Notepad++ v8.8.4 Release Candidate

donho

@xomx said in Notepad++ v8.8.4 Release Candidate:

I found the culprit of the issue - you forgot to sign also the NppShell.msix (in the latest installer) with your new cert.

~~In v8.8.3, NppShell.msix is not signed either, because of signing error for unknown reason.~~

do not have

OK, no problem. We can use the ones of v8.8.3 for the release v8.8.4.

Edit: I just realized the fact of not signing NppShell.msix again keeps its old validate signature of old certificate - it could be the cause indeed. So NppShell.msix is not signed COULD BE the problem. The thing is, even there’s no signing problem with the self-signed certificate on NppShell.msix, I wonder if the system tolerates it.

Edit2: For x32, NppShell.msix is not necessary. So that doesn’t explain why x86 version doesn’t work.

xomx

@donho said in Notepad++ v8.8.4 Release Candidate:

NppShell.msix is not signed COULD BE the problem.

IT IS the problem.

For sparse packages registering, only the msix-file (with a valid sign) is important (I tried/debugged - one can have the NppShell.dll unsigned but if the NppShell.msix is signed according to its corresponding xml manifest (CN=“Notepad++”, O=“Notepad++”, L=Saint Cloud, S=Ile-de-France, C=FR), the new N++ Win11 context menu gets registered & works ok).

@donho said in Notepad++ v8.8.4 Release Candidate:

send them to me (don.h@free.fr ) for some test from my side

I sent you binaries of my x64 Debug build of the current NppShell master, signed by my fake N++ self-signing cert created. I tested them on my Win11 ok - new context menu works as it should.

No time yet for the x86 tests, sorry.

Edit: Please ignore (click on the OK btn) the debugger attaching point of my NppShell.dll binary sent:

Ekopalypse

It looks like 8.8.2 is the last version that allows a portable version to use the plugin admin to install plugins, or am I the only one having this problem? With the newer versions you still see the dialog that Npp needs to be restarted but the restart or installation of the plugin does not take place.

PeterJones

@Ekopalypse said in Notepad++ v8.8.4 Release Candidate:

am I the only one having this problem?

I concur. I saw it yesterday with DSpellCheck on 8.8.3, but thought it was just that one plugin, and didn’t look into it more deeply. I confirmed today with 8.8.3 portable and 8.8.4-RC portable that I cannot get DSpellCheck or ConfigUpdater or CollectionInterface plugins to install through Plugins Admin. (And confirmed that v8.8.2 portable is able to install plugins using Plugins Admin)

Looks like a regression in v8.8.3 that wasn’t noticed.

Ekopalypse

@PeterJones

its blocked

unblocking it solves it.

PeterJones

@Ekopalypse said in Notepad++ v8.8.4 Release Candidate:

unblocking it solves it.

Confirmed.

For future readers: you can also unblock the zipfile before unzipping, then none of the executables will be marked as “blocked” when they are extracted.

xomx

@donho said in Notepad++ v8.8.4 Release Candidate:

NppShell.msix is not signed either, because of signing error for unknown reason.

Probably because of:

donho

@xomx
It should match certificate’s Subject, not Issuer. (the issuer of the old certificate was DigiCert).
I’ve checked your “home-mde” certificate comes with NppShell.dll (Thank you BTW), the content of both issuer and subject is identical.
So with the new self-signed certificate, we need to add E=don.h@free.fr, at the begining.

However, I still have signing problem:

SignTool Error: An unexpected internal error has occurred.
Error information: "Error: SignerSign() failed." (-2147024885/0x8007000b)

Could you pass me your command to sign NppShell.MSIX please?

donho

NppShell.msix is not signed either, because of signing error for unknown reason.

With some searches, it seems that MSIX just cannot be signed by a self-signed certificate, a lot of ppl have the same issue:
https://techcommunity.microsoft.com/discussions/msix-discussions/can-not-sign-the-msix-pacakge-with-self-signed-certificate/218928

@xomx
I’m really curious how did you made it.

donho

@Ekopalypse said in Notepad++ v8.8.4 Release Candidate:

unblocking it solves it.

Is it due to its signature from the self-signed certificate?

PeterJones

@donho said in Notepad++ v8.8.4 Release Candidate:

Is it due to its signature from the self-signed certificate?

No, it’s the Mark of the Web that browsers add when you download a zip or exe. For a normal exe, when you run it if it has the MotW, Windows will just ask you if you agree it’s safe… but because the gup.exe wasn’t run from the GUI but from inside Notepad++, the OS apparently doesn’t ask you, so N++ just cannot spawn the gup.exe.

xomx

@donho said in Notepad++ v8.8.4 Release Candidate:

With some searches, it seems that MSIX just cannot be signed by a self-signed certificate, a lot of ppl have the same issue:
https://techcommunity.microsoft.com/discussions/msix-discussions/can-not-sign-the-msix-pacakge-with-self-signed-certificate/218928

@xomx
I’m really curious how did you made it.

I had exactly the same

SignTool Error: An unexpected internal error has occurred.
Error information: “Error: SignerSign() failed.” (-2147024885/0x8007000b)

The 0x8007000b means ERROR_BAD_FORMAT. To find out more, I run Eventvwr.msc and checked the Event Viewer (Local) > Applications and Services Logs > Microsoft > Windows > AppxPackagingOM > Microsoft-Windows-AppxPackaging/Operational

and found this details:

“error 0x8007000B: The app manifest publisher name (CN=“Notepad++”, O=“Notepad++”, L=Saint Cloud, S=Ile-de-France, C=FR) must match the subject name of the signing certificate (CN=…, O=…, C=…).”

There were real strings instead of the dots above (I used my own cert 1st).

So I went to create a fake Notepad++ cert to exactly match the mentioned CN=“Notepad++”, O=“Notepad++”, L=Saint Cloud, S=Ile-de-France, C=FR.
But there was a problem with the “++” chars in the “Notepad++” (CRYPT_E_INVALID_X500_STRING), so I used this in PowerShell (runas admin):

PS C:\WINDOWS\system32> $signname="`"Notepad++`""
PS C:\WINDOWS\system32> New-SelfSignedCertificate -Type Custom -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3", "2.5.29.19={text}") -Subject "CN=$signname, O=$signname, L=Saint Cloud, S=Ile-de-France, C=FR" -FriendlyName $signname

Then exported my new cert to a PFX-file:

PS C:\WINDOWS\system32> $password = ConvertTo-SecureString -String SOMEPWD -Force -AsPlainText
>> Export-PfxCertificate -cert "Cert:\CurrentUser\My\NEW_FAKE_NPP_CERT_THUMBPRINT" -FilePath C:\...SOMEPATH...\npp-test.pfx -Password $password

Then move the signing cert to LocalMachine\TrustedPeople:

PS C:\WINDOWS\system32> Import-PfxCertificate -CertStoreLocation "Cert:\LocalMachine\TrustedPeople" -Password $password -FilePath C:\...SOMEPATH...\npp-test.pfx

Then launched MSVS2022 x64 native tools command prompt and signed the binaries with:

SignTool sign /fd sha256 /a /f C:\...SOMEPATH...\npp-test.pfx /p SOMEPWD C:\...SOMEOTHERPATH...\nppShell-master\x64\Debug\NppShell.msix

and

SignTool sign /fd sha256 /a /f C:\...SOMEPATH...\npp-test.pfx /p SOMEPWD C:\...SOMEOTHERPATH...\nppShell-master\x64\Debug\NppShell.dll

donho

@donho said in Notepad++ v8.8.4 Release Candidate:

I’m really curious how did you made it.

@xomx
I noticed that your certificate’s hash algorithm: sha256 - so instead of using /fd SHA512, I use /fd SHA256 (old certificate hash algorithm: sha256, so /fd SHA256 was used to sign):

“C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe” sign /fd SHA256 /tr http://timestamp.acs.microsoft.com /td sha512 /a /f C:\myPath\NppP12File.pfx /p *********** /d “Notepad++” /du https://notepad-plus-plus.org/ …\bin64\NppShell.msix

Done Adding Additional Store
Successfully signed: …\bin64\NppShell.x64.dll

Size does matter ;)

Of course, your remark of Publisher field is essential to fix:

<Identity Name="NotepadPlusPlus" ProcessorArchitecture="neutral" 
Publisher="E=don.h@free.fr, CN=&quot;Notepad++&quot;, O=&quot;Notepad++&quot;, L=Saint Cloud, S=Ile-de-France, C=FR" 
Version="1.0.0.0" />

So both fixes make it correct again:
https://download.notepad-plus-plus.org/repository/MISC/NppShellWorking/

Thank you for taking time to investigate this issue.
I’ll redo & post the RC2 tomorrow.

donho

error 0x8007000B: The signature hash method specified (SHA512) must match the hash method used in the app package block map (SHA256).

The hashAlgorithm specified in the /fd parameter is incorrect. Rerun SignTool using hashAlgorithm that matches the app package block map (used to create the app package)

Ref: https://learn.microsoft.com/en-us/windows/msix/package/signing-known-issues

donho

@xomx said in Notepad++ v8.8.4 Release Candidate:

SignTool sign /fd sha256

Aha ! :)

donho

FYI: RC2 is available:
http://download.notepad-plus-plus.org/repository/8.x/8.8.4.RC2/

Lycan Thrope

@donho,

I installed this one as a portable, and it still doesn’t allow plugins to be installed, after the installation. It goes through the process of warning, closing but never comes back up, and doesn’t install anything. I’m guessing this is what you were trying to fix?

Notepad++ v8.8.4   (64-bit)
Build time: Aug  4 2025 - 18:01:28
Scintilla/Lexilla included: 5.5.7/5.4.5
Boost Regex included: 1_85
Path: C:\Users\camilee\Documents\Development Tools Downloads\Notepad++ Versions\npp.8.8.4.RC2portable.x64\notepad++.exe
Command Line: 
Admin mode: OFF
Local Conf mode: ON
Cloud Config: OFF
Periodic Backup: ON
Placeholders: OFF
Scintilla Rendering Mode: SC_TECHNOLOGY_DIRECTWRITE (1)
Multi-instance Mode: monoInst
asNotepad: OFF
File Status Auto-Detection: cdEnabledNew (for current file/tab only)
Dark Mode: OFF
Display Info:
    primary monitor: 1600x900, scaling 100%
    visible monitors count: 1
    installed Display Class adapters: 
        0000: Description - AMD Radeon HD 8400 / R3 Series
        0000: DriverVersion - 27.20.1034.6
OS Name: Windows 10 Home (64-bit)
OS Version: 22H2
OS Build: 19045.6093
Current ANSI codepage: 1252
Plugins: 
    mimeTools (3.1)
    NppConverter (4.6)
    NppExport (0.4)

Edit: I looked back at the previous discussions and saw that the gup.exe needs to be unblocked, and that fixed it, but I thought this update was supposed to take care of that aspect. Correct me if I misunderstood the fix we were testing for in this RC2 version.

PeterJones

@Lycan-Thrope said in Notepad++ v8.8.4 Release Candidate:

Edit: I looked back at the previous discussions and saw that the gup.exe needs to be unblocked, and that fixed it, but I thought this update was supposed to take care of that aspect. Correct me if I misunderstood the fix we were testing for in this RC2 version.

Nope. The Mark of the Web (for portable) was a separate issue from the signature of the installer. RC2 fixed the MSIX signature for the installer.

@Ekopalypse had mentioned originally that 8.8.2 portable worked for him for plugins, but 8.8.3/8.8.4-portable did not…

But I just ran the experiment: if I download a copy of 8.8.2-portable from https://download.notepad-plus-plus.org/repository/8.x/8.8.2/ , the zipfile has the MotW, and when you unzip, the gup.exe also has MotW, so it’s not version dependent. I did the same thing from https://notepad-plus-plus.org/downloads/v8.8.2/ , which downloads from GitHub instead, and the zipfile and the resulting gup.exe also had the MotW.

I did some web searching: other than manually deleting the MotW using the Properties on the zipfile before unzipping, or on the individual exe after unzipping, one can use the old Windows “Internet Options” (accessible thru Control Panel (even in Win11), or directly running inetcpl.cpl), and go to Security, then click on Trusted Sites, then Add https://download.notepad-plus-plus.org/ and https://*.github.com/ to allow downloads directly from the NPP downloads server or from the github server to be “trusted” and not necessarily add the MotW. (I am just explaining how that setting can be changed, not whether it is a good idea; and I don’t guarantee that your given browser will honor that setting; I believe a browser can choose to add the MotW even despite that “trusted” setting.)

xomx

@donho said in Notepad++ v8.8.4 Release Candidate:

FYI: RC2 is available:
http://download.notepad-plus-plus.org/repository/8.x/8.8.4.RC2/

Just tried and so far so good, the new Win11 ctx menu works again, thanks for the NppShell & N++ PRs.

Have you checked/resolved your x86 issues reported here? (I didn’t even try to check it, sorry.).

Ekopalypse

@PeterJones

Does that mean if you are using 8.8.2 you can’t use the plugin admin to install plugins without unlocking gup.exe first? Because I just checked again and I can.
It probably has something to do with Windows Smartscreen, because with 8.8.2 I don’t get a warning that Npp could be “dangerous”, with the newer versions I do.