title: Digital signature information in a cab file?
body: <p>I've been trying to check for digital signatures on .cab (Windows cabinet) files programmatically. This will likely be deployed on a linux box so I can't use WinVerifyTrust. I've been using Sigcheck to get the actual value (it will show you whether signed or not, and who signed the leaf cert) and I've also looked at <a href="https://stackoverflow.com/questions/6475132/detect-a-digital-signature-without-winverifytrust">Detect a digital signature without WinVerifyTrust</a> which is pretty similar.           </p>
  
  <p>I've gotten Hex Editor Neo to scan for any relevant patterns, since my cab files are often too big for Offvis.     </p>
  
  <p>Edit: Further inspection with Neo shows the presence of certificates near the end of the file, but I'm not sure how to use this more generally.</p>
  
  <p>How do you know if a cab file has been signed? What fields do you look for? 
  Is there something similar to  IMAGE_DIRECTORY_ENTRY_SECURITY in PE files? Whether you can write a class to describe its structure or just scan for particular fields using a hexdumper, I'm open to any suggestions. 
  My plan is to eventually write a struct for it when I can get a hold on how to represent a signed cab file.       </p>
  
  <p>Edit: Getting back to it after a couple days, it seems CAB file signatures begin at an arbitrary distance from the end of the actually cabinets. You can see the hex bytes of the cert from a Hex Editor, or using SigCheck to verify if the file is just signed or not. But no logic suggests itself to me as for how to account for this.<br>
  Any insights? </p>