{"record":{"id":"4a4fd77064ef8205","repo":"oven-sh/bun","slug":"invalidsecuritydirectory","errorCode":null,"errorMessage":"InvalidSecurityDirectory","messagePattern":"InvalidSecurityDirectory","errorType":"console","errorClass":"bun_exe_format::pe::Error","httpStatus":null,"severity":"error","filePath":"src/exe_format/pe.rs","lineNumber":33,"sourceCode":"    #[error(\"Overflow\")]\n    Overflow,\n    #[error(\"InvalidPEFile\")]\n    InvalidPEFile,\n    #[error(\"InvalidDOSSignature\")]\n    InvalidDOSSignature,\n    #[error(\"InvalidPESignature\")]\n    InvalidPESignature,\n    #[error(\"UnsupportedPEFormat\")]\n    UnsupportedPEFormat,\n    #[error(\"InsufficientHeaderSpace\")]\n    InsufficientHeaderSpace,\n    #[error(\"TooManySections\")]\n    TooManySections,\n    #[error(\"SectionExists\")]\n    SectionExists,\n    #[error(\"InputIsSigned\")]\n    InputIsSigned,\n    #[error(\"InvalidSecurityDirectory\")]\n    InvalidSecurityDirectory,\n    #[error(\"SecurityDirInsideImage\")]\n    SecurityDirInsideImage,\n    #[error(\"UnexpectedOverlayPresent\")]\n    UnexpectedOverlayPresent,\n    #[error(\"InsufficientSpace\")]\n    InsufficientSpace,\n}\n\n/// Windows PE Binary manipulation for codesigning standalone executables\npub struct PEFile {\n    pub(crate) data: Vec<u8>,\n    // Store offsets instead of pointers to avoid invalidation after resize\n    pub(crate) pe_header_offset: usize,\n    pub(crate) optional_header_offset: usize,\n    pub(crate) section_headers_offset: usize,\n    pub(crate) num_sections: u16,\n}","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/exe_format/pe.rs#L15-L51","documentation":"While stripping Authenticode, the Security data directory (index 4) points outside the file: the certificate-table file offset is >= file length (src/exe_format/pe.rs:375-377), or the 8-byte-aligned end of the certificate blob exceeds EOF (src/exe_format/pe.rs:383-386). The directory claims a signature that is not actually present in the bytes, so it cannot be safely removed.","triggerScenarios":"`bun build --compile --target=windows` on a base exe whose Security directory VA/Size fields are stale or corrupt — e.g. the file was truncated after signing, a signature-stripping tool zeroed the certificate bytes but left the directory entry, or a packer rewrote offsets without updating the directory.","commonSituations":"Base executables processed by half-finished signing/stripping tools; PEs downloaded over a flaky connection and truncated; CI artifacts mutated by Docker image layers or artifact managers that clip files; hand-edited PEs.","solutions":["Repair the Security directory before compiling: `osslsigncode remove-signature -i base.exe -o clean.exe` (or signtool remove on Windows) produces a consistent unsigned PE.","Re-obtain the base executable from a trusted source so the directory entry and certificate bytes agree.","Verify with `dumpbin /headers base.exe` (security directory entry) or PowerShell `Get-AuthenticodeSignature base.exe` — expect 'NotSigned' after cleaning.","Then run `bun build --compile` against the cleaned base."],"exampleFix":"# before\nbun build app.ts --compile --base signed-broken.exe --target=windows-x64  # InvalidSecurityDirectory\n# after: normalize the signature state first\nossligncode remove-signature -p '' -i signed-broken.exe -o clean.exe || osslsigncode remove-signature -i signed-broken.exe -o clean.exe\nbun build app.ts --compile --base clean.exe --target=windows-x64","handlingStrategy":"fallback","validationCode":"# Verify the security directory is consistent before compiling\npython -c \"\nimport pefile\npe = pefile.PE('base.exe')\nsd = pe.OPTIONAL_HEADER.DATA_DIRECTORY[4]\nassert sd.VirtualAddress == 0 or sd.VirtualAddress + sd.Size <= len(pe.__data__), 'security dir points past EOF'\n\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Normalize custom bases with osslsigncode remove-signature before compiling","Avoid bases that partial signing/stripping tools have touched","Sign after Bun compiles, never before"],"tags":["windows","pe","authenticode","codesigning","compile"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}