I own a code signing certificate, so I can add digital signatures on files that contain executable code.
Microsoft seems to use a "new" way and provides most digital signatures not in the file itself but in a signature catalog (C:\Windows\System32\catroot
). AFAIK, the lookup in that list is based on a hash value. Therefore, changing the file in any way - even adding another valid signature - will actually result in a removal of the Microsoft signature.
I agree that changing a Microsoft file should result in an invalid signature, but I can't see the benefit of removing a Microsoft signature when the file is signed again by someone else. Although I agree that this will rarely happen.
I see the following disadvantage: given you copy a valid Microsoft executable over to another PC which does not have the catalog (e.g. a newer catalog or older catalog), it will be displayed as unsigned, leaving it up to the one who copied the executable to proof that this is not malware.
When did Microsoft start to use catalogs any especially: why?