Signature should only be considered valid if cert is verified

[cedws]

https://github.com/saferwall/pe/blob/17e522178cedf23638f283fb6f7f467272394721/security.go#L401-L409

As I understand, this code compares the actual Authenticode hash against the hash in the signed message. However, the check is performed independently of certificate validation. Therefore, an unverified certificate chain has no effect, and SignatureValid can still end up being true as long as the hashes match.

I think it would be a good idea to consider the signature valid as long as the certificate chain can be verified to prevent misuse of the API.

signatureValid = signatureValid && certValid

[ayoubfaouzi]

Thanks a lot @cedws, that's a good catch ! I will make a patch soon.

[cedws]

I would suggest using this fork of the pkcs7 library too, it seems to be more maintained: https://github.com/smallstep/pkcs7