Security Compliance

Failed to sign package error in Patch Manager

This article addresses an error that appears when you publish third party packages to one or more WSUS servers. Error: FAILED TO SIGN PACKAGE

First published date

10/27/2018 12:23 AM

Last published date

8/18/2023 5:52 PM

Overview

When you publish any third-party packages to the WSUS server(s), you may see one one or more of the following error(s):
Error 1:

2026/01/12 04:31:11:792 PID: 14200 TID:  7618 [ERROR] Failed to publish update: SomePackageName Message: Failed to sign package; error was: 2148081670 Stack Trace: at
Microsoft.UpdateServices.Internal.BaseApi.Publisher.SignPackageCab(Boolean dualSign, String httpTimeStamp) 
Error 2:
2018/06/13 16:44:04:073 PID: 3696 TID:  7684 [ERROR] Failed to publish update: Adobe Acrobat DC Update 18.011.20040 Message: Failed to sign package; error was: 2147942405 Stack Trace: at Microsoft.UpdateServices.Internal.BaseApi.Publisher.SignPackageCab(Boolean dualSign, String httpTimeStamp)
Error 3: 
2022/09/04 11:15:18:552 PID: 12576 TID: 15664 [ERROR] Failed to publish update: WinSCP 5.21.1 Message: Failed to sign package; error was: 2147943568 Stack Trace:
   at Microsoft.UpdateServices.Internal.BaseApi.Publisher.SignPackageCab(Boolean dualSign, String httpTimeStamp)
   at Microsoft.UpdateServices.Internal.BaseApi.Publisher.PublishPackage(String sourcePath, String additionalSourcePath, String packageDirectoryName, Boolean dualSign, String httpTimeStamp)
   at Microsoft.UpdateServices.Internal.BaseApi.Publisher.PublishPackage(String sourcePath, String packageDirectoryName)
   at EminentWare.UpdateServices.Administration.UpdateServer.PublishUpdates()
2022/09/04 11:15:18:552 PID: 12576 TID: 15664 [INFO] CallbaseCommandHelpers::UpdateResult() updated record by object. Object Key: aa7bc201-d2aa-4a3e-a278-ffe1e2240532 Operation Name: publish Result Status: Failure

In some cases after you delete, recreate and resign the packages with valid WSUS cert, the same error still returns. And there are no permissions issues to access the WSUS store either on local / remote WSUS server according to PM logs.

Upon verification the published package is successfully copied to the local publishing folder under  %AppData%\Local\EminentWare\Packages and the UpdatesServicesPackages folder on the WSUS server.

And when you review the Application Event logs on the WSUS server, you may notice an error message similar to the one below with Event Source = MOVE AV Client and eventid = 24, which points to the root cause in this case.

Deferred scan is in progress for file 'D:\WSUS\Upd
ateServicesPackages\cde8e668-2572-4777-8fbf-427af3497cd3\b75e6446-1c23-4115-8d60-2edb35ebeb1b\AcrobatDCUpd1801120040.msp'. (A thread in  process took 30 seconds for scanning. Hence, access denied.)

Error 4:
And in some cases, you are able to publish all packages except for specific package for example here Mozilla Firefox 77.0.1 (upgrade) - you can publish other version of Mozilla except this one and see below error.

Product section

Patch Manager

Cause

  • The WSUS content store was improperly moved or is misconfigured.
  • Packages larger than 200 MB may be blocked or locked by the antivirus software.
  • One of the WSUS(or SUP) servers Certificate expired
  • The content folder for the specific package might be corrupted and it was already been published.

Resolution

I have a problem publishing any third-party packages
  1. Please verify that the WSUS cert store has a valid cert on the WSUS server (2012 R2) you are trying to publish
  2. Verify the WSUS permissions as explained in CreateDirectory Failed error when publishing updates to WSUS.
  3. Verify the WSUS shares are in place and accessible by the Primary Application Server.
  4. Check Windows event logs if antivirus software is not locking/blocking the update files due to their large size i.e. few 100 MB.
  5. If the shares were previously moved and the error displays when you publish, use the WSUSUtil tool to move the content stores. (© 2018 Microsoft Corporation, available at https://www.microsoft.com, obtained on August 8, 2018.). You can move the shares back to your current path. The utility should resolve issues with the shares and registry settings that help define the storage location.

If you continue getting the same error, Re-create the WSUS certs even though they are still valid.

I have a problem with publishing specific third-party package.
If the problem is with publishing specific third-party packages, example: Mozilla Firefox 77.0.1 or a custom package.
1. Go to the content folder (WSUS\UpdateServicesPackages) on WSUS server and search for Mozilla Firefox 77.0.1 (upgrade) package for example:

2. Delete all the folder(s) containing this version of the packages in our example folder.
Image_2020-07-28_11-46-51.png
3. Go back to the Patch Manager MMC console and re-publish this package.

If the issue still persists, you may have to deploy a new WSUS server and test it (confirmed in one customer case#01434903)