CR runtime modules not digitally signed for SP 29

[kelvinsmith]

The runtime modules for Crystal Reports for Visual Studio, service pack 29, are not digitally signed--neither the .zip archives posted for download nor the MSI installer that is contained within the .zip archive. This is true for the 32-bit version, the 64-bit version, and the merge modules (as made available at https://www.sap.com/cmp/td/sap-crystal-reports-visual-studio-trial.html). This presents a major security risk, because there is nothing to confirm that the files haven't been tampered with. Previous service packs were properly digitally signed.

[kelvinsmith · Accepted solution]

I don't think I used it for an install, since I'm looking on my development machine. However, I just tried again unpacking the .zip archive, and this time the .msi file has a digital signature. The .zip archive that's downloaded from the Internet doesn't, though. However, the .msi is what's most important--what will give the nasty warning message if it's unsigned. Since that seems OK at this point, I guess I'll chalk the previous problem up to gremlins and move on.

[former_member11696]

Hi Kelvin,

What SP were you using? I looked in SP 21 and 19 and I don't see a signature.

As of around SP 21 with updates to the Framework versions and other things when installing the MSI packages you must install them under an Admin account to get everything properly registered etc.

According to this MS article:

https://docs.microsoft.com/en-us/windows/win32/msi/digital-signatures-and-windows-installer

"Performing an administrative installation removes the digital signature from the package. An administrative installation modifies the installation package in order to add the AdminProperties stream, which would invalidate the original digital signature. An administrator can resign the package."

And noted on my WIKI download page:

https://wiki.scn.sap.com/wiki/display/BOBJ/Crystal+Reports%2C+Developer+for+Visual+Studio+Downloads

"❗ Please note: To integrate “SAP Crystal Reports, developer version for Microsoft Visual Studio” you must run the Install Executable by right clicking and selecting "Run as Administrator". Installing the MSI will not fully integrate Crystal Reports into VS. MSI files by definition are for runtime distribution only. Do not run the MSI's on your Development PC, where VS is installed, not required."

PS - Checking with R&D...