Signed dll doesn't meet the custom 1 signing level requirements or violated code integrity policy

Question

I'm trying to get my Electron app approved to the app store. I have enabled the audit mode on a VM. I'm running into this issue after installing the app with a signed appx.

The following log is found in the Event Viewer -> Application and Services Logs-> Microsoft-> Windows-> CodeIntegrity-> Operational.

Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\WindowsApps\Company.App_Version_x64__identifier\app\Bar.exe) attempted to load \Device\HarddiskVolume2\Program Files\WindowsApps\Company.Bar_Version_x64__identifier\app\d3dcompiler_47.dll that did not meet the Custom 1 signing level requirements or violated code integrity policy (Policy ID:{a244370e-44c9-4c06-b551-f6016e563076}). However, due to code integrity auditing policy, the image was allowed to load.

I have the same issue twice more with /app/swiftshader/libGLESv2.dll and /app/swiftshader/libEGL.dll.

The dlls are being signed with :

  require("child_process").execSync(`/signtool.exe sign /f ${CERTIFICATE_NAME} /p ${TOKEN_PASSWORD} /t http://timestamp.digicert.com ./dist/win-unpacked/${dllName}.dll`);

C:\Program Files\WindowsApps\Company.Bar_version_x64__identifier\app> Get-AuthenticodeSignature -FilePath .\*.dll,.\*.exe,.\swiftshader\*.dll

    Directory: C:\Program Files\WindowsApps\Company.Bar_version_x64__identifier\app


SignerCertificate                         Status                                 Path
-----------------                         ------                                 ----
0011223344556677889911223344556677889900  Valid                                  d3dcompiler_47.dll11
0011223344556677889911223344556677889900  Valid                                  ffmpeg.dll
0011223344556677889911223344556677889900  Valid                                  libEGL.dll
0011223344556677889911223344556677889900  Valid                                  libGLESv2.dll
0011223344556677889911223344556677889900  Valid                                  vk_swiftshader.dll
0011223344556677889911223344556677889900  Valid                                  vulkan-1.dll
                                          NotSigned                              Bar.exe


    Directory: C:\Program Files\WindowsApps\Company.Bar_version_x64__identifier\app\swiftshader


SignerCertificate                         Status                                 Path
-----------------                         ------                                 ----
0011223344556677889911223344556677889900  Valid                                  libEGL.dll
0011223344556677889911223344556677889900  Valid                                  libGLESv2.dll

I'm not sure how to debug this issue, I did not have a lot of success by googling the available error message. The code is being signed by an official certificate that we paid for.

Signed dll doesn't meet the custom 1 signing level requirements or violated code integrity policy

0 Answers