v6.1.37 Test Builds Fail to Install - Signature verification failed while checking integrity of driver package 'VBoxSup.inf'

[Jacob Klein]

Originally reported here: ​https://forums.virtualbox.org/viewtopic.php?f=15&t=106662v6.1.37 Test Build 152627... fails to install.

It says: "Oracle VM VirtualBox 6.1.37 Setup Wizard ended prematurely" and VirtualBox Installer Installation failed! Error: Fatal error during installation.

Tested on Windows 10 Release Preview (19045.1865), and Windows 11 Dev Channel (25169.1000) ... since those are all that I have readily available.

Is the installer busted for this VirtualBox Test Build?

Oracle VirtualBox v6.1.36 Build 152435 ... continues to install fine. And I'm nearly sure that all the v6.1.35 Test Builds installed fine, too, from my testing.

=============================== Bug Details:

When I run the installer with option "--logging", I'm able to get an install log file in C:\Users\{User}\AppData\Local\Temp

See attached to compare these: VBoxInstallLog - 6.1.36 r152435.txt VBoxInstallLog - 6.1.37 r152676.txt

The main problem appears to be: DIFXAPP: ERROR: Signature verification failed while checking integrity of driver package 'VBoxSup.inf' ('C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf'). (Error code 0x800B0109: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.)

Is it possible that 6.1.35 Test Builds were WHQL signed, but 6.1.37 Test Builds are not? Note: I don't have my 6.1.35 Test Builds anymore, but I'm sure they worked.

[BlueMonday19]

I have the exact same error during install, none of the 6.1.37 builds will work.

[multiOS2019]

Tested installation of 6.1.x revision 152676 Test Build on:

• Windows 10 19044.1826 (21H2)
• Windows 11 22000.832 (current build as of 01 Aug 2022)
• Windows 11 22621/2.436 (22H2 Beta - insider build)

All failed with the same output as reported by the OP

[Jacob Klein]

Problem persists with v6.1.37 Test Build 152741.

Please advise.

[fth0]

Download a Windows test build installer (e.g. VirtualBox-6.1.37-152741-Win.exe), open a Windows Command Prompt with normal user rights, navigate to the Downloads folder (e.g. cd Downloads) and execute the following command:

VirtualBox-6.1.37-152741-Win.exe --logging --msi-log-file VBoxInstallLog.txt --force-install-timestamp-ca

This command will run the installation from within your downloads folder and also place the log file there. The last option tries to install a necessary certificate into your host's system root certificate store and should be needed only once.

[Jacob Klein]

I understand your proposed workaround.

However, we need a fix!

The instructions here make no mention of needing to use "--force-install-timestamp-ca" https://www.virtualbox.org/wiki/Testbuilds

So, what is the plan for a fix?

[fth0]

Since you seem to be asking me, I feel inclined to state that I'm not affiliated to Oracle or the VirtualBox development. I'm just a knowledgeable VirtualBox user. In consequence, I can neither offer a fix nor a plan, I can only make suggestions.

Since there are two workarounds (one in this ticket and two in the forum thread linked in your ticket description above), I wouldn't hold my breath. ;)

[Jacob Klein]

I wasn't asking you for a fix, but I do understand your workarounds.

Oracle: What is the plan for a fix? Is it on your radar? If not, can you update the TestBuilds instructions to make it clear what we are supposed to do to continue to test your product? Thanks.

[Jacob Klein]

Hmm. I'll keep hoping for Oracle to respond to my questions. I want to test :)

[Jacob Klein]

VirtualBox Devs:

The installation problem persists with Oracle VirtualBox v6.1.37 Test Build 153415 And I see no new required installation instructions, on https://www.virtualbox.org/wiki/Testbuilds

Please advise. Thank you.

[Jacob Klein]

klaus pointed out that instructions have now been added to https://www.virtualbox.org/wiki/Testbuilds

Thanks! My only additional request might be to consider explaining why we need to do the additional step. From a security standpoint, performing the step sounds risky if we're not fully aware of what it is doing. If that makes sense. Consider it.

I'll be sure to test the additional step in the next TestBuild. Thank you for adding some instructions.

I think this Ticket can be closed, if you are satisfied with the requirement of having testers perform this additional step, per the new documentation.