan 11, 2023): I feel like you may have closed this too hastily. Sysinternals Process Explorer is standard admin software for troubleshooting issues like this. If their software says your exe is unsigned, and you admit it's unsigned, but insist that the de-facto software is wrong because it's not checking the **special way you chose to sign it**, you're pretty clearly in the wrong here. Just sign the exe so AAL/AWL can work properly. Either that, or get Mark Russinovich/SysInternals to add checking for your signature type. You also insist that the "Package Name" field will show the proper information, but that is clearly not displayed. <img width="1152" alt="image" src="https://user-images.githubusercontent.com/4333916/211877078-30cacc11-e1e6-4fe8-8f58-f92355051e35.png"> Sorry if this all sounds a bit angry, but I just had to spend a very non-zero amount of time checking that my system wasn't infected because my windows terminal was un-signed. Please just sign your exe and save everyone some headaches and hair-pulling.
claunia commented 2026-01-31 03:37:46 +00:00
Author
Owner
Copy Link

@johnstep commented on GitHub (Jan 12, 2023):

Packaged executables are signed, along with other files as required for deployment, but file signatures are stored in the package catalog, AppxMetadata\CodeIntegrity.cat (except for Windows system packages). Executables may also have embedded signatures, but those are not required when packaged, even for a verified publisher UAC elevation prompt.

Process Explorer currently only displays the package name (package full name*, not display name) for UWP processes, not all packaged processes, and does not use the package catalog. We will fix both issues in Process Explorer. Thanks!

In the meantime, try the following workaround with Sigcheck from PowerShell:

$ (ps WindowsTerminal).Path
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.15.3466.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe

$ cd "C:\Program Files\WindowsApps\Microsoft.WindowsTerminalPreview_1.16.3464.0_x64__8wekyb3d8bbwe\"

$ sigcheck.exe -f .\AppxMetadata\CodeIntegrity.cat .\WindowsTerminal.exe

Sigcheck v2.90 - File version and signature viewer
Copyright (C) 2004-2022 Mark Russinovich
Sysinternals - www.sysinternals.com

C:\Program Files\WindowsApps\Microsoft.WindowsTerminalPreview_1.16.3464.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe:
        Verified:       Signed
        Signing date:   10:03 2022-12-13
        Publisher:      Microsoft Corporation
        Company:        Microsoft Corporation
        Description:    WindowsTerminal.exe
        Product:        Windows Terminal
        Prod version:   1.16.221212004-preview
        File version:   1.16.2212.12004
        MachineType:    64-bit

* Example package full name: Microsoft.SysinternalsSuite_2022.11.2.0_x64__8wekyb3d8bbwe

@johnstep commented on GitHub (Jan 12, 2023): Packaged executables _are_ signed, along with other files as [required](https://learn.microsoft.com/windows/msix/package/signing-package-overview) for deployment, but file signatures are stored in the package catalog, AppxMetadata\CodeIntegrity.cat (except for Windows system packages). Executables may also have embedded signatures, but those are not required when packaged, even for a verified publisher UAC elevation prompt. Process Explorer currently only displays the package name (package full name*, not display name) for UWP processes, not _all_ packaged processes, and does not use the package catalog. We will fix both issues in Process Explorer. Thanks! In the meantime, try the following workaround with [Sigcheck](https://www.sysinternals.com/downloads/sigcheck) from PowerShell: ``` $ (ps WindowsTerminal).Path C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.15.3466.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe $ cd "C:\Program Files\WindowsApps\Microsoft.WindowsTerminalPreview_1.16.3464.0_x64__8wekyb3d8bbwe\" $ sigcheck.exe -f .\AppxMetadata\CodeIntegrity.cat .\WindowsTerminal.exe Sigcheck v2.90 - File version and signature viewer Copyright (C) 2004-2022 Mark Russinovich Sysinternals - www.sysinternals.com C:\Program Files\WindowsApps\Microsoft.WindowsTerminalPreview_1.16.3464.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe: Verified: Signed Signing date: 10:03 2022-12-13 Publisher: Microsoft Corporation Company: Microsoft Corporation Description: WindowsTerminal.exe Product: Windows Terminal Prod version: 1.16.221212004-preview File version: 1.16.2212.12004 MachineType: 64-bit ``` \* Example package full name: Microsoft.SysinternalsSuite_2022.11.2.0_x64__8wekyb3d8bbwe
claunia commented 2026-01-31 03:37:46 +00:00
Author
Owner
Copy Link

@ghost commented on GitHub (Jan 24, 2023):

:tada:This issue was addressed in #14710, which has now been successfully released as Windows Terminal v1.16.1023 (10231 and 10232).🎉

Handy links:

@ghost commented on GitHub (Jan 24, 2023): :tada:This issue was addressed in #14710, which has now been successfully released as `Windows Terminal v1.16.1023 (10231 and 10232)`.:tada: Handy links: * [Release Notes](https://github.com/microsoft/terminal/releases/tag/v1.16.1023 (10231 and 10232)) * [Store Download](https://www.microsoft.com/store/apps/9n8g5rfz9xk3?cid=storebadge&ocid=badge)
claunia commented 2026-01-31 03:37:47 +00:00
Author
Owner
Copy Link

@ghost commented on GitHub (Jan 24, 2023):

:tada:This issue was addressed in #14710, which has now been successfully released as Windows Terminal Preview v1.17.1023.🎉

Handy links:

@ghost commented on GitHub (Jan 24, 2023): :tada:This issue was addressed in #14710, which has now been successfully released as `Windows Terminal Preview v1.17.1023`.:tada: Handy links: * [Release Notes](https://github.com/microsoft/terminal/releases/tag/v1.17.1023) * [Store Download](https://www.microsoft.com/store/apps/9n8g5rfz9xk3?cid=storebadge&ocid=badge)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
⛺ Reserved
A11yCO
A11yMAS
A11ySev1
A11ySev2
A11ySev3
A11yTTValidated
A11yUsable
A11yVoiceAccess
A11yWCAG
Area-Accessibility
Area-AtlasEngine
Area-AzureShell
Area-Build
Area-Build
Area-Chat
Area-CmdPal
Area-CodeHealth
Area-Commandline
Area-CookedRead
Area-DefApp
Area-Extensibility
Area-Fonts
Area-GroupPolicy
Area-i18n
Area-Input
Area-Interaction
Area-Interop
Area-Localization
Area-Output
Area-Performance
Area-Portable
Area-Quality
Area-Remoting
Area-Rendering
Area-Schema
Area-Server
Area-Settings
Area-SettingsUI
Area-ShellExtension
Area-ShellExtension
Area-ShellExtension
Area-Suggestions
Area-Suggestions
Area-TerminalConnection
Area-TerminalControl
Area-Theming
Area-UserInterface
Area-VT
Area-Windowing
Area-WPFControl
AutoMerge
Blocking-Ingestion
Culprit-Centennial
Culprit-WinUI
Disability-All
Disability-Blind
Disability-LowVision
Disability-Mobility
External-Blocked-WinUI3
Fixed
Gathering-Data
good first issue
HCL-E+D
HCL-WindowsTerminal
Help Wanted
Impact-Compatibility
Impact-Compliance
Impact-Correctness
Impact-Visual
In-PR
InclusionBacklog
InclusionBacklog-Windows TerminalWin32
InclusionCommitted-202206
Issue-Bug
Issue-Docs
Issue-Feature
Issue-Feature
Issue-Question
Issue-Samples
Issue-Scenario
Issue-Task
Needs-Attention
Needs-Author-Feedback
Needs-Bisect
Needs-Discussion
Needs-Repro
Needs-Tag-Fix
Needs-Tag-Fix
Needs-Triage
No-Recent-Activity
Priority-0
Priority-1
Priority-2
Priority-3
Product-Cmd.exe
Product-Colortool
Product-Colortool
Product-Colortool
Product-Conhost
Product-Conpty
Product-Meta
Product-Powershell
Product-Terminal
Product-WSL
pull-request
Mirrored from GitHub Pull Request
 Resolution-Answered
Resolution-By-Design
Resolution-Duplicate
Resolution-External
Resolution-Fix-Available
Resolution-Fix-Committed
Resolution-No-Repro
Resolution-Won't-Fix
Severity-Blocking
Severity-Crash
Severity-DataLoss
spam
this-will-be-a-breaking-change
Tracking-External
WindowsTerminal_Win32
Work-Item
zAskModeBug
zInbox-Bug
No Label Needs-Tag-Fix Needs-Triage Resolution-Fix-Committed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#13247
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?