Changeset 93249 in vbox

Timestamp:

Jan 15, 2022 1:13:13 AM (3 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

149311

Message:

/Config.kmk: Adjusted VBOX_SIGN_IMAGE_WITH_EV_FN to make it able to sign VBOX_RTSIGNTOOL itself. bugref:10162

File:

• trunk/Config.kmk (modified) (2 diffs)

trunk/Config.kmk

@@ -3980 +3980 @@
   ## Local SHA-1 and SHA-256 signatures with EV SHA-256 signature from corp code signing.
   #
-  # This builds on Plan B, since the corp code signing always replaces existing signatures.
+  # This builds on Plan B, since the corp code signing always replaces existing
+  # signatures. Since we're signing more, though, we do things slightly differently
+  # so we can apply this to VBOX_RTSIGNTOOL as well.
+  #
   # So, here is what we do.
-  #   1. Sign $1 using local SHA-1 certificate.
-  #   2. Make temporary copy of $1 as $1.ccs
-  #   3. Do SHA-256 corp code signing of $1.ccs
-  #   4. Add the SHA-256 signature from $1.ccs to $1 using bldRTSignTool.
-  #   5. Delete $1.ccs.
+  #   1. Sign $1 using the regular signing, probably dual signing it using local certs.
+  #   2. Make temporary copy of $1 as $1.dual
+  #   3. Do SHA-256 corp code signing of $1
+  #   4. Add the SHA-256 signature from $1 to $1.dual using bldRTSignTool.
+  #   5. Replace $1 with $1.dual.
   #
   # @param 1  The file to sign.
@@ -3992 +3995 @@
   # @param 3  Additional parameters. Optional.
   # @param 4  Set to 2 if the expression will be expanded twice before chopped into commands (for _CMDS).
-  # @param 5  Disables dual signing if non-empty.
+  # @param 5  Disables dual & tripple signing if non-empty.
+  # @param 6  Disables tripple signing if non-empty.
   #
   # @remarks The parameters are the same as VBOX_SIGN_FILE_FN.
   VBOX_SIGN_IMAGE_WITH_EV_FN = $(call VBOX_SIGN_FILE_FN,$1,$2,$3,$4,$5)$(if-expr "$5" == "",\
-        $(if-expr "$4" == "2",$$(NLTAB),$(NLTAB))$(RM) -f -- "$1.ccs" \
-        $(if-expr "$4" == "2",$$(NLTAB),$(NLTAB))$(CP) -- "$1" "$1.ccs" \
-        $(if-expr "$4" == "2",$$(NLTAB),$(NLTAB))$(call VBOX_CCS_SIGN_CMD,microsoftev,$1.ccs,,-digest_algo SHA2) \
-        $(if-expr "$4" == "2",$$(NLTAB),$(NLTAB))$(VBOX_RTSIGNTOOL) add-nested-$(if-expr "$(suffix $1)" == ".cat",cat,exe)-signature -v "$1" "$1.ccs" \
-        $(if-expr "$4" == "2",$$(NLTAB),$(NLTAB))$(RM) -f -- "$1.ccs" \
+        $(if-expr "$4" == "2",$$(NLTAB),$(NLTAB))$(RM) -f -- "$1.dual" \
+        $(if-expr "$4" == "2",$$(NLTAB),$(NLTAB))$(CP) -- "$1" "$1.dual" \
+        $(if-expr "$4" == "2",$$(NLTAB),$(NLTAB))$(call VBOX_CCS_SIGN_CMD,microsoftev,$1,,-digest_algo SHA2) \
+        $(if-expr "$4" == "2",$$(NLTAB),$(NLTAB))$(VBOX_RTSIGNTOOL) add-nested-$(if-expr "$(suffix $1)" == ".cat",cat,exe)-signature -v "$1.dual" "$1" \
+        $(if-expr "$4" == "2",$$(NLTAB),$(NLTAB))$(MV) -f -- "$1.dual" "$1" \
         ,)