oven-sh/bun · error · bun_exe_format::pe::Error

InvalidSecurityDirectory

Error message

InvalidSecurityDirectory

What it means

While stripping Authenticode, the Security data directory (index 4) points outside the file: the certificate-table file offset is >= file length (src/exe_format/pe.rs:375-377), or the 8-byte-aligned end of the certificate blob exceeds EOF (src/exe_format/pe.rs:383-386). The directory claims a signature that is not actually present in the bytes, so it cannot be safely removed.

Source

Thrown at src/exe_format/pe.rs:33

    #[error("Overflow")]
    Overflow,
    #[error("InvalidPEFile")]
    InvalidPEFile,
    #[error("InvalidDOSSignature")]
    InvalidDOSSignature,
    #[error("InvalidPESignature")]
    InvalidPESignature,
    #[error("UnsupportedPEFormat")]
    UnsupportedPEFormat,
    #[error("InsufficientHeaderSpace")]
    InsufficientHeaderSpace,
    #[error("TooManySections")]
    TooManySections,
    #[error("SectionExists")]
    SectionExists,
    #[error("InputIsSigned")]
    InputIsSigned,
    #[error("InvalidSecurityDirectory")]
    InvalidSecurityDirectory,
    #[error("SecurityDirInsideImage")]
    SecurityDirInsideImage,
    #[error("UnexpectedOverlayPresent")]
    UnexpectedOverlayPresent,
    #[error("InsufficientSpace")]
    InsufficientSpace,
}

/// Windows PE Binary manipulation for codesigning standalone executables
pub struct PEFile {
    pub(crate) data: Vec<u8>,
    // Store offsets instead of pointers to avoid invalidation after resize
    pub(crate) pe_header_offset: usize,
    pub(crate) optional_header_offset: usize,
    pub(crate) section_headers_offset: usize,
    pub(crate) num_sections: u16,
}

View on GitHub (pinned to 8c5296ac45)

Solutions

  1. Repair the Security directory before compiling: `osslsigncode remove-signature -i base.exe -o clean.exe` (or signtool remove on Windows) produces a consistent unsigned PE.
  2. Re-obtain the base executable from a trusted source so the directory entry and certificate bytes agree.
  3. Verify with `dumpbin /headers base.exe` (security directory entry) or PowerShell `Get-AuthenticodeSignature base.exe` — expect 'NotSigned' after cleaning.
  4. Then run `bun build --compile` against the cleaned base.

Example fix

# before
bun build app.ts --compile --base signed-broken.exe --target=windows-x64  # InvalidSecurityDirectory
# after: normalize the signature state first
ossligncode remove-signature -p '' -i signed-broken.exe -o clean.exe || osslsigncode remove-signature -i signed-broken.exe -o clean.exe
bun build app.ts --compile --base clean.exe --target=windows-x64
Defensive patterns

Strategy: fallback

Validate before calling

# Verify the security directory is consistent before compiling
python -c "
import pefile
pe = pefile.PE('base.exe')
sd = pe.OPTIONAL_HEADER.DATA_DIRECTORY[4]
assert sd.VirtualAddress == 0 or sd.VirtualAddress + sd.Size <= len(pe.__data__), 'security dir points past EOF'
"

Prevention

When it happens

Trigger: `bun build --compile --target=windows` on a base exe whose Security directory VA/Size fields are stale or corrupt — e.g. the file was truncated after signing, a signature-stripping tool zeroed the certificate bytes but left the directory entry, or a packer rewrote offsets without updating the directory.

Common situations: Base executables processed by half-finished signing/stripping tools; PEs downloaded over a flaky connection and truncated; CI artifacts mutated by Docker image layers or artifact managers that clip files; hand-edited PEs.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/4a4fd77064ef8205. Report an issue: GitHub.