Spaces in file path trouble Signotaur tool

Signotaur Bugs
1

Signotaur tool doesn’t accept spaces in the target file path, it seems to iterate through the space delimited bits and try to resolve each as a target file. N.B. The whole path is enclosed by double quotes on the command line.
In a similar vein, the -d parameter is always truncated at the first space.

2

Hi Peter,

Thanks for the report. We haven’t been able to reproduce this on our side - quoted paths and -d values are coming through as single arguments in our tests, for example:

SignotaurTool sign "C:\Some Folder\My App.exe" -a <api-key> -s https://signotaur.example.com -t <thumbprint> --fd SHA256 -d "Built by CI on Friday"

This signs a single file and sets the full description as expected.

For the behaviour you’re seeing, something upstream is almost certainly stripping or re-tokenising the quotes before they reach SignotaurTool.exe - likely a script, a CI step, or a PowerShell call.

A couple of things that would help narrow it down:

  • Run the same command with -v added and share the output - that’ll show what SignotaurTool actually received.
  • Let us know how you’re launching it: straight from a command prompt, a .cmd/.ps1 script, or a CI runner (and which one)?

Once we can see that, we should be able to pinpoint whether the issue is in the tool or in the caller.

3

Hi Dave,

You are right, the upstream process is putting in too many quotes so I end with the final command having the paths surrounded by 2 double quotes at each end.
The call stack is FinalBuilder->InstallShield->Custom signing cmd file.
It looks like InstallShield is quoting arguments to the cmd file as needed which possibly led to my confusion.
Anyway, I have fixed it by removing some quotes from the cmd file - and tested ok.
Thanks for your response and please consider resolved.
Regards,

Peter.