Wix Burn fails to download exePackage - wix

Question

I am using the exePackage attribute to download an exe pacakge - actually the VSTO runtime from microsoft.
It fails to get the package.
I believe this is the correct way to add it to the CHAIN
<ExePackage Id="VSTORuntime" SourceFile="vstor_redist.exe" Permanent="yes" Vital="yes" Cache="no" Compressed="no"
DownloadUrl="http://go.microsoft.com/fwlink/?LinkId=158917"
PerMachine="yes"
InstallCommand="/q /norestart"
DetectCondition="VSTORFeature"
InstallCondition="NOT VSTORFeature OR NOT (VSTORVersionV4R >=v10.0.40303) OR NOT (VSTORVersionV4 >=v10.0.21022)" />
This is the log file part. It does this about three times.
[0D98:06A8][2013-07-22T11:47:31]w343: Prompt for source of package: VSTORuntime, payload: VSTORuntime, path: F:\vstor_redist.exe
[0D98:06A8][2013-07-22T11:47:31]i338: Acquiring package: VSTORuntime, payload: VSTORuntime, download from: http://go.microsoft.com/fwlink/?LinkId=158917
[16A0:0BE4][2013-07-22T11:47:37]e000: Error 0x80070490: Failed to find expected public key in certificate chain.
[16A0:0BE4][2013-07-22T11:47:37]e000: Error 0x80070490: Failed to verify expected payload against actual certificate chain.
[16A0:0BE4][2013-07-22T11:47:37]e000: Error 0x80070490: Failed to verify signature of payload: VSTORuntime

Answer 1

i think you need to specify Certificate key in the RemotePayload tag, like this :
<ExePackage Id="VSTORuntime" SourceFile="vstor_redist.exe" Permanent="yes" Vital="yes" Cache="no" Compressed="no"
DownloadUrl="http://go.microsoft.com/fwlink/?LinkId=158917"
PerMachine="yes"
InstallCommand="/q /norestart"
DetectCondition="VSTORFeature"
InstallCondition="NOT VSTORFeature OR NOT (VSTORVersionV4R >=v10.0.40303) OR NOT (VSTORVersionV4 >=v10.0.21022)">
<RemotePayload ProductName="Windows Installer 4.5"
Description="Windows Installer 4.5 Setup"
CertificatePublicKey="F321408E7C51F8544B98E517D76A8334052E26E8"
CertificateThumbprint="D57FAC60F1A8D34877AEB350E83F46F6EFC9E5F1"
Hash="86E1CC622DBF4979717B8F76AD73220CDB70400B"
Size="3327000"
Version="4.5.0.0" />
</ExePackage>
it's just an idea ...
or Try to use fiddler to find if they'r an error 404 or something like this ...

Answer 2

I've encountered this problem when the bootstrapper bundle is compiled with one version of the exe package, but another version is sitting alongside the installer executable when you try to run it. I suspect that Burn automatically pulls the certificate information out of the source file when you compile the bundle.
If for example your Setup.exe file was in C:\Downloads and C:\Downloads also contains a version of vstor_redist.exe which is different to the one present when you built Setup.exe, you'll see this error. You can work around the problem by deleting vstor_redist.exe from C:\Downloads - Setup.exe will then go off and download the correct version from the URL you specified.

Answer 3

It appears that Microsoft had updated the package behind that URL, and changed the certificate that was used to sign it. This is indistinguishable from an attacker serving up a malicious file, so the only thing you can do is build a new bundle from the new file with the updated certificate. In later versions of 3.x, you had to specify SuppressSignatureVerification="no" when not using RemotePayload and you wanted signature verification instead of hash verification.