Werk #22457: Fixed invalid signature on baked Windows agent packages

Component

Agent bakery

Title

Fixed invalid signature on baked Windows agent packages

Date

Sep 18, 2026

Level

Prominent Change

Class

Bug Fix

Compatibility

Compatible - no manual interaction needed

Checkmk versions & editions

3.0.0b1 Not yet released	Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.5.0p15 Not yet released	Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT

Since Checkmk 2.5.0, Windows agent packages built by the agent bakery kept the Authenticode signature of the shipped agent MSI even though the bakery modifies the package contents. The signature no longer matched the file it was attached to. The stripping that the bakery was supposed to do did not happen anymore.

Windows still installs such a package, so you may not have noticed. It shows up when something actually checks the signature: Get-AuthenticodeSignature reports HashMismatch rather than NotSigned, and publisher-based rules such as AppLocker or WDAC plus some endpoint protection products treat a mismatching signature more harshly than a missing one.

Baked MSI packages are now unsigned again, as they were before 2.5.0. Re-bake your Windows agent packages to pick up the fix.

To the list of all Werks