Enforced Package Signature Verification

Observed Behavior

After upgrading to Studio v2019.4 or above from an older version, some processes fail to execute. This is only applicable if package signature verification is enforced. Find out how to sign a package and how the Robot verifies a package signature.

Cause

Once the upgrade to Studio v2019.4 or above is done, the packages folder (C:\Program Files (x86)\UiPath\Studio\Packages in versions prior to 2021.4 or C:\Program Files\UiPath\Studio\Packages starting with version 2021.4) gets populated with signed activities packages, while also keeping the unsigned versions.

For example, the Packages folder contains both the Microsoft.Rest.ClientRuntime.2.3.10.nupkg (unsigned) and Microsoft.Rest.ClientRuntime.2.3.12.nupkg (signed) packages. When a process gets executed, the Robot uses the lowest applicable version to install the required package, which in our case is Microsoft.Rest.ClientRuntime.2.3.10.nupkg (unsigned). If package signature verification is enforced, then the process execution fails. Otherwise, the process is executed as expected.

Solution

There are a couple of approaches to the situation:

1. Make sure all the packages used in your automation projects are signed.

2. Modify your processes so that they request the latest package version upon execution.

   Note: If signature verification is NOT enforced, processes created with Studio prior to v2019.4 are still executed, regardless if they are signed or not.