Engine signing failed with error 800700C1

[Kalyani-git-12]

Question

Hi @robmen
I am using WiX version 6.0.2 and followed the documented procedure for signing a WiX bundle described here: https://docs.firegiant.com/wix/tools/wixexe/#burnextract

Specifically, I:

• Detached the Burn engine from the bundle.
• Signed the detached engine.
• Reattached the signed engine to the bundle.
• Signed the resulting bundle.

This process completed successfully.

However, when I attempt to sign the already-signed bundle again using the same approach, the engine signing step fails with error 0x800700C1.
Could you please help me understand why this error occurs and advise on the correct approach for re-signing an already-signed bundle?
Thank you for your assistance.

Open Source Maintenance Fee

• I (or an organization I'm a member of) pay the Open Source Maintenance Fee by sponsoring the wixtoolset project because I support the maintainers.

[krotname]

The safe mental model is: the Burn bundle signing flow is a one-way finalization step.

The documented order is:

1. build the bundle
2. detach the Burn engine from that original bundle
3. sign the detached engine
4. reattach the signed engine to the original bundle
5. sign the resulting full bundle

For re-signing, I would not use the already-signed bundle as the input to the detach/reattach pipeline. Keep the unsigned bundle build output as an intermediate artifact and repeat the full pipeline from that artifact.

So the re-sign flow should be either:

unsigned bundle -> detach engine -> sign engine -> reattach -> sign final bundle

or rebuild the bundle and run the same signing pipeline again.

If you only add/replace the outer Authenticode signature on the final EXE, the embedded engine signature is not refreshed. If you need the engine signed with a new cert/timestamp too, you need the original unsigned bundle or a rebuild.

0x800700C1 is ERROR_BAD_EXE_FORMAT, so the signing tool is most likely being handed something that is no longer the plain detached engine it expects. Using the already-signed bundle as the new source can lead to exactly that kind of bad input. Treat the signed bundle as the final distributable, not as the source for another Burn signing pass.