signtool: options interpreted as files on AppVeyor

Question

I'm having this super weird behaviour on an AppVeyor build (Visual Studio 2019): In a shell script (cmd.exe), when signing my app with signtool , all the options are interpreted as files ( signtool can sign multiple files at once).

The line "$WINDOWSKITBIN\\\\signtool.exe" sign /tr http://timestamp.digicert.com /td sha256 /fd SHA256 /n "Jan Gerner" /v /debug "build\\\\TypeWorld.exe" produces:

Successfully signed: build\TypeWorld.exe
Number of files successfully Signed: 1
Number of errors: 10
SignTool Error: File not found: C:/Program Files/Git/tr
SignTool Error: File not found: http://timestamp.digicert.com
SignTool Error: File not found: C:/Program Files/Git/td
SignTool Error: File not found: sha256
SignTool Error: File not found: C:/Program Files/Git/fd
SignTool Error: File not found: SHA256
SignTool Error: File not found: N:/
SignTool Error: File not found: Jan Gerner
SignTool Error: File not found: V:/
SignTool Error: File not found: C:/Program Files/Git/debug

The wanted file TypeWorld.exe is signed, just without all the options, and all the options are interpreted as files to sign which then aren't found, obviously.

I've confirmed the escaped backslashes and folder variable to be correct.

This line echo "$WINDOWSKITBIN\\\\signtool.exe" sign /tr http://timestamp.digicert.com /td sha256 /fd SHA256 /n "Jan Gerner" /v /debug "build\\\\TypeWorld.exe"

produces the expected rendering: C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.19041.0\\x86\\signtool.exe sign /tr http://timestamp.digicert.com /td sha256 /fd SHA256 /n Jan Gerner /v /debug build\\TypeWorld.exe

I tried running the same in PowerShell, to same result.

Answer 1

None of what the AppVeyor staff recommended (also by email) helped.

What did help in the end is to not mix Windows and Linux (WSL) environments. In appveyor.yml I was calling the build script through sh (or later bash at the recommendation of AppVeyor staff):

build_script: 
    - cmd: C:\\msys64\\usr\\bin\\bash.exe wxPython/build/Windows/build-all.sh

Instead, for some commands it's better to keep things simple, so I converted the code signing part to a good old Windows batch file:

build_script: 
    - wxPython/build/Windows/build-sign.bat

Inside the batch file, the line signtool.exe sign /tr http://timestamp.digicert.com /td sha256 /fd SHA256 /n "Jan Gerner" /v "build\\\\TypeWorld.exe" executes fine.