Changeset 79439 in vbox

Timestamp:

Jul 1, 2019 2:51:04 PM (6 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

131693

Message:

Installer/win: add EV signing support of driver cab in the re-packing logic (optional)

Location:

trunk

Files:

• Config.kmk (modified) (3 diffs)
• src/VBox/Installer/win/Makefile.kmk (modified) (3 diffs)
• src/VBox/Installer/win/Scripts/Combined-1-Prepare.cmd (modified) (2 diffs)
• src/VBox/Installer/win/Scripts/PackDriversForSubmission.cmd (modified) (1 diff)

trunk/Config.kmk

@@ -3500 +3500 @@
   VBOX_CERTIFICATE_SHA2_FINGERPRINT_ARGS := $(if-expr "$(VBOX_CERTIFICATE_SHA2_FINGERPRINT)" != "" \
         ,/sha1 "$(subst $(SP),,$(VBOX_CERTIFICATE_SHA2_FINGERPRINT))",) # Still using SHA-1 for fingerprinting, it's good enough for that!
+  #VBOX_CERTIFICATE_EV_SUBJECT_NAME ?= MyEvCertificate
+  VBOX_CERTIFICATE_EV_SUBJECT_NAME_ARGS ?= /n "$(VBOX_CERTIFICATE_EV_SUBJECT_NAME)"
+  VBOX_CERTIFICATE_EV_STORE ?= my
+  VBOX_CERTIFICATE_EV_STORE_ARGS ?= /s "$(VBOX_CERTIFICATE_EV_STORE)"
+  #VBOX_CERTIFICATE_EV_FINGERPRINT ?= my ev cert fingerprint
+  VBOX_CERTIFICATE_EV_FINGERPRINT_ARGS := $(if-expr "$(VBOX_CERTIFICATE_EV_FINGERPRINT)" != "" \
+        ,/sha1 "$(subst $(SP),,$(VBOX_CERTIFICATE_EV_FINGERPRINT))",) # Still using SHA-1 for fingerprinting, it's good enough for that!
 
   ## Sign a file (generic).
@@ -3531 +3538 @@
         $(VBOX_CERTIFICATE_SHA2_STORE_ARGS) \
         $(VBOX_CERTIFICATE_SHA2_SUBJECT_NAME_ARGS) \
-       $(VBOX_CERTIFICATE_SHA2_FINGERPRINT_ARGS) \
+        $(VBOX_CERTIFICATE_SHA2_FINGERPRINT_ARGS) \
         $(VBOX_TSA_SHA2_URL_ARGS) \
         $(if $(strip $(2)),/d "$(strip $(2))",) \
@@ -3541 +3548 @@
         $(VBOX_CERTIFICATE_STORE_ARGS) \
         $(VBOX_CERTIFICATE_SUBJECT_NAME_ARGS) \
-       $(VBOX_CERTIFICATE_FINGERPRINT_ARGS) \
+        $(VBOX_CERTIFICATE_FINGERPRINT_ARGS) \
         $(VBOX_TSA_URL_ARGS) \
         $(if $(strip $(2)),/d "$(strip $(2))",) \
         $(3) \
+        $(1)
+   endif
+  endif
+
+  ## EV sign a file (generic).
+  # @param 1  The file to sign.
+  ifndef VBOX_SIGN_EV_FILE_FN
+   if $(intersects win all 1,$(VBOX_WITH_CORP_CODE_SIGNING))
+    VBOX_SIGN_EV_FILE_FN  = $(call VBOX_CCS_SIGN_CMD,microsoftev,$1,$(dir $1))d$ \
+   else ifdef VBOX_CERTIFICATE_EV_SUBJECT_NAME
+    VBOX_SIGN_EV_FILE_FN  = $(VBOX_SIGNTOOL) \
+        sign /as /fd sha256 \
+        $(VBOX_CERTIFICATE_EV_STORE_ARGS) \
+        $(VBOX_CERTIFICATE_EV_SUBJECT_NAME_ARGS) \
+        $(VBOX_CERTIFICATE_EV_FINGERPRINT_ARGS) \
+        $(VBOX_TSA_SHA2_URL_ARGS) \
         $(1)
    endif

trunk/src/VBox/Installer/win/Makefile.kmk

@@ -1061 +1061 @@
         $(RePackScripts_0_OUTDIR)/sign-dual.cmd \
         $(RePackScripts_0_OUTDIR)/sign-sha1.cmd \
+        $(if-expr defined(VBOX_SIGN_EV_FILE_FN),$(RePackScripts_0_OUTDIR)/sign-ev.cmd,) \
         $(RePackScripts_0_OUTDIR)/VMMR0.inf \
         $(RePackScripts_0_OUTDIR)/VBoxExtPackPuel.inf
@@ -1076 +1077 @@
         $(RePackScripts_0_OUTDIR)/sign-dual.cmd \
         $(RePackScripts_0_OUTDIR)/sign-sha1.cmd \
+        $(RePackScripts_0_OUTDIR)/sign-ev.cmd \
         $(RePackScripts_0_OUTDIR)/VMMR0.inf \
         $(RePackScripts_0_OUTDIR)/VBoxExtPackPuel.inf
@@ -1102 +1104 @@
                 ) )
 
+$$(RePackScripts_0_OUTDIR)/sign-ev.cmd: | $$(dir $$@)
+        $(APPEND) -nt "$@" \
+                'if ".%KBUILD_DEVTOOLS%" == "." (echo KBUILD_DEVTOOLS is not set & exit /b 1)' \
+                'if ".%KBUILD_BIN_PATH%" == "." (echo KBUILD_BIN_PATH is not set & exit /b 1)' \
+                'if ".%1" == "." (echo No .cab file specified & exit /b 1)' \
+                $(subst $(KBUILD_BIN_PATH),%KBUILD_BIN_PATH%,$(subst $(KBUILD_DEVTOOLS),%KBUILD_DEVTOOLS%, \
+                '( $(call VBOX_SIGN_EV_FILE_FN,%1) ) || exit /b1' \
+                ) )
+
 $$(RePackScripts_0_OUTDIR)/VMMR0.inf: $(PATH_SUB_CURRENT)/Scripts/VMMR0.inf $(MAKEFILE_CURRENT) | $$(dir $$@)
         $(call MSG_GENERATE,RePackScripts,$@,$<)

trunk/src/VBox/Installer/win/Scripts/Combined-1-Prepare.cmd

@@ -182 +182 @@
 rem Do the packing.
 rem
-@echo **************************************************************************
-@echo Packing AMD64 drivers
-@echo **************************************************************************
+echo **************************************************************************
+echo Packing AMD64 drivers
+echo **************************************************************************
 cd /d "%_MY_REPACK_DIR_AMD64%" || goto end_failed
 call "%_MY_REPACK_DIR_AMD64%\PackDriversForSubmission.cmd" -b "%_MY_BINDIR_AMD64%" -a amd64 -e "%_MY_OPT_EXTPACK%" ^
     -o "%_MY_OPT_OUTDIR%\VBoxDrivers-%_MY_VER_REV%-amd64.cab" || goto end_failed
-@echo .
-@echo **************************************************************************
-@echo Packing X86 drivers
-@echo **************************************************************************
+echo .
+echo **************************************************************************
+echo Packing X86 drivers
+echo **************************************************************************
 cd /d "%_MY_REPACK_DIR_X86%" || goto end_failed
 call "%_MY_REPACK_DIR_X86%\PackDriversForSubmission.cmd" -b "%_MY_BINDIR_X86%" -a x86 -e "%_MY_OPT_EXTPACK%" ^
     -o "%_MY_OPT_OUTDIR%\VBoxDrivers-%_MY_VER_REV%-x86.cab" || goto end_failed
-@echo off
 echo .
 cd /d "%_MY_SAVED_CD%"
@@ -221 +220 @@
 echo *
 echo * Next steps:
-echo *   1. Sign the two files using the Oracle EV certificate.
-echo *   2. Submit the signed files to Microsoft for attestation signing.
-echo *   3. Download the signed result.
-echo *   4. "%_MY_NEXT_SCRIPT%" --signed-x86 {zip} --signed-amd64 {zip}
+echo *   1. Submit the files to Microsoft for attestation signing.
+echo *   2. Download the signed result.
+echo *   3. "%_MY_NEXT_SCRIPT%" --signed-x86 {zip} --signed-amd64 {zip}
 
 goto end

trunk/src/VBox/Installer/win/Scripts/PackDriversForSubmission.cmd

@@ -246 +246 @@
 rem Note! MakeCab is shipped on W10, so we ASSUME it's in the PATH.
 rem
-MakeCab.exe /v2 /F "%_MY_OPT_DDF_FILE%"
+MakeCab.exe /v2 /F "%_MY_OPT_DDF_FILE%" || goto end_failed
+
+rem
+rem EV sign the cabient file.
+rem
+if not exist "sign-ev.cmd" goto end
+call sign-ev.cmd "%_MY_OPT_OUTPUT%" || goto end_failed
 
 goto end