Signature thumbprint do not match expected

[philcart]

Description

==> azure-arm.image: Waiting for machine to restart...
==> azure-arm.image: A system shutdown is in progress.(1115)
azure-arm.image: pkrvms4osbkppd6 restarted.
==> azure-arm.image: #< CLIXML
==> azure-arm.image: System.Management.Automation.PSCustomObjectSystem.Object1Preparing modules for first use.0-1-1Completed-1 1Preparing modules for first use.0-1-1Completed-1
==> azure-arm.image: Machine successfully restarted, moving on
==> azure-arm.image: Provisioning with Powershell...
==> azure-arm.image: Provisioning with powershell script: C:/Dev/runner-images/images/windows/templates/../scripts/build/Install-VisualStudio.ps1
azure-arm.image: Downloading Bootstrapper ...
azure-arm.image: Downloading package from https://aka.ms/vs/17/release/vs_Enterprise.exe to C:\Users\INSTAL~1\AppData\Local\Temp\vs_Enterprise.exe...
azure-arm.image: Package downloaded in 1 seconds
azure-arm.image: Signature thumbprint do not match expected.
azure-arm.image: At C:\Program Files\WindowsPowerShell\Modules\ImageHelpers\InstallHelpers.ps1:972 char:9
azure-arm.image: + throw "Signature thumbprint do not match expected."
azure-arm.image: + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
azure-arm.image: + CategoryInfo : OperationStopped: (Signature thumb...match expected.:String) [], RuntimeException
azure-arm.image: + FullyQualifiedErrorId : Signature thumbprint do not match expected.
azure-arm.image:
==> azure-arm.image: Script exited with non-zero exit status: 1. Allowed exit codes are: [0 3010]
==> azure-arm.image: Step "StepProvision" failed
==> azure-arm.image: [c] Clean up and exit, [a] abort without cleanup, or [r] retry step (build may fail even if retry succeeds)?

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 20.04
• Ubuntu 22.04
• macOS 11
• macOS 12
• macOS 13
• macOS 13 Arm64
• Windows Server 2019
• Windows Server 2022

Image version and build link

main branch cloned at
192a94d

Is it regression?

N/A

Expected behavior

New Windows2022 runner image built

Actual behavior

Errors with the above message

Repro steps

1. Start Windows PowerShell as Administrator
2. Run build as per docs located at https://github.com/actions/runner-images/blob/main/docs/create-image-and-azure-resources.md
3. Run command using an existing Azure Resource Group ==> GenerateResourcesAndImage -SubscriptionId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -ResourceGroupName "my-resource-group" -AzureLocation "Australia Southeast" -ImageType "Windows2022"

[sergei-pyshnoi]

Hello @philcart . Thanks for your report. We will merge fix as as possible.

[mikhailkoliada]

Should be fixed in main!

[apzeiss]

Hi guys,
Can we find a solution for this ? Read the thumbprint automatically from a trusted location for example .Each time Microsoft published a new package can provide the thumbprint as well in that location.
I mean the problem is that : anytime something gets released by Microsoft our builds will faill , it can happen even during the build to get a new release with different thumbprint.

And in the context of CD concepts , this is kind of problematic.

Regards,

[lightray55]

I can confirm that I've hit this issue again today:

==> azure-arm.image: Provisioning with Powershell...
==> azure-arm.image: Provisioning with powershell script: C:/a/1/s/runner-images/images/windows/templates/../scripts/build/Install-VisualStudio.ps1
    azure-arm.image: Downloading Bootstrapper ...
    azure-arm.image: Downloading package from https://aka.ms/vs/17/release/vs_Enterprise.exe to C:\Users\INSTAL~1\AppData\Local\Temp\vs_Enterprise.exe...
    azure-arm.image: Package downloaded in 1 seconds
    azure-arm.image: Signature thumbprint do not match expected.
    azure-arm.image: At C:\Program Files\WindowsPowerShell\Modules\ImageHelpers\InstallHelpers.ps1:972 char:9
    azure-arm.image: +         throw "Signature thumbprint do not match expected."
    azure-arm.image: +         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    azure-arm.image:     + CategoryInfo          : OperationStopped: (Signature thumb...match expected.:String) [], RuntimeException
    azure-arm.image:     + FullyQualifiedErrorId : Signature thumbprint do not match expected.
    azure-arm.image:
==> azure-arm.image: Provisioning step had errors: Running the cleanup provisioner, if present...
...
==> Some builds didn't complete successfully and had errors:
--> azure-arm.image: Script exited with non-zero exit status: 1. Allowed exit codes are: [0 3010]

I would like to reiterate the above comment requesting a longer term solution for this rather than a manual update.

[piotrgradzinski]

I'm experiencing the same problem and I've updated the signature for VS. #9502

[alperkar]

I would also like to see a long term solution to signatures not matching issue. This happens too often and wastes a lot of time. It is really annoying to wait 2-3 hours for a build and to see that it failed because the signature of a single tool has changed.

[LokeshNagireddy]

we are having a similar issue for AzureCLI from few days.

2024-05-02T21:04:29.1761743Z ==> azure-arm.image: Provisioning with powershell script: /agent/_work/3/s/runner-images/images/windows/templates/../scripts/build/Install-AzureCli.ps1
2024-05-02T21:04:41.9840385Z azure-arm.image: Install the latest Azure CLI release
2024-05-02T21:04:41.9845413Z azure-arm.image: Downloading package from https://aka.ms/installazurecliwindowsx64 to C:\Users\packer\AppData\Local\Temp\bj43jtiz.msi...
2024-05-02T21:04:50.8294601Z azure-arm.image: Package downloaded in 8.81 seconds
2024-05-02T21:04:52.6240392Z ==> azure-arm.image: Signature thumbprint do not match expected.
2024-05-02T21:04:52.6243750Z ==> azure-arm.image: At C:\Program Files\WindowsPowerShell\Modules\ImageHelpers\InstallHelpers.ps1:972 char:9
2024-05-02T21:04:52.6248599Z ==> azure-arm.image: + throw "Signature thumbprint do not match expected."
2024-05-02T21:04:52.6252653Z ==> azure-arm.image: + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2024-05-02T21:04:52.6256881Z ==> azure-arm.image: + CategoryInfo : OperationStopped: (Signature thumb...match expected.:String) [], RuntimeException
2024-05-02T21:04:52.6260757Z ==> azure-arm.image: + FullyQualifiedErrorId : Signature thumbprint do not match expected.

---

Can you please upgrade the signature and let me know.
i look forwad for your response.

Thank you,
Regards,
Lokesh N