signpath

diylc/diylc-swing/deploy/win/signpath/is-signed.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""Exits 0 if the given PE file carries an Authenticode signature, 1 if it does not.
+
+`osslsigncode verify` also fails on an untrusted chain, which is the normal result for the
+SignPath test certificate, so it cannot answer this question on its own. This reads the PE
+Certificate Table data directory instead, which says whether a signature is present without
+making any claim about its validity.
+"""
+
+import struct
+import sys
+
+
+def has_signature(path):
+    with open(path, "rb") as f:
+        data = f.read()
+
+    pe = struct.unpack_from("<I", data, 0x3C)[0]
+    if data[pe:pe + 4] != b"PE\0\0":
+        raise ValueError("not a PE file: %s" % path)
+
+    optional_header = pe + 24
+    magic = struct.unpack_from("<H", data, optional_header)[0]
+    if magic == 0x10B:
+        directories = optional_header + 96
+    elif magic == 0x20B:
+        directories = optional_header + 112
+    else:
+        raise ValueError("unknown optional header magic 0x%x in %s" % (magic, path))
+
+    # data directory entry 4 is the Certificate Table
+    _, size = struct.unpack_from("<II", data, directories + 4 * 8)
+    return size > 0
+
+
+if __name__ == "__main__":
+    signed = has_signature(sys.argv[1])
+    print("signed" if signed else "unsigned")
+    sys.exit(0 if signed else 1)