Changeset 96692 in vbox for trunk/Config.kmk

Timestamp:

Sep 12, 2022 12:39:59 AM (2 years ago)

Author:

vboxsync

Message:

Add/Nt/Installer,/Config.kmk,SupDrv/Certs: Check for and install missing root certificates. This is a real problem with vista and older. bugref:10261

File:

• trunk/Config.kmk (modified) (5 diffs)

trunk/Config.kmk

@@ -179 +179 @@
 
 
+#
+# Some source paths of global interest.
+#
+VBOX_PATH_SRC_CERTIFICATES = $(PATH_ROOT)/src/VBox/HostDrivers/Support/Certificates
+
+
+#
 # Delete targets on failure.
+#
 .DELETE_ON_ERROR:
 
+#
 # Notify about important kBuild updates.
+#
 if  $(KBUILD_VERSION_MAJOR) == 0 \
  && (   $(KBUILD_VERSION_MINOR) >= 2 \
@@ -330 +340 @@
 endif
 
+
 #
 # The VirtualBox Configuration Defaults.
@@ -409 +420 @@
 # (Used by the additions build server, don't invert it.)
 #VBOX_WITHOUT_ADDITIONS_ISO = 1
+# Include root certs in the windows GAs installer and on the ISO (ignore when
+# signing is disabled).  Since we don't have any runtime detection of which
+# roots are actually being used, we expect shipping of the non-default root
+# with the signing setup in LocalConfig.kmk.  Following root cert selectors
+# are available (more details in GA tools & installer):
+#       - VBOX_WITH_GA_ROOT_VERISIGN_G5
+#       - VBOX_WITH_GA_ROOT_DIGICERT_ASSURED_ID
+#       - VBOX_WITH_GA_ROOT_DIGICERT_HIGH_ASSURANCE_EV
+VBOX_WITH_GA_ROOT_CERTS_INCLUDED := 1
+if (!defined(VBOX_CERTIFICATE_SUBJECT_NAME) || !defined(VBOX_CERTIFICATE_SHA2_SUBJECT_NAME)) && "$(VBOX_SIGNING_MODE)" == "release"
+ VBOX_WITH_GA_ROOT_DIGICERT_ASSURED_ID := 1
+endif
 ## @}
+
 # Set build options right for building the Additions as an RPM package.
 # VBOX_ONLY_RPM_ADDITIONS = 1
@@ -4271 +4295 @@
    VBOX_SIGN_IMAGE_CMDS_ORDERDEPS ?= $(if $(eq $(tool_do),LINK_LIBRARY),,$(VBOX_SIGN_IMAGE_ORDERDEPS))
   endif
-  ## Enable signing of the additions.
+  ## Enable signing of the additions drivers, i.e. create CAT files.
+  ## @todo r=bird: This bugger is entirely misplaced, as it belongs in the additions config section so it can be properly overriden.
   VBOX_SIGN_ADDITIONS   ?= 1
   ## Set if we should include the legacy timestamp CA.
@@ -4279 +4304 @@
    endif
   endif
-  VBOX_LEGACY_TS_CA_FILE = $(PATH_ROOT)/src/VBox/HostDrivers/Support/Certificates/Timestamp-VBoxLegacyWinCA.crt
+  VBOX_LEGACY_TS_CA_FILE = $(VBOX_PATH_SRC_CERTIFICATES)/Timestamp-VBoxLegacyWinCA.crt
 
  else ifeq ($(KBUILD_HOST),darwin)