[Bug 60077] New: crypt32: CryptDecodeObjectEx fails to decode SPC_INDIRECT_DATA/SPC_STATEMENT_TYPE OIDs, breaking Epic Games Launcher MSI signature verification

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=60077

            Bug ID: 60077
           Summary: crypt32: CryptDecodeObjectEx fails to decode
                    SPC_INDIRECT_DATA/SPC_STATEMENT_TYPE OIDs, breaking
                    Epic Games Launcher MSI signature verification
           Product: Wine
           Version: 11.13
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: crypt32
          Assignee: [e-mail]
          Reporter: [e-mail]
  Target Milestone: ---
      Distribution: ---

Created attachment 81588
  --> http://bugs.winehq.org/attachment.cgi?id=81588
epic debug log

Epic Games Launcher fails during its MSI-based auto-update process because
CryptDecodeObjectEx() does not support decoding the following Authenticode-
related OIDs used in SPC (Software Publisher Certificate) structures:

  1.3.6.1.4.1.311.2.1.4   (SPC_INDIRECT_DATA_OBJID)
  1.3.6.1.4.1.311.2.1.30  (SPC_STATEMENT_TYPE_OBJID)

This causes MSI signature verification to fail with:
  "The embedded MSI payload failed signature verification.
   Certificate CN does not match 'Epic Games Inc.'"

even though the MSI's signing certificate is valid on Windows.

Reproduction:
1. Install/run Epic Games Launcher installer under Wine
2. Let it attempt to verify the embedded MSI payload
3. Observe the certificate verification failure dialog with CN mismatch

Expected: MSI signature should verify successfully, matching Windows behavior.
Actual: CryptDecodeObjectEx returns an unsupported-decoder error for the
above OIDs, causing downstream cert validation to reject a validly signed
package.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 60077] crypt32: CryptDecodeObjectEx fails to decode SPC_INDIRECT_DATA/SPC_STATEMENT_TYPE OIDs, breaking Epic Games Launcher MSI signature verification

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=60077

Ken Sharp <[e-mail]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download, Installer
                URL|                            |https://launcher-public-ser
                   |                            |vice-prod06.ol.epicgames.co
                   |                            |m/launcher/api/installer/do
                   |                            |wnload/EpicGamesLauncherIns
                   |                            |taller.msi

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.