LIEF/tests/pe/test_authenticode.py

import json
import sys
from typing import cast

import lief
import pytest
from utils import get_sample, parse_pe

try:
    sys.set_int_max_str_digits(0)
except Exception:  # pragma: no cover # noqa
    pass


def from_hex(x):
    return bytes.fromhex(x.replace(":", ""))


def int_from_bytes(x):
    return int.from_bytes(x, byteorder="little")


def test_api():
    avast = parse_pe("PE/PE32_x86-64_binary_avast-free-antivirus-setup-online.exe")

    assert avast.authentihash(lief.PE.ALGORITHMS.MD5) == from_hex(
        "1c:a0:91:53:dc:9a:3a:5f:34:1d:7f:9b:b9:56:69:4d"
    )
    assert avast.authentihash(lief.PE.ALGORITHMS.MD5) == avast.authentihash_md5

    assert avast.authentihash(lief.PE.ALGORITHMS.SHA_1) == from_hex(
        "1e:ad:dc:29:1e:db:41:a2:69:c2:ba:ae:4b:fb:9d:31:e7:bb:ab:59"
    )
    assert avast.authentihash(lief.PE.ALGORITHMS.SHA_1) == avast.authentihash_sha1

    assert avast.authentihash(lief.PE.ALGORITHMS.SHA_256) == from_hex(
        "a7:38:da:44:46:a4:e7:8a:b6:47:db:7e:53:42:7e:b0:79:61:c9:94:31:7f:4c:59:d7:ed:be:a5:cc:78:6d:80"
    )
    assert avast.authentihash(lief.PE.ALGORITHMS.SHA_256) == avast.authentihash_sha256

    assert avast.authentihash(lief.PE.ALGORITHMS.SHA_512) == from_hex(
        "2a:e7:4c:81:0d:65:7b:6a:49:48:94:ab:b9:7d:fa:03:18:5d:48:cf:cd:4e:c2:99:f6:49:5f:db:30:64:78:03:f6:60:90:ab:04:84:01:36:7e:b0:6e:f6:29:b1:d1:a8:49:51:c3:4e:b3:75:89:c9:74:62:a2:2e:d2:ac:6e:96"
    )
    assert avast.authentihash(lief.PE.ALGORITHMS.SHA_512) == avast.authentihash_sha512

    assert len(avast.signatures) == 1
    sig = avast.signatures[0]

    assert sig.version == 1
    assert sig.digest_algorithm == lief.PE.ALGORITHMS.SHA_256

    # Verify ContentInfo
    content_info = sig.content_info
    spc_indirect_data = content_info.value
    assert isinstance(spc_indirect_data, lief.PE.SpcIndirectData)

    assert content_info.content_type == "1.3.6.1.4.1.311.2.1.4"
    assert content_info.digest == bytes(spc_indirect_data.digest)
    assert content_info.digest_algorithm == spc_indirect_data.digest_algorithm
    assert spc_indirect_data.digest_algorithm == lief.PE.ALGORITHMS.SHA_256
    assert spc_indirect_data.digest == from_hex(
        "a7:38:da:44:46:a4:e7:8a:b6:47:db:7e:53:42:7e:b0:79:61:c9:94:31:7f:4c:59:d7:ed:be:a5:cc:78:6d:80"
    )

    # Verify embedded certificates
    certs = sig.certificates
    assert len(certs) == 2
    cert_ca, cert_signer = certs

    assert cert_ca.version == 3
    assert cert_ca.serial_number == from_hex(
        "04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08"
    )
    assert cert_ca.signature_algorithm == "1.2.840.113549.1.1.11"
    assert cert_ca.valid_from == [2013, 10, 22, 12, 0, 0]
    assert cert_ca.valid_to == [2028, 10, 22, 12, 0, 0]
    assert (
        cert_ca.issuer
        == "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA"
    )
    assert (
        cert_ca.subject
        == "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA"
    )

    assert cert_signer.version == 3
    assert cert_signer.serial_number == from_hex(
        "09:70:EF:4B:AD:5C:C4:4A:1C:2B:C3:D9:64:01:67:4C"
    )
    assert cert_signer.signature_algorithm == "1.2.840.113549.1.1.11"
    assert cert_signer.valid_from == [2020, 4, 2, 0, 0, 0]
    assert cert_signer.valid_to == [2023, 3, 9, 12, 0, 0]
    assert (
        cert_signer.issuer
        == "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA"
    )
    assert (
        cert_signer.subject
        == "C=CZ, L=Praha, O=Avast Software s.r.o., OU=RE stapler cistodc, CN=Avast Software s.r.o."
    )

    assert (
        cert_ca.verify(cert_signer) == lief.PE.x509.VERIFICATION_FLAGS.BADCERT_EXPIRED
    )
    assert (
        cert_ca.verify(cert_ca) == lief.PE.x509.VERIFICATION_FLAGS.BADCERT_NOT_TRUSTED
    )
    assert (
        cert_signer.is_trusted_by([cert_ca])
        == lief.PE.x509.VERIFICATION_FLAGS.BADCERT_EXPIRED
    )

    ca_bundles = lief.PE.x509.parse(get_sample("pkcs7/windows-ca-bundle.pem"))
    assert cert_ca.is_trusted_by(ca_bundles) == lief.PE.x509.VERIFICATION_FLAGS.OK

    # Verify signer(s)
    assert len(sig.signers) == 1
    signer = sig.signers[0]

    assert signer.version == 1
    assert signer.serial_number == from_hex(
        "09:70:ef:4b:ad:5c:c4:4a:1c:2b:c3:d9:64:01:67:4c"
    )
    assert (
        signer.issuer
        == "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA"
    )
    assert signer.digest_algorithm == lief.PE.ALGORITHMS.SHA_256
    assert signer.encryption_algorithm == lief.PE.ALGORITHMS.RSA
    assert signer.encrypted_digest.hex()[:16] == "758db1f480eb25ba"
    assert hash(signer.cert) == hash(cert_signer)

    # Check authenticated attributes
    auth_attrs = signer.authenticated_attributes
    assert len(auth_attrs) == 4

    content_type = auth_attrs[0]
    assert isinstance(content_type, lief.PE.ContentType)
    assert content_type.oid == "1.3.6.1.4.1.311.2.1.4"

    ms_spc_statement_type = auth_attrs[1]
    assert isinstance(ms_spc_statement_type, lief.PE.MsSpcStatementType)
    assert ms_spc_statement_type.oid == "1.3.6.1.4.1.311.2.1.21"

    spc_spopus_info = auth_attrs[2]
    assert isinstance(spc_spopus_info, lief.PE.SpcSpOpusInfo)
    assert spc_spopus_info.program_name == ""
    assert spc_spopus_info.more_info == "http://www.avast.com"

    pkcs9_message_digest = auth_attrs[3]
    assert isinstance(pkcs9_message_digest, lief.PE.PKCS9MessageDigest)
    assert pkcs9_message_digest.digest == from_hex(
        "39:83:81:6a:7d:1c:62:96:25:40:ec:66:fa:87:90:fa:45:d1:06:3c:b2:3e:93:36:77:de:45:9f:0b:73:c5:77"
    )

    # Check unauthenticated attributes
    unauth_attrs = signer.unauthenticated_attributes
    assert len(unauth_attrs) == 1

    ms_counter_sig = unauth_attrs[0]
    assert isinstance(ms_counter_sig, lief.PE.MsCounterSign)

    assert avast.verify_signature() == lief.PE.Signature.VERIFICATION_FLAGS.OK
    # Verify the signature through a fake-detached signature
    pkcs7_sig = lief.PE.Signature.parse(list(sig.raw_der))
    assert pkcs7_sig is not None
    assert avast.verify_signature(pkcs7_sig) == lief.PE.Signature.VERIFICATION_FLAGS.OK


def test_json_serialization():
    avast = parse_pe("PE/PE32_x86-64_binary_avast-free-antivirus-setup-online.exe")
    with open(
        get_sample(
            "PE/PE32_x86-64_binary_avast-free-antivirus-setup-online-signature.json"
        ),
        "rb",
    ) as f:
        json_sig = json.load(f)
    lief.logging.info(lief.to_json(avast.signatures[0]))
    assert json.loads(lief.to_json(avast.signatures[0])) == json_sig


def test_fail():
    # Check bad-signed PE files
    avast_altered = parse_pe(
        "PE/PE32_x86-64_binary_avast-free-antivirus-setup-online-altered-dos-stub.exe"
    )
    assert avast_altered.verify_signature() != lief.PE.Signature.VERIFICATION_FLAGS.OK
    assert (
        avast_altered.signatures[0].check() == lief.PE.Signature.VERIFICATION_FLAGS.OK
    )

    avast_altered = parse_pe(
        "PE/PE32_x86-64_binary_avast-free-antivirus-setup-online-altered-encrypted-digest.exe"
    )
    assert avast_altered.verify_signature() != lief.PE.Signature.VERIFICATION_FLAGS.OK
    assert (
        avast_altered.signatures[0].check() != lief.PE.Signature.VERIFICATION_FLAGS.OK
    )

    avast_altered = parse_pe(
        "PE/PE32_x86-64_binary_avast-free-antivirus-setup-online-altered-content-info-digest.exe"
    )
    assert avast_altered.verify_signature() != lief.PE.Signature.VERIFICATION_FLAGS.OK
    assert (
        avast_altered.signatures[0].check() != lief.PE.Signature.VERIFICATION_FLAGS.OK
    )

    avast_altered = parse_pe(
        "PE/PE32_x86-64_binary_avast-free-antivirus-setup-online-altered-pkcs9-msg-digest.exe"
    )
    assert avast_altered.verify_signature() != lief.PE.Signature.VERIFICATION_FLAGS.OK
    assert (
        avast_altered.signatures[0].check() != lief.PE.Signature.VERIFICATION_FLAGS.OK
    )


def test_pkcs9_signing_time():
    sig = lief.PE.Signature.parse(get_sample("pkcs7/cert0.p7b"))
    assert sig is not None
    attr = sig.signers[0].get_attribute(lief.PE.Attribute.TYPE.PKCS9_SIGNING_TIME)
    assert attr is not None
    assert isinstance(attr, lief.PE.PKCS9SigningTime)
    assert attr.time == [2018, 8, 2, 15, 0, 12]


def test_pkcs9_at_sequence_number():
    sig = lief.PE.Signature.parse(get_sample("pkcs7/cert3.p7b"))
    assert sig is not None
    nested_sig_attr = sig.signers[0].get_attribute(
        lief.PE.Attribute.TYPE.MS_SPC_NESTED_SIGN
    )
    assert nested_sig_attr is not None
    assert isinstance(nested_sig_attr, lief.PE.MsSpcNestedSignature)
    nested_sig = nested_sig_attr.signature
    at_seq_nb = nested_sig.signers[0].get_attribute(
        lief.PE.Attribute.TYPE.PKCS9_AT_SEQUENCE_NUMBER
    )
    assert at_seq_nb is not None
    assert isinstance(at_seq_nb, lief.PE.PKCS9AtSequenceNumber)
    assert at_seq_nb.number == 1


def test_spc_sp_opus_info():
    sig = lief.PE.Signature.parse(get_sample("pkcs7/cert11.p7b"))
    assert sig is not None
    spc = sig.signers[0].get_attribute(lief.PE.Attribute.TYPE.SPC_SP_OPUS_INFO)
    assert spc is not None
    assert isinstance(spc, lief.PE.SpcSpOpusInfo)

    assert spc.program_name == "Slideshow Generator Powertoy for WinXP"
    assert spc.more_info == "http://www.microsoft.com/windowsxp"

    sig = lief.PE.Signature.parse(get_sample("pkcs7/cert9.p7b"))
    assert sig is not None
    spc = sig.signers[0].get_attribute(lief.PE.Attribute.TYPE.SPC_SP_OPUS_INFO)
    assert spc is not None
    assert isinstance(spc, lief.PE.SpcSpOpusInfo)
    assert spc.program_name == "Microsoft Windows"
    assert spc.more_info == "http://www.microsoft.com/windows"


def test_pkcs9_counter_signature():
    sig = lief.PE.Signature.parse(get_sample("pkcs7/cert10.p7b"))
    assert sig is not None
    counter_sign = sig.signers[0].get_attribute(
        lief.PE.Attribute.TYPE.PKCS9_COUNTER_SIGNATURE
    )
    assert counter_sign is not None
    assert isinstance(counter_sign, lief.PE.PKCS9CounterSignature)

    signer = counter_sign.signer

    assert signer.version == 1
    assert signer.serial_number == from_hex(
        "0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50"
    )
    assert (
        signer.issuer
        == "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA - G2"
    )
    assert signer.digest_algorithm == lief.PE.ALGORITHMS.SHA_1
    assert signer.encryption_algorithm == lief.PE.ALGORITHMS.RSA
    assert signer.encrypted_digest.hex()[:30] == "92db1faf4b20293109bcddbb6ed7a3"
    assert len(signer.authenticated_attributes) == 3
    assert len(signer.unauthenticated_attributes) == 0

    content_type, sig_time, msg_digest = signer.authenticated_attributes
    assert isinstance(content_type, lief.PE.ContentType)
    assert isinstance(sig_time, lief.PE.PKCS9SigningTime)
    assert isinstance(msg_digest, lief.PE.PKCS9MessageDigest)
    assert content_type.oid == "1.2.840.113549.1.7.1"
    assert sig_time.time == [2018, 7, 25, 18, 14, 50]
    assert msg_digest.digest == from_hex(
        "05:ca:7d:34:f0:ef:c2:70:33:4c:f9:90:77:a5:bc:86:6e:46:be:45"
    )


def test_ms_spc_nested_signature():
    sig = lief.PE.Signature.parse(get_sample("pkcs7/cert0.p7b"))
    assert sig is not None
    attr = sig.signers[0].get_attribute(lief.PE.Attribute.TYPE.MS_SPC_NESTED_SIGN)
    assert attr is not None
    assert isinstance(attr, lief.PE.MsSpcNestedSignature)
    nested_sig = attr.signature

    assert nested_sig.version == 1
    assert nested_sig.digest_algorithm == lief.PE.ALGORITHMS.SHA_256

    content_info = nested_sig.content_info
    spc_indirect_data = content_info.value
    assert isinstance(spc_indirect_data, lief.PE.SpcIndirectData)
    lief.logging.info(spc_indirect_data)

    assert spc_indirect_data.content_type == "1.3.6.1.4.1.311.2.1.4"
    assert spc_indirect_data.digest_algorithm == lief.PE.ALGORITHMS.SHA_256
    assert spc_indirect_data.digest == from_hex(
        "90:a4:df:36:26:df:d9:8d:6b:3b:1d:42:74:5b:94:54:c5:e2:30:2e:d2:f8:23:70:16:3f:1e:e6:dd:7d:8c:91"
    )

    certs = nested_sig.certificates
    assert len(certs) == 3
    nvidia_cert, self_signed_ca, signer_cert = certs

    assert (
        nvidia_cert.issuer
        == "C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA - G2"
    )
    assert (
        nvidia_cert.subject
        == "C=US, ST=California, L=Santa Clara, O=NVIDIA Corporation, OU=IT-MIS, CN=NVIDIA Corporation"
    )
    assert nvidia_cert.serial_number == from_hex(
        "62:E7:45:E9:21:65:21:3C:97:1F:5C:49:0A:EA:12:A5"
    )

    assert (
        self_signed_ca.issuer
        == r"C=US, O=VeriSign\, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign\, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority"
    )
    assert (
        self_signed_ca.subject
        == r"C=US, O=VeriSign\, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign\, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority"
    )
    assert self_signed_ca.serial_number == from_hex(
        "40:1A:C4:64:21:B3:13:21:03:0E:BB:E4:12:1A:C5:1D"
    )

    assert (
        signer_cert.issuer
        == r"C=US, O=VeriSign\, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign\, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority"
    )
    assert (
        signer_cert.subject
        == "C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA - G2"
    )
    assert signer_cert.serial_number == from_hex(
        "7C:1B:35:35:4A:E7:DB:74:E7:41:5F:11:69:CA:6B:A8"
    )

    # Check self-signed
    assert self_signed_ca.verify(self_signed_ca) == lief.PE.x509.VERIFICATION_FLAGS.OK
    assert (
        signer_cert.is_trusted_by([self_signed_ca])
        == lief.PE.x509.VERIFICATION_FLAGS.BADCERT_EXPIRED
    )
    assert (
        self_signed_ca.verify(signer_cert)
        == lief.PE.x509.VERIFICATION_FLAGS.BADCERT_EXPIRED
    )
    assert (
        signer_cert.verify(nvidia_cert)
        == lief.PE.x509.VERIFICATION_FLAGS.BADCERT_EXPIRED
    )

    ca_bundles = lief.PE.x509.parse(get_sample("pkcs7/windows-ca-bundle.pem"))
    assert (
        self_signed_ca.is_trusted_by(ca_bundles) == lief.PE.x509.VERIFICATION_FLAGS.OK
    )
    assert (
        nvidia_cert.is_trusted_by(ca_bundles)
        == lief.PE.x509.VERIFICATION_FLAGS.BADCERT_NOT_TRUSTED
        | lief.PE.x509.VERIFICATION_FLAGS.BADCERT_EXPIRED
    )

    assert nested_sig.check() == lief.PE.Signature.VERIFICATION_FLAGS.OK

    signer = nested_sig.signers[0]
    lief.logging.info(signer)


def test_self_signed():
    selfsigned = parse_pe("PE/PE32_x86-64_binary_self-signed.exe")
    sig = selfsigned.signatures[0]
    ca_bundles = lief.PE.x509.parse(get_sample("pkcs7/windows-ca-bundle.pem"))
    cert_ca, cert_signer = sig.certificates
    assert cert_ca.verify(cert_signer) == lief.PE.x509.VERIFICATION_FLAGS.OK
    assert (
        cert_ca.is_trusted_by(ca_bundles)
        == lief.PE.x509.VERIFICATION_FLAGS.BADCERT_NOT_TRUSTED
    )


def test_rsa_info():
    avast = parse_pe("PE/PE32_x86-64_binary_avast-free-antivirus-setup-online.exe")
    cert_ca, _cert_signer = avast.signatures[0].certificates
    assert cert_ca.key_type == lief.PE.x509.KEY_TYPES.RSA
    rsa_info = cert_ca.rsa_info
    assert rsa_info is not None
    assert rsa_info.key_size == 2048
    assert rsa_info.has_public_key
    assert not rsa_info.has_private_key

    N = int_from_bytes(rsa_info.N)
    E = int_from_bytes(rsa_info.E)
    D = int_from_bytes(rsa_info.D)
    P = int_from_bytes(rsa_info.P)
    Q = int_from_bytes(rsa_info.Q)

    assert E == 65537
    assert (
        str(N)[:70]
        == "2645636708930440977121533117630461323983500317859148049010916849328467"
    )
    assert D == 0
    assert P == 0
    assert Q == 0


@pytest.mark.parametrize("name", ["Amazon Root CA 3", "Amazon Root CA 4"])
def test_ec_certificate(name):
    certs = lief.PE.x509.parse(get_sample("pkcs7/windows-ca-bundle.pem"))
    cert = next(c for c in certs if c.subject == f"C=US, O=Amazon, CN={name}")

    assert cert.key_type == lief.PE.x509.KEY_TYPES.ECKEY
    assert cert.rsa_info is None
    assert cert.verify(cert) == lief.PE.x509.VERIFICATION_FLAGS.OK


def test_issue_703():
    sig = lief.PE.Signature.parse(get_sample("pkcs7/cert_issue_703.der"))
    assert sig is not None
    assert sig.certificates[0].issuer == "CN=TxExoTiQueMoDz\\\\Tx ExoTiQueMoDz"
    assert sig.certificates[0].subject == "CN=TxExoTiQueMoDz\\\\Tx ExoTiQueMoDz"


def test_issue_912():
    steam = parse_pe("PE/steam.exe")
    assert steam.verify_signature() == lief.PE.Signature.VERIFICATION_FLAGS.OK


def test_verification_flags_str():
    flag = (
        lief.PE.Signature.VERIFICATION_FLAGS.BAD_DIGEST
        | lief.PE.Signature.VERIFICATION_FLAGS.CERT_FUTURE
    )
    assert str(flag) in {
        "VERIFICATION_FLAGS.BAD_DIGEST|CERT_FUTURE",
        "VERIFICATION_FLAGS.CERT_FUTURE|BAD_DIGEST",
    }
    assert repr(flag) in {
        "VERIFICATION_FLAGS.BAD_DIGEST|CERT_FUTURE",
        "VERIFICATION_FLAGS.CERT_FUTURE|BAD_DIGEST",
    }
    assert (
        str(lief.PE.Signature.VERIFICATION_FLAGS.from_value(0))
        == "VERIFICATION_FLAGS.OK"
    )


def test_ms_manifest_binary_id():
    acres = parse_pe("PE/AcRes.dll")
    attr = (
        acres.signatures[0]
        .signers[0]
        .get_auth_attribute(lief.PE.Attribute.TYPE.MS_PLATFORM_MANIFEST_BINARY_ID)
    )
    assert attr is not None
    assert isinstance(attr, lief.PE.MsManifestBinaryID)
    assert attr.manifest_id == "Q3XarTZK62/v5aPftDNzWYB5ybbMDvHGQIYjVa+ja+0="


def test_ms_counter_signature():
    acres = parse_pe("PE/AppVClient.exe")
    sig = acres.signatures[0]
    _ms_counter_sig = sig.signers[0].get_unauth_attribute(
        lief.PE.Attribute.TYPE.MS_COUNTER_SIGN
    )
    assert _ms_counter_sig is not None
    ms_counter_sig = cast(lief.PE.MsCounterSign, _ms_counter_sig)
    assert ms_counter_sig.version == 3
    assert ms_counter_sig.digest_algorithm == lief.PE.ALGORITHMS.SHA_256

    content_info = ms_counter_sig.content_info
    assert content_info.digest_algorithm == lief.PE.ALGORITHMS.UNKNOWN
    assert content_info.content_type == "1.2.840.113549.1.9.16.1.4"

    content_info_value = content_info.value
    assert isinstance(content_info_value, lief.PE.PKCS9TSTInfo)

    certs = list(ms_counter_sig.certificates)

    assert len(certs) == 2
    assert (
        certs[0].issuer
        == "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA 2010"
    )
    assert (
        certs[1].issuer
        == "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010"
    )

    signers = list(ms_counter_sig.signers)
    assert len(signers) == 1

    signer = signers[0]
    assert signer.version == 1
    assert signer.digest_algorithm == lief.PE.ALGORITHMS.SHA_256
    assert signer.encryption_algorithm == lief.PE.ALGORITHMS.SHA_256_RSA
    assert (
        signer.issuer
        == "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA 2010"
    )
    assert (
        ":".join(f"{e:02x}" for e in signer.serial_number)
        == "33:00:00:01:b7:21:27:1a:07:a2:2a:86:46:00:01:00:00:01:b7"
    )

    auth_attrs = signer.authenticated_attributes
    assert len(auth_attrs) == 3
    assert auth_attrs[0].type == lief.PE.Attribute.TYPE.CONTENT_TYPE
    assert auth_attrs[1].type == lief.PE.Attribute.TYPE.PKCS9_MESSAGE_DIGEST
    assert auth_attrs[2].type == lief.PE.Attribute.TYPE.SIGNING_CERTIFICATE_V2
    assert isinstance(auth_attrs[2], lief.PE.SigningCertificateV2)

    unauth_attrs = signer.unauthenticated_attributes
    assert len(unauth_attrs) == 0


@pytest.mark.private
def test_playready_signature():
    pe = parse_pe("private/PE/Windows.Media.Protection.PlayReady.dll")

    sig = pe.signatures[0]
    spc = sig.signers[0].get_auth_attribute(
        lief.PE.Attribute.TYPE.SPC_RELAXED_PE_MARKER_CHECK
    )
    assert spc is not None


def test_pkcs1_15_padding():
    pe = parse_pe("PE/jar.exe")
    assert pe.signatures[0].check() == lief.PE.Signature.VERIFICATION_FLAGS.OK


def test_font_signature():
    sig = lief.PE.Signature.parse(get_sample("pkcs7/pr_1153.p7b"))
    assert sig is not None
    value = sig.content_info.value
    assert isinstance(value, lief.PE.SpcIndirectData)
    assert (
        value.url
        == "\x00<\x00<\x00<\x00O\x00b\x00s\x00o\x00l\x00e\x00t\x00e\x00>\x00>\x00>"
    )
    attr = sig.signers[0].authenticated_attributes[4]
    assert isinstance(attr, lief.PE.SpcSpOpusInfo)
    assert attr.program_name == "this is a test"
    assert attr.more_info == "Monotype"

    sig = lief.PE.Signature.parse(get_sample("pkcs7/consolab.p7b"))
    assert sig is not None
    value = sig.content_info.value
    assert isinstance(value, lief.PE.SpcIndirectData)
    assert (
        value.url
        == "\x00<\x00<\x00<\x00O\x00b\x00s\x00o\x00l\x00e\x00t\x00e\x00>\x00>\x00>"
    )
    attr = sig.signers[0].authenticated_attributes[3]
    assert isinstance(attr, lief.PE.SpcSpOpusInfo)
    assert attr.program_name == "Microsoft Typography"
    assert attr.more_info == "http://www.microsoft.com/Typography "


def test_issue_1219():
    pe = parse_pe(
        "PE/issue_1219_be5d6c4aa4b27548a06c2afaef3b4035abf65566e9a8bfd642b4a2032729656e.exe_MALWARE"
    )
    cert = pe.signatures[0].signers[0].cert
    assert cert is not None
    assert "JURISDICTION_OF_INCORPORATION_C=CN" in str(cert.subject)