Skip to content

Do not strip VC redists - #856

Merged
jjhelmus merged 1 commit into
astral-sh:mainfrom
neilmehta24:keep-signature-of-vc-redists
Nov 19, 2025
Merged

jjhelmus merged 1 commit into
astral-sh:mainfrom
neilmehta24:keep-signature-of-vc-redists

Conversation

@neilmehta24

Copy link
Copy Markdown
Contributor

Closes #855

Please see the above issue description for why this addition is proposed

@jjhelmus jjhelmus added platform:windows Specific to the Windows platform and removed platform:windows Specific to the Windows platform labels Nov 14, 2025
@jjhelmus

Copy link
Copy Markdown
Contributor

I agree that symbols should not be stripped from these DLLs. Thanks for the fix @neilmehta24.

@jjhelmus
jjhelmus merged commit ad2b817 into astral-sh:main Nov 19, 2025
511 checks passed
jjhelmus pushed a commit that referenced this pull request Aug 13, 2026
when packaging a `uv python` installed python into a .msix app for the
microsoft app store, i hit some `signtool` failures with error
`0x800700C1`.

these are caused by `AppxSIP` going thru every binary in your package
and validating them in some way.

`llvm-strip` removes the signature from a bunch of DLLs that come with
these python buidls, but it keeps the certificate table entry in the PE
optional header , which makes the entry point past the end of the file.

this is *exactly* the bug from
#855 that
#856 solved.
i'm extending it to more DLLs and adding a comment explaining it.

a more permanent fix might be detecting signatures on files and skipping
if we see them? let me know if you'd rather that, i could wireup
detecting signatures and/or zipfs to get rid of the hardcoded list
that'll probably regress as versions change what DLLs are shipped.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

llvm-strip invalidates digital signature of MSVC redists

2 participants