签署非 PE 文件的通用方法
我知道 Windows 本质上可以检测和验证 PE 和某些类型的文本文件（.vbs、.ps 和 .wsf）的签名。不过，我很好奇是否有一种方法可以将签名附加或关联到不直接支持签名的文件，例如 .ISO 或 .zip 文件。
包含二进制文件和 .inf 文件混合的驱动程序包使用签名的 .cat 文件来允许间接签名其组成部分，但您必须使用“signtool.exe verify”来验证文件，并且我通过这种方法得到了混合结果。
我想我正在寻找某种签名的清单文件，我们可以使用它来允许用户轻松验证他们下载的文件集在传输过程中或被第三方未损坏，并且不涉及他们创建手动进行 MD5 并将结果与存储在文本文件中的值进行比较（文本文件也可能被欺骗）。
I know that Windows can intrinsically detect and verify signatures of PEs and some types of text file (.vbs, .ps and .wsf). However I'm curious whether there is a way to somehow attach or associate a signature to a file that doesn't directly support signatures, such as .ISO or .zip files.
Drivers packages that contain a mixture of binaries and .inf files use signed .cat files to allow their constituents to be signed indirectly, but you have to use "signtool.exe verify" to validate the file and I am getting mixed results with this approach.
I guess I am looking for some kind of signed manifest file that we can use to allow users to easily verify that the set of files they downloaded haven't been corrupted in transit or by a third party, and which doesn't involve them creating MD5's manually and comparing the results with values stored in a text file (which might also have been diddled with).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
NTFS 的备用数据流 似乎非常适合存储签名 - 这将允许您将签名附加到任何类型的文件，因此您不需要单独的清单。
当然，您仍然需要开发一个应用程序来验证签名 - 没有办法解决这个问题。
NTFS's Alternate Data Streams seem like a good fit for storing the signatures - this would allow you to attach a signature to any kind of file, so you wouldn't need a separate manifest.
You would of course still need to develop an application to verify the signatures - there is no way around that.