msix code signature cannot be verified

Author: rglCreated Aug 1, 2026Updated Sep 5, 2026

Labelsbug

I'm trying to generate a signed msix at https://github.com/rgl/example-go-windows-app/releases/tag/v0.0.0-dev1 but it seems its signature cannot be verified.

Here's how it behaves, in a Windows PowerShell session, execute:

powershell

curl.exe -sOL https://github.com/rgl/example-go-windows-app/releases/download/v0.0.0-dev1/example-code-signing-ca-crt.pem
curl.exe -sOL https://github.com/rgl/example-go-windows-app/releases/download/v0.0.0-dev1/example-go-windows-app_0.0.0-dev1_windows_amd64v3.msix
Import-Certificate example-code-signing-ca-crt.pem -CertStoreLocation Cert:/LocalMachine/Root
Get-AuthenticodeSignature *.msix | Format-List

And this ends up showing:

bash

SignerCertificate      : [Subject]
                           CN=example.com

                         [Issuer]
                           CN=Example Code Signing CA

                         [Serial Number]
                           19143F3A74F0C81EEE54EB1FE2DCAFE4D353937D

                         [Not Before]
                           01/08/2026 20:40:44

                         [Not After]
                           01/08/2027 20:40:44

                         [Thumbprint]
                           E7B70BB26080ECFAECA43BA1806D79B35C0C1FB2

TimeStamperCertificate :
Status                 : HashMismatch
StatusMessage          : The contents of file C:\Users\Administrator\tmp\example-go-windows-app_0.0.0-dev1_windows_amd64v3.msix might have been changed by an unauthorized user or
                         process, because the hash of the file does not match the hash stored in the digital signature. The script cannot run on the specified system. For more
                         information, run Get-Help about_Signing.
Path                   : C:\Users\Administrator\tmp\example-go-windows-app_0.0.0-dev1_windows_amd64v3.msix
SignatureType          : Authenticode
IsOSBinary             : False

Can you please help me understand why this is failing?

Source: goreleaser/goreleaser

View original on GitHub View discussion on GitHub