[PATCH 0/1] MR11609: wintrust: Delegate hash verification to SIP dispatch table.

[Nilesh Kumbhar (＠nilesh123)]

SOFTPUB_VerifyImageHash() only verified hashes for PE files and
silently returned success for any other subject type, including
MSI packages (SPC_SIPINFO_OBJID). Delegate to the SIP dispatch
table's pfVerify function, which was already being loaded via
CryptSIPLoad() but never used here.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=60077

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11609

[PATCH 1/1] wintrust: Delegate hash verification to SIP dispatch table.

[Nilesh Kumbhar]

From: Nilesh Kumbhar <[e-mail]>

SOFTPUB_VerifyImageHash() only verified hashes for PE files and
silently returned success for any other subject type, including
MSI packages (SPC_SIPINFO_OBJID). Delegate to the SIP dispatch
table's pfVerify function, which was already being loaded via
CryptSIPLoad() but never used here.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=60077
---
 dlls/wintrust/softpub.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/dlls/wintrust/softpub.c b/dlls/wintrust/softpub.c
index 609d240a738..381a6594a5b 100644
--- a/dlls/wintrust/softpub.c
+++ b/dlls/wintrust/softpub.c
@@ -318,7 +318,16 @@ static DWORD SOFTPUB_VerifyImageHash(CRYPT_PROVIDER_DATA *data, HANDLE file)
     if (((ULONG_PTR)indirect->Data.pszObjId >> 16) == 0 ||
         strcmp(indirect->Data.pszObjId, SPC_PE_IMAGE_DATA_OBJID))
     {
-        FIXME("Cannot verify hash for pszObjId=%s\n", debugstr_a(indirect->Data.pszObjId));
+        if (data->pPDSip->pSip && data->pPDSip->pSip->pfVerify &&
+            data->pPDSip->psSipSubjectInfo)
+        {
+            BOOL sip_ret = data->pPDSip->pSip->pfVerify(
+                data->pPDSip->psSipSubjectInfo,
+                (SIP_INDIRECT_DATA *)indirect);
+            return sip_ret ? ERROR_SUCCESS : TRUST_E_BAD_DIGEST;
+        }
+        FIXME("Cannot verify hash for pszObjId=%s (no SIP verify available)\n",
+         debugstr_a(indirect->Data.pszObjId));
         return ERROR_SUCCESS;
     }
 
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/11609

[PATCH 0/1] MR11609: wintrust: Delegate hash verification to SIP dispatch table. - approved

[Nilesh Kumbhar (＠nilesh123)]

This merge request was approved by Nilesh Kumbhar.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11609

[Hans Leidekker (＠hans)]

This could use a test. Did you use AI to generate this patch?

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11609#note_148276

[Nilesh Kumbhar (＠nilesh123)]

On Fri Aug  7 21:11:37 2026 +0000, Hans Leidekker wrote:
> This could use a test. Did you use AI to generate this patch?
> I did use Ai while working on this, to help understand the trace logs. The actual debugging was done by me I also ran the existing wintrust tests (asn, crypt, register, softpub), and they all pass with no new failures.I haven't added a dedicated test for this yet because after this fix the code reaches MsiSIPVerifyIndirectData, which is currently just an unimplemented stub in Wine. I can add a todo_wine test if you'd prefer.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11609#note_148348