Notepad++ v8.8.4 Release Candidate
-
@donho said in Notepad++ v8.8.4 Release Candidate:
NppShell.msix is not signed COULD BE the problem.
IT IS the problem.
For sparse packages registering, only the msix-file (with a valid sign) is important (I tried/debugged - one can have the NppShell.dll unsigned but if the NppShell.msix is signed according to its corresponding xml manifest (CN=“Notepad++”, O=“Notepad++”, L=Saint Cloud, S=Ile-de-France, C=FR), the new N++ Win11 context menu gets registered & works ok).
@donho said in Notepad++ v8.8.4 Release Candidate:
send them to me (don.h@free.fr ) for some test from my side
I sent you binaries of my x64 Debug build of the current NppShell master, signed by my fake N++ self-signing cert created. I tested them on my Win11 ok - new context menu works as it should.
No time yet for the x86 tests, sorry.
Edit: Please ignore (click on the OK btn) the debugger attaching point of my NppShell.dll binary sent:
-
It looks like 8.8.2 is the last version that allows a portable version to use the plugin admin to install plugins, or am I the only one having this problem? With the newer versions you still see the dialog that Npp needs to be restarted but the restart or installation of the plugin does not take place.
-
@Ekopalypse said in Notepad++ v8.8.4 Release Candidate:
am I the only one having this problem?
I concur. I saw it yesterday with DSpellCheck on 8.8.3, but thought it was just that one plugin, and didn’t look into it more deeply. I confirmed today with 8.8.3 portable and 8.8.4-RC portable that I cannot get DSpellCheck or ConfigUpdater or CollectionInterface plugins to install through Plugins Admin. (And confirmed that v8.8.2 portable is able to install plugins using Plugins Admin)
Looks like a regression in v8.8.3 that wasn’t noticed.
-
-
@Ekopalypse said in Notepad++ v8.8.4 Release Candidate:
unblocking it solves it.
Confirmed.
For future readers: you can also unblock the zipfile before unzipping, then none of the executables will be marked as “blocked” when they are extracted.
-
@donho said in Notepad++ v8.8.4 Release Candidate:
NppShell.msix is not signed either, because of signing error for unknown reason.
Probably because of:
-
@xomx
It should match certificate’s Subject, not Issuer. (the issuer of the old certificate was DigiCert).
I’ve checked your “home-mde” certificate comes with NppShell.dll (Thank you BTW), the content of both issuer and subject is identical.
So with the new self-signed certificate, we need to addE=don.h@free.fr,at the begining.However, I still have signing problem:
SignTool Error: An unexpected internal error has occurred. Error information: "Error: SignerSign() failed." (-2147024885/0x8007000b)Could you pass me your command to sign NppShell.MSIX please?
-
NppShell.msix is not signed either, because of signing error for unknown reason.
With some searches, it seems that MSIX just cannot be signed by a self-signed certificate, a lot of ppl have the same issue:
https://techcommunity.microsoft.com/discussions/msix-discussions/can-not-sign-the-msix-pacakge-with-self-signed-certificate/218928@xomx
I’m really curious how did you made it. -
@Ekopalypse said in Notepad++ v8.8.4 Release Candidate:
unblocking it solves it.
Is it due to its signature from the self-signed certificate?
-
@donho said in Notepad++ v8.8.4 Release Candidate:
Is it due to its signature from the self-signed certificate?
No, it’s the Mark of the Web that browsers add when you download a zip or exe. For a normal exe, when you run it if it has the MotW, Windows will just ask you if you agree it’s safe… but because the gup.exe wasn’t run from the GUI but from inside Notepad++, the OS apparently doesn’t ask you, so N++ just cannot spawn the gup.exe.
-
@donho said in Notepad++ v8.8.4 Release Candidate:
With some searches, it seems that MSIX just cannot be signed by a self-signed certificate, a lot of ppl have the same issue:
https://techcommunity.microsoft.com/discussions/msix-discussions/can-not-sign-the-msix-pacakge-with-self-signed-certificate/218928@xomx
I’m really curious how did you made it.I had exactly the same
SignTool Error: An unexpected internal error has occurred.
Error information: “Error: SignerSign() failed.” (-2147024885/0x8007000b)The 0x8007000b means ERROR_BAD_FORMAT. To find out more, I run Eventvwr.msc and checked the Event Viewer (Local) > Applications and Services Logs > Microsoft > Windows > AppxPackagingOM > Microsoft-Windows-AppxPackaging/Operational
and found this details:
“error 0x8007000B: The app manifest publisher name (CN=“Notepad++”, O=“Notepad++”, L=Saint Cloud, S=Ile-de-France, C=FR) must match the subject name of the signing certificate (CN=…, O=…, C=…).”
There were real strings instead of the dots above (I used my own cert 1st).
So I went to create a fake Notepad++ cert to exactly match the mentioned CN=“Notepad++”, O=“Notepad++”, L=Saint Cloud, S=Ile-de-France, C=FR.
But there was a problem with the “++” chars in the “Notepad++” (CRYPT_E_INVALID_X500_STRING), so I used this in PowerShell (runas admin):PS C:\WINDOWS\system32> $signname="`"Notepad++`"" PS C:\WINDOWS\system32> New-SelfSignedCertificate -Type Custom -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3", "2.5.29.19={text}") -Subject "CN=$signname, O=$signname, L=Saint Cloud, S=Ile-de-France, C=FR" -FriendlyName $signnameThen exported my new cert to a PFX-file:
PS C:\WINDOWS\system32> $password = ConvertTo-SecureString -String SOMEPWD -Force -AsPlainText >> Export-PfxCertificate -cert "Cert:\CurrentUser\My\NEW_FAKE_NPP_CERT_THUMBPRINT" -FilePath C:\...SOMEPATH...\npp-test.pfx -Password $passwordThen move the signing cert to LocalMachine\TrustedPeople:
PS C:\WINDOWS\system32> Import-PfxCertificate -CertStoreLocation "Cert:\LocalMachine\TrustedPeople" -Password $password -FilePath C:\...SOMEPATH...\npp-test.pfxThen launched MSVS2022 x64 native tools command prompt and signed the binaries with:
SignTool sign /fd sha256 /a /f C:\...SOMEPATH...\npp-test.pfx /p SOMEPWD C:\...SOMEOTHERPATH...\nppShell-master\x64\Debug\NppShell.msixand
SignTool sign /fd sha256 /a /f C:\...SOMEPATH...\npp-test.pfx /p SOMEPWD C:\...SOMEOTHERPATH...\nppShell-master\x64\Debug\NppShell.dll -
@donho said in Notepad++ v8.8.4 Release Candidate:
I’m really curious how did you made it.
@xomx
I noticed that your certificate’s hash algorithm: sha256 - so instead of using/fd SHA512, I use/fd SHA256(old certificate hash algorithm: sha256, so/fd SHA256was used to sign):“C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe” sign /fd SHA256 /tr http://timestamp.acs.microsoft.com /td sha512 /a /f C:\myPath\NppP12File.pfx /p *********** /d “Notepad++” /du https://notepad-plus-plus.org/ …\bin64\NppShell.msix
Done Adding Additional Store
Successfully signed: …\bin64\NppShell.x64.dllSize does matter ;)
Of course, your remark of Publisher field is essential to fix:
<Identity Name="NotepadPlusPlus" ProcessorArchitecture="neutral" Publisher="E=don.h@free.fr, CN="Notepad++", O="Notepad++", L=Saint Cloud, S=Ile-de-France, C=FR" Version="1.0.0.0" />So both fixes make it correct again:
https://download.notepad-plus-plus.org/repository/MISC/NppShellWorking/Thank you for taking time to investigate this issue.
I’ll redo & post the RC2 tomorrow. -
error 0x8007000B: The signature hash method specified (SHA512) must match the hash method used in the app package block map (SHA256).
The hashAlgorithm specified in the /fd parameter is incorrect. Rerun SignTool using hashAlgorithm that matches the app package block map (used to create the app package)
Ref: https://learn.microsoft.com/en-us/windows/msix/package/signing-known-issues
-
-
FYI: RC2 is available:
http://download.notepad-plus-plus.org/repository/8.x/8.8.4.RC2/ -
I installed this one as a portable, and it still doesn’t allow plugins to be installed, after the installation. It goes through the process of warning, closing but never comes back up, and doesn’t install anything. I’m guessing this is what you were trying to fix?
Notepad++ v8.8.4 (64-bit) Build time: Aug 4 2025 - 18:01:28 Scintilla/Lexilla included: 5.5.7/5.4.5 Boost Regex included: 1_85 Path: C:\Users\camilee\Documents\Development Tools Downloads\Notepad++ Versions\npp.8.8.4.RC2portable.x64\notepad++.exe Command Line: Admin mode: OFF Local Conf mode: ON Cloud Config: OFF Periodic Backup: ON Placeholders: OFF Scintilla Rendering Mode: SC_TECHNOLOGY_DIRECTWRITE (1) Multi-instance Mode: monoInst asNotepad: OFF File Status Auto-Detection: cdEnabledNew (for current file/tab only) Dark Mode: OFF Display Info: primary monitor: 1600x900, scaling 100% visible monitors count: 1 installed Display Class adapters: 0000: Description - AMD Radeon HD 8400 / R3 Series 0000: DriverVersion - 27.20.1034.6 OS Name: Windows 10 Home (64-bit) OS Version: 22H2 OS Build: 19045.6093 Current ANSI codepage: 1252 Plugins: mimeTools (3.1) NppConverter (4.6) NppExport (0.4)Edit: I looked back at the previous discussions and saw that the gup.exe needs to be unblocked, and that fixed it, but I thought this update was supposed to take care of that aspect. Correct me if I misunderstood the fix we were testing for in this RC2 version.
-
@Lycan-Thrope said in Notepad++ v8.8.4 Release Candidate:
Edit: I looked back at the previous discussions and saw that the gup.exe needs to be unblocked, and that fixed it, but I thought this update was supposed to take care of that aspect. Correct me if I misunderstood the fix we were testing for in this RC2 version.
Nope. The Mark of the Web (for portable) was a separate issue from the signature of the installer. RC2 fixed the MSIX signature for the installer.
@Ekopalypse had mentioned originally that 8.8.2 portable worked for him for plugins, but 8.8.3/8.8.4-portable did not…
But I just ran the experiment: if I download a copy of 8.8.2-portable from https://download.notepad-plus-plus.org/repository/8.x/8.8.2/ , the zipfile has the MotW, and when you unzip, the
gup.exealso has MotW, so it’s not version dependent. I did the same thing from https://notepad-plus-plus.org/downloads/v8.8.2/ , which downloads from GitHub instead, and the zipfile and the resultinggup.exealso had the MotW.I did some web searching: other than manually deleting the MotW using the Properties on the zipfile before unzipping, or on the individual exe after unzipping, one can use the old Windows “Internet Options” (accessible thru Control Panel (even in Win11), or directly running
inetcpl.cpl), and go to Security, then click on Trusted Sites, then Addhttps://download.notepad-plus-plus.org/andhttps://*.github.com/to allow downloads directly from the NPP downloads server or from the github server to be “trusted” and not necessarily add the MotW. (I am just explaining how that setting can be changed, not whether it is a good idea; and I don’t guarantee that your given browser will honor that setting; I believe a browser can choose to add the MotW even despite that “trusted” setting.) -
@donho said in Notepad++ v8.8.4 Release Candidate:
FYI: RC2 is available:
http://download.notepad-plus-plus.org/repository/8.x/8.8.4.RC2/Just tried and so far so good, the new Win11 ctx menu works again, thanks for the NppShell & N++ PRs.
Have you checked/resolved your x86 issues reported here? (I didn’t even try to check it, sorry.).
-
Does that mean if you are using 8.8.2 you can’t use the plugin admin to install plugins without unlocking gup.exe first? Because I just checked again and I can.
It probably has something to do with Windows Smartscreen, because with 8.8.2 I don’t get a warning that Npp could be “dangerous”, with the newer versions I do. -
@xomx said in Notepad++ v8.8.4 Release Candidate:
Have you checked/resolved your x86 issues reported here? (I didn’t even try to check it, sorry.).
Yes, x86 NppShell.dll (with no msix) which comes with Notepad++ x86 installer does work well as before, according my test.
