Basic MSI: Error 2728.Table definition error:MsiDigitalCertificate

[Holger_G]

I´ve signed my Basic MSI release build as usual (using a valid certificate .pfx file for Setup.exe and the Windows Installer package). That works in the past but not since use of IS2009 SP1.

Error 2728 occurs during installation (Vista only)

[MichaelU]

Does MSI validation provide any leads? If not, could you try a sample project and compare the MsiDigitalCertificate tables (or exports thereof) if the sample works?

[Holger_G]

Michael,

I´ve also opened a support Incident: #SIOA-000126459

MSI validation did not provide any leads but comparing the .msi packages possibly does.

- MsiPackageCertificate table added
- MsiPatchCertificate modified
- and some added entries to the _Validation table

[MichaelU]

Just to clarify, are the differences you show here between a working and a failing package? Or are they between two sample packages built with IS2008 and IS2009 SP1 respectively? I'm confused as the MsiDigitalCertificate table doesn't show any differences, and the other tables with differences just have foreign key references to it.

I forgot to ask earlier, as I assumed you'd done so, but is there anything telling in the verbose MSI log file when the 2728 error is encountered on Vista?

[Holger_G]

MichaelU wrote:
Just to clarify, are the differences you show here between a working and a failing package? Or are they between two sample packages built with IS2008 and IS2009 SP1 respectively? I'm confused as the MsiDigitalCertificate table doesn't show any differences, and the other tables with differences just have foreign key references to it.

Yes, a working package (IS2008) and a failing package (IS2009 or IS2009 migrated from IS2008).

MichaelU wrote:

I forgot to ask earlier, as I assumed you'd done so, but is there anything telling in the verbose MSI log file when the 2728 error is encountered on Vista?

I just found out that the problem occurs only when using Windows Installer 4.5 (redist).

Here are the log entries from a working and failing package:
Failing package (IS2009):
[SIZE="1"]Action start 10:00:09: InstallFiles.
InstallFiles: File: Copying new files, Directory: , Size:
MSI (s) (AC:48) [10:00:09:418]: Note: 1: 2205 2: 3: MsiPatchOldAssemblyFile
MSI (s) (AC:48) [10:00:09:418]: Note: 1: 2228 2: 3: MsiPatchOldAssemblyFile 4: SELECT `MsiPatchOldAssemblyFile`.`Assembly_` FROM `MsiPatchOldAssemblyFile` WHERE `MsiPatchOldAssemblyFile`.`File_` = ?
MSI (s) (AC:48) [10:00:09:418]: Note: 1: 2205 2: 3: MsiSFCBypass
MSI (s) (AC:48) [10:00:09:418]: Note: 1: 2228 2: 3: MsiSFCBypass 4: SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ?
MSI (s) (AC:48) [10:00:09:418]: Note: 1: 2205 2: 3: MsiPatchHeaders
MSI (s) (AC:48) [10:00:09:418]: Note: 1: 2228 2: 3: MsiPatchHeaders 4: SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ?
MSI (s) (AC:48) [10:00:09:418]: Note: 1: 2263 2: MsiDigitalCertificate.ReleaseCertificate1 3: -2147287035
MSI (s) (AC:48) [10:00:09:418]: Note: 1: 2728 2: MsiDigitalCertificate
Error 2728.Table definition error: MsiDigitalCertificate
MSI (s) (AC:48) [10:00:10:593]: Product: My Project Name-5 -- Error 2728.Table definition error: MsiDigitalCertificate

Action ended 10:00:10: InstallFiles. Return value 3.[/SIZE]

Working package (IS2009):
[SIZE="1"]InstallFiles: File: Copying new files, Directory: , Size:
MSI (s) (AC:94) [10:02:20:486]: Note: 1: 2235 2: 3: StreamRef_ 4: SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence`
MSI (s) (AC:94) [10:02:20:486]: Note: 1: 2205 2: 3: MsiPatchOldAssemblyFile
MSI (s) (AC:94) [10:02:20:486]: Note: 1: 2228 2: 3: MsiPatchOldAssemblyFile 4: SELECT `MsiPatchOldAssemblyFile`.`Assembly_` FROM `MsiPatchOldAssemblyFile` WHERE `MsiPatchOldAssemblyFile`.`File_` = ?
MSI (s) (AC:94) [10:02:20:486]: Note: 1: 2205 2: 3: MsiSFCBypass
MSI (s) (AC:94) [10:02:20:486]: Note: 1: 2228 2: 3: MsiSFCBypass 4: SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ?
MSI (s) (AC:94) [10:02:20:486]: Note: 1: 2205 2: 3: MsiPatchHeaders
MSI (s) (AC:94) [10:02:20:486]: Note: 1: 2228 2: 3: MsiPatchHeaders 4: SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ?
MSI (s) (AC:94) [10:02:20:502]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (AC:94) [10:02:20:502]: Note: 1: 2205 2: 3: MsiPatchHeaders
MSI (s) (AC:94) [10:02:20:502]: Note: 1: 2205 2: 3: PatchPackage
Action ended 10:02:20: InstallFiles. Return value 1.[/SIZE]

[MichaelU]

Access Denied trying to open the stream of the certificate thumbprint? Weird. Since you mention the MSI 4.5 redist, has the machine been rebooted since the redist was laid down? (You said this is on Vista, so I assume so, but just making sure.) I wasn't able to reproduce this using a simple notepad project signed with a test certificate on either Windows Vista (RTM) or Windows Server 2008; are there any other steps you can suggest?

[Holger_G]

MichaelU wrote:
Access Denied trying to open the stream of the certificate thumbprint? Weird. Since you mention the MSI 4.5 redist, has the machine been rebooted since the redist was laid down? (You said this is on Vista, so I assume so, but just making sure.) I wasn't able to reproduce this using a simple notepad project signed with a test certificate on either Windows Vista (RTM) or Windows Server 2008; are there any other steps you can suggest?

Michael, OS was rebootet after installation of MSI 4.5.

I´ve also created a simple Notepad project. I´ve signed the package using different certificates (single .pfx or .spc & .pvk) but neither of them works.

[Holger_G]

I found out something more....

It depends on the selected Media Type. My project uses 'Custom' media type.
Here is what I found out:

Media Type:
CD-ROM: failed
Custom: failed
DVD: failed
Network Image: OK
Web: OK

'Network Image' is the default setting for a new Basic MSI project, could that be the reason why you are not able to reproduce the problem?

-Holger

[MichaelU]

Thanks, that did the trick. We've now reproduced it and have raised the issue with Microsoft.

[Holger_G]

MichaelU wrote:
Thanks, that did the trick. We've now reproduced it and have raised the issue with Microsoft.

Michael, any feedback from MS yet?

[MichaelU]

Yes, we've received some feedback with a suggested workaround, and are implementing it on our side for what appears to be a problem on Windows Installer's side. If you want to test other things early, the easiest workaround until we offer one would be to create and run with a transform which drops the row from the MsiPackageCertificate table which references ReleaseCertificate1.

[MichaelU]

Here's an updated ISWIBuild.dll which should prevent this error from occurring. You can use the contents to replace your ISWIBuild.dll on either IDE or SAB machines, but please back up your current one. The difference is a slight change in how the DigitalCertificate related tables are populated related to the workaround I mentioned above.

[Holger_G]

Michael, thanks for posting a fix for testing. Hope that Acresso will release an official fix asap.

[Holger_G]

Official hotfix Q200162 released:
http://kb.acresso.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=Q200162