Troubleshooting Appx/Msix Signing with Appx Subject Interface Package (SIP) logging

(updated: )

Troubleshooting Appx/Msix signing errors can be a real pain in the butt.

Here's an example of unhelpful output from signtool:

SignTool Error: An unexpected internal error has occurred.
Error information: "Error: SignerSign() failed." (-2147024885/0x8007000b)

Trace logging can be controlled via one of two ways:

  1. Set DWORD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppxSip\LogLevel
  2. Set environment variable APPXSIP_LOG=

Valid values for both methods range from 0 to 3:

  • 0 - None
  • 1 - Info
  • 2 - Error
  • 3 - Trace

Here's helpful output from signtool:

...
ERROR: [Appx::Packaging::SipFunctionHelper::VerifyManifestPublisherName] failed because signing certificate subject name (CN="Foo") does not match package manifest publisher (CN="Package Foo")

ERROR: [AppxSipPutSignedDataMsg] SipFunctionHelper::VerifyManifestPublisherName( manifestPackageId.Get(), signatureSize, signature, false) failed with HR=0x8007000b.
SignTool Error: An unexpected internal error has occurred.

Error information: "Error: SignerSign() failed." (-2147024885/0x8007000b)