[天天解決一問題系列 - 0005] WiX Burn 如何校驗chained package的合法性

問題描述：

項目中使用Wix burn打包，內部包含了多個MSI。有時候會遇到以下錯誤

Error 0x80091007: Failed to verify hash of payload: SetupProject1.msi 。

問題解析：

首先須要瞭解Wix Brun校驗其payload的原理，主要有以下兩種狀況：

1）若是MSI有數字簽名，則根據MSI的數字簽名進行校驗，也就是說若是數字簽名沒有變，Burn不會校驗MSI的內容是否變化

2）若是MSI無數字簽名，則獲取該MSI的SHA1 hash，在安裝的時候校驗hash。這種狀況下，若是MSI的內容發生變化，則沒法使用該burn進行安裝，必須從新編譯。

WIX Brun 源代碼 (burn\engine\cache.cpp)

static HRESULT VerifyThenTransferPayload(
    __in BURN_PAYLOAD* pPayload,
    __in_z LPCWSTR wzCachedPath,
    __in_z LPCWSTR wzUnverifiedPayloadPath,
    __in BOOL fMove
    )
{
。。。
 // If the payload has a certificate root public key identifier provided, verify the certificate.
    if (pPayload->pbCertificateRootPublicKeyIdentifier)
    {
        hr = CacheVerifyPayloadSignature(pPayload, wzUnverifiedPayloadPath, hFile);
        ExitOnFailure1(hr, "Failed to verify payload signature: %ls", wzCachedPath);
    }
    else if (pPayload->pCatalog) // If catalog files are specified, attempt to verify the file with a catalog file
    {
        hr = VerifyPayloadWithCatalog(pPayload, wzUnverifiedPayloadPath, hFile);
        ExitOnFailure1(hr, "Failed to verify payload signature: %ls", wzCachedPath);
    }
    else if (pPayload->pbHash) // the payload should have a hash we can use to verify it.
    {
        hr = VerifyHash(pPayload->pbHash, pPayload->cbHash, wzUnverifiedPayloadPath, hFile);
        ExitOnFailure1(hr, "Failed to verify payload hash: %ls", wzCachedPath);
    }
。。。
}

 

解決方法：

瞭解了問題的原理，方法就顯而易見了。