Appxmanifest Identity Publisher contains ST=Oregon instead of S=Oregon

Question

I am trying to use the&nbsp;10.0.19041.0 makeappx.exe using a certificate I can not change.&nbsp; The issue is that the publisher subject lines contains ST=Oregon instead of S=Oregon and I get the following error:MakeAppx : error: Error info: error C00CE169: App manifest validation error: The app manifest must be valid as per schema: Line 6, Column 45, Reason: 'C=US, ST=Oregon, L=Portland, O=Acme Inc, CN=Acme Inc' violates pattern constraint of '(CN|L|O|OU|E|C|S|STREET|T|G|I|SN|DC|SERIALNUMBER|Description|PostalCode|POBox|Phone|X21Address|dnQualifier|(OID\.(0|[1-9][0-9]*)(\.(0|[1-9][0-9]*))+))=(([^,+="&lt;&gt;#;])+|".*")(, ((CN|L|O|OU|E|C|S|STREET|T|G|I|SN|DC|SERIALNUMBER|Description|PostalCode|POBox|Phone|X21Address|dnQualifier|(OID\.(0|[1-9][0-9]*)(\.(0|[1-9][0-9]*))+))=(([^,+="&lt;&gt;#;])+|".*")))*'.The attribute 'Publisher' with value 'C=US, ST=Oregon, L=Portland, O=Acme Inc, CN=Acme Inc' failed to parse.If I set S=Oregon it packages fine. However, it then cannot be signed because the subject line in the certificate has ST=Oregon and it doesn't match. Is there a way to get around this other then getting a new certificate created?&nbsp;thanks

tanaka_jimha · Answer

Hi&nbsp;dmondou&nbsp;
&nbsp;
Can you try passing in the /nv flag to MakeAppx when packaging. This should skip semantic validation. You'll have to verify that your package installs successfully after it's created.
&nbsp;
Cheers,
Tanaka
&nbsp;
&nbsp;

dmondou · Answer

Hello&nbsp;Tanaka_Jimha&nbsp;,With the /nv flag it does try to package up the files but then throws the following error:MakeAppx : error: Error info: error C00CE169: App manifest validation error: The app manifest must be valid as per schema: Line 6, Column 45, Reason: 'C=US, ST=Oregon, L=Portland, O=Acme Inc, CN=Acme Inc' violates pattern constraint of '(CN|L|O|OU|E|C|S|STREET|T|G|I|SN|DC|SERIALNUMBER|Description|PostalCode|POBox|Phone|X21Address|dnQualifier|(OID\.(0|[1-9][0-9]*)(\.(0|[1-9][0-9]*))+))=(([^,+="&lt;&gt;#;])+|".*")(, ((CN|L|O|OU|E|C|S|STREET|T|G|I|SN|DC|SERIALNUMBER|Description|PostalCode|POBox|Phone|X21Address|dnQualifier|(OID\.(0|[1-9][0-9]*)(\.(0|[1-9][0-9]*))+))=(([^,+="&lt;&gt;#;])+|".*")))*'.The attribute 'Publisher' with value 'C=US, ST=Oregon, L=Portland, O=Acme Inc, CN=Acme Inc' failed to parse.&nbsp;Without the /nv flag it doesn't try to package anything it just throws the error right away.Thanks,David

marcinotorowski · Answer

dmondou&nbsp;This seems to be a possible bug in regexp validation of makeappx.exe. According to RFC 4519, ST should be a valid token (https://tools.ietf.org/html/rfc4519#section-2.33&nbsp;Now while this does not help with the original problem, here is a weird thing.I tried to test it myself, and tried to first create a test code signing certificate using your subject name. Invoking the following two commands:&nbsp;&nbsp;$certificate = New-SelfSignedCertificate -Type Custom -KeyUsage DigitalSignature -Subject "C=US, ST=Oregon, L=Portland, O=Acme Inc, CN=Acme Inc" -FriendlyName "AcmeTest" -CertStoreLocation 'Cert:\CurrentUser\my';

(Get-ChildItem -path "Cert:\CurrentUser\my" | ? { $_.Subject.IndexOf("Oregon") -ne -1 }).Subject&nbsp;Seems to output:C=US, S=Oregon, L=Portland, O=Acme Inc, CN=Acme Inc&nbsp;The same if you use makecert.exe, ST gets somehow replaced with S. No idea why, but seems to partially explain the choice of the regexp used by makeappx.exe.&nbsp;

dmondou · Answer

Hello&nbsp;@Tanaka_Jimha,Is there an update on this issue? as it is a blocker for us in trying to deploy our app.&nbsp;Thanks,&nbsp;David

dmondou · Answer

Thanks for digging further into this.

Forum Discussion

Appxmanifest Identity Publisher contains ST=Oregon instead of S=Oregon

10 Replies

Resources