VirtualBox

Changeset 96766 in vbox for trunk/src/VBox/Additions


Ignore:
Timestamp:
Sep 16, 2022 12:00:23 PM (2 years ago)
Author:
vboxsync
Message:

Add/Nt/Installer,Add/Nt/Tools,Add/Makefile,/Config.kmk: Use bldRTSignTool to extract the root certificates and always ship+install them, except for the legacy TS CA which won't be installed on W10. bugref:8691

Location:
trunk/src/VBox/Additions
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/VBox/Additions/Makefile.kmk

    r96692 r96766  
    291291
    292292if defined(VBOX_WITH_ADDITIONS_ISO.win.amd64) || defined(VBOX_WITH_ADDITIONS_ISO.win.x86)
     293 # Note! This probably only work reliably when packing is also done on a windows host!
    293294 ifndef VBOX_SIGNING_MODE
    294295  GUESTADDITIONS_FILESPEC.win =
    295296 else if !defined(VBOX_CERTIFICATE_SHA2_SUBJECT_NAME) && !$(intersects win all 1,$(VBOX_WITH_CORP_CODE_SIGNING))
    296   GUESTADDITIONS_FILESPEC.win = cert/vbox.cer=$(VBOX_PATH_ADDITIONS.win)/vbox.cer
     297  GUESTADDITIONS_FILESPEC.win = \
     298        cert/vbox.cer=$(VBOX_PATH_ADDITIONS.win)/vbox.cer \
     299        cert/vbox-root.cer=$(VBOX_PATH_ADDITIONS.win)/vbox-root.cer
     300  ifdef VBOX_TSA_URL_ARGS
     301   GUESTADDITIONS_FILESPEC.win += cert/vbox-timestamp-root.cer=$(VBOX_PATH_ADDITIONS.win)/vbox-timestamp-root.cer
     302  endif
    297303 else
    298304  GUESTADDITIONS_FILESPEC.win = \
    299305        cert/vbox-sha1.cer=$(VBOX_PATH_ADDITIONS.win)/vbox-sha1.cer \
     306        cert/vbox-sha1-root.cer=$(VBOX_PATH_ADDITIONS.win)/vbox-sha1-root.cer \
     307        cert/vbox-sha256-root.cer=$(VBOX_PATH_ADDITIONS.win)/vbox-sha256-root.cer \
    300308        cert/vbox-sha256.cer=$(VBOX_PATH_ADDITIONS.win)/vbox-sha256.cer
     309  ifdef VBOX_TSA_URL_ARGS
     310   GUESTADDITIONS_FILESPEC.win += cert/vbox-sha1-timestamp-root.cer=$(VBOX_PATH_ADDITIONS.win)/vbox-sha1-timestamp-root.cer
     311  endif
     312  ifdef VBOX_TSA_SHA2_URL_ARGS
     313   GUESTADDITIONS_FILESPEC.win += cert/vbox-sha256-timestamp-root.cer=$(VBOX_PATH_ADDITIONS.win)/vbox-sha256-timestamp-root.cer
     314  endif
    301315  if $(intersects win_planb,$(VBOX_WITH_CORP_CODE_SIGNING))
    302    GUESTADDITIONS_FILESPEC.win += cert/vbox-sha256-r3.cer=$(VBOX_PATH_ADDITIONS.win)/vbox-sha256-r3.cer
    303   endif
    304  endif
    305  ifdef VBOX_WITH_VBOX_LEGACY_TS_CA
    306   GUESTADDITIONS_FILESPEC.win += cert/vbox-legacy-timestamp-ca.cer=$(VBOX_PATH_ADDITIONS.win)/vbox-legacy-timestamp-ca.cer
    307  endif
    308  ifdef VBOX_WITH_GA_ROOT_CERTS_INCLUDED
    309   ifdef VBOX_WITH_GA_ROOT_VERISIGN_G5
    310    GUESTADDITIONS_FILESPEC.win += cert/root-versign-pca3-g5.cer=$(VBOX_PATH_ADDITIONS.win)/root-versign-pca3-g5.cer
    311   endif
    312   ifdef VBOX_WITH_GA_ROOT_DIGICERT_ASSURED_ID
    313    GUESTADDITIONS_FILESPEC.win += cert/root-digicert-assured-id.cer=$(VBOX_PATH_ADDITIONS.win)/root-digicert-assured-id.cer
    314   endif
    315   ifdef VBOX_WITH_GA_ROOT_DIGICERT_HIGH_ASSURANCE_EV
    316    GUESTADDITIONS_FILESPEC.win += cert/root-digicert-high-assurance-ev.cer=$(VBOX_PATH_ADDITIONS.win)/root-digicert-high-assurance-ev.cer
     316   GUESTADDITIONS_FILESPEC.win += \
     317        cert/vbox-sha256-r3.cer=$(VBOX_PATH_ADDITIONS.win)/vbox-sha256-r3.cer \
     318        cert/vbox-sha256-r3-root.cer=$(VBOX_PATH_ADDITIONS.win)/vbox-sha256-r3-root.cer \
     319        cert/vbox-sha256-r3-timestamp-root.cer=$(VBOX_PATH_ADDITIONS.win)/vbox-sha256-r3-timestamp-root.cer
    317320  endif
    318321 endif

  • trunk/src/VBox/Additions/WINNT/Installer/Makefile.kmk

    r96698 r96766  
    8686RegCleanup_VBOX_IMPORT_CHECKER.win.x86 := nt4
    8787
     88
     89#
     90# Install all the certificates we use.
     91#
     92INSTALLS += AdditionsInstCertFiles
     93AdditionsInstCertFiles_TEMPLATE := VBoxGuestR3Exe
     94AdditionsInstCertFiles_SOURCES   =
     95AdditionsInstCertFiles_CLEAN     =
     96if defined(VBOX_SIGNING_MODE) && defined(VBOX_SIGN_ADDITIONS)
     97 define def_VBoxAdditionsInstCertFiles
     98  AdditionsInstCertFiles_SOURCES += $$(AdditionsInstCertFiles_0_OUTDIR)/$(1)=>$1
     99  AdditionsInstCertFiles_CLEAN   += $$(AdditionsInstCertFiles_0_OUTDIR)/$(1)
     100  $$$$(AdditionsInstCertFiles_0_OUTDIR)/$(1): $$(2) | $$$$(dir $$$$@) $(VBOX_RTSIGNTOOL)
     101        $(QUIET)$(RM) -f -- "$$@"
     102        $(VBOX_RTSIGNTOOL) $3 --signature-index $4 --input "$$<" --output "$$@"
     103 endef
     104
     105 if !defined(VBOX_CERTIFICATE_SHA2_SUBJECT_NAME) && !$(intersects win all 1,$(VBOX_WITH_CORP_CODE_SIGNING))
     106  $(evalcall2 def_VBoxAdditionsInstCertFiles,vbox.cer,$(VBOX_PATH_ADDITIONS)/VBoxGuest.sys, \
     107        extract-exe-signer-cert, 0)
     108  VBOX_GA_CERT_ROOT_SHA1 := vbox-root.cer
     109  $(evalcall2 def_VBoxAdditionsInstCertFiles,$(VBOX_GA_CERT_ROOT_SHA1),$(VBOX_PATH_ADDITIONS)/VBoxGuest.sys, \
     110        extract-signer-root --self-signed-roots-from-system, 0)
     111  ifdef VBOX_TSA_URL_ARGS
     112   VBOX_GA_CERT_ROOT_SHA1_TS := vbox-timestamp-root.cer
     113   $(evalcall2 def_VBoxAdditionsInstCertFiles,$(VBOX_GA_CERT_ROOT_SHA1_TS),$(VBOX_PATH_ADDITIONS)/VBoxGuest.sys, \
     114        extract-timestamp-root --self-signed-roots-from-system, 0)
     115  endif
     116 else
     117  $(evalcall2 def_VBoxAdditionsInstCertFiles,vbox-sha1.cer,$(VBOX_PATH_ADDITIONS)/VBoxGuest.sys, \
     118        extract-exe-signer-cert, 0)
     119  VBOX_GA_CERT_ROOT_SHA1 := vbox-sha1-root.cer
     120  $(evalcall2 def_VBoxAdditionsInstCertFiles,$(VBOX_GA_CERT_ROOT_SHA1),$(VBOX_PATH_ADDITIONS)/VBoxGuest.sys, \
     121        extract-signer-root --self-signed-roots-from-system, 0)
     122  ifdef VBOX_TSA_URL_ARGS
     123   VBOX_GA_CERT_ROOT_SHA1_TS := vbox-sha1-timestamp-root.cer
     124   $(evalcall2 def_VBoxAdditionsInstCertFiles,$(VBOX_GA_CERT_ROOT_SHA1_TS),$(VBOX_PATH_ADDITIONS)/VBoxGuest.sys, \
     125        extract-timestamp-root --self-signed-roots-from-system, 0)
     126  endif
     127
     128  $(evalcall2 def_VBoxAdditionsInstCertFiles,vbox-sha256.cer,$(VBOX_PATH_ADDITIONS)/VBoxGuest.sys, \
     129        extract-exe-signer-cert, 1)
     130  VBOX_GA_CERT_ROOT_SHA2 := vbox-sha256-root.cer
     131  $(evalcall2 def_VBoxAdditionsInstCertFiles,$(VBOX_GA_CERT_ROOT_SHA2),$(VBOX_PATH_ADDITIONS)/VBoxGuest.sys, \
     132        extract-signer-root --self-signed-roots-from-system, 1)
     133  ifdef VBOX_TSA_SHA2_URL_ARGS
     134   VBOX_GA_CERT_ROOT_SHA2_TS := vbox-sha256-timestamp-root.cer
     135   $(evalcall2 def_VBoxAdditionsInstCertFiles,$(VBOX_GA_CERT_ROOT_SHA2_TS),$(VBOX_PATH_ADDITIONS)/VBoxGuest.sys, \
     136        extract-timestamp-root --self-signed-roots-from-system, 1)
     137  endif
     138
     139  if $(intersects win_planb,$(VBOX_WITH_CORP_CODE_SIGNING))
     140   $(evalcall2 def_VBoxAdditionsInstCertFiles,vbox-sha256-r3.cer,$(VBOX_PATH_ADDITIONS)/VBoxDrvInst.exe, \
     141        extract-exe-signer-cert, 1)
     142   VBOX_GA_CERT_ROOT_SHA2_R3 := vbox-sha256-r3-root.cer
     143   $(evalcall2 def_VBoxAdditionsInstCertFiles,$(VBOX_GA_CERT_ROOT_SHA2_R3),$(VBOX_PATH_ADDITIONS)/VBoxDrvInst.exe, \
     144        extract-signer-root --self-signed-roots-from-system, 1)
     145   VBOX_GA_CERT_ROOT_SHA2_R3_TS := vbox-sha256-r3-timestamp-root.cer
     146   $(evalcall2 def_VBoxAdditionsInstCertFiles,$(VBOX_GA_CERT_ROOT_SHA2_R3_TS),$(VBOX_PATH_ADDITIONS)/VBoxDrvInst.exe, \
     147        extract-timestamp-root --self-signed-roots-from-system, 1)
     148  endif
     149 endif
     150endif
    88151
    89152#
    … …  
    179242endif
    180243
    181 if defined(VBOX_SIGNING_MODE) && defined(VBOX_SIGN_ADDITIONS)
    182  ifdef VBOX_WITH_VBOX_LEGACY_TS_CA
    183 VBOX_WINDOWS_ADDITIONS_OTHER_FILES += $(PATH_STAGE_BIN)/additions/vbox-legacy-timestamp-ca.cer
    184  endif
    185  ifdef VBOX_WITH_GA_ROOT_CERTS_INCLUDED
    186   ifdef VBOX_WITH_GA_ROOT_VERISIGN_G5
    187 VBOX_WINDOWS_ADDITIONS_OTHER_FILES += $(PATH_STAGE_BIN)/additions/root-versign-pca3-g5.cer
    188   endif
    189   ifdef VBOX_WITH_GA_ROOT_DIGICERT_ASSURED_ID
    190 VBOX_WINDOWS_ADDITIONS_OTHER_FILES += $(PATH_STAGE_BIN)/additions/root-digicert-assured-id.cer
    191   endif
    192   ifdef VBOX_WITH_GA_ROOT_DIGICERT_HIGH_ASSURANCE_EV
    193 VBOX_WINDOWS_ADDITIONS_OTHER_FILES += $(PATH_STAGE_BIN)/additions/root-digicert-high-assurance-ev.cer
    194   endif
    195  endif
    196 endif
     244VBOX_WINDOWS_ADDITIONS_OTHER_FILES += $(addprefix $(PATH_STAGE_BIN)/additions/, \
     245        $(VBOX_GA_CERT_ROOT_SHA1) \
     246        $(VBOX_GA_CERT_ROOT_SHA1_TS) \
     247        $(VBOX_GA_CERT_ROOT_SHA2) \
     248        $(VBOX_GA_CERT_ROOT_SHA2_TS) \
     249        $(VBOX_GA_CERT_ROOT_SHA2_R3) \
     250        $(VBOX_GA_CERT_ROOT_SHA2_R3_TS))
    197251
    198252VB_WIN_ADD_NSIS_ENV := \
    … …  
    225279        $(foreach lang,$(VBOX_INSTALLER_ADD_LANGUAGES),-E 'VBOX_BRAND_$(lang)_LICENSE_RTF=$(VBOX_BRAND_$(lang)_LICENSE_RTF)') \
    226280        -E 'KBUILD_TYPE=$(KBUILD_TYPE)' \
    227         -E 'KBUILD_TARGET_ARCH=$(KBUILD_TARGET_ARCH)'
     281        -E 'KBUILD_TARGET_ARCH=$(KBUILD_TARGET_ARCH)' \
     282       $(foreach base, VBOX_GA_CERT_ROOT_SHA1 VBOX_GA_CERT_ROOT_SHA2 VBOX_GA_CERT_ROOT_SHA2_R3 \
     283       ,-E '$(base)=$(firstword $($(base)) none)' -E '$(base)_TS=$(firstword $($(base)_TS) none)')
    228284
    229285$(PATH_STAGE_BIN)/additions/VBoxWindowsAdditions-$(KBUILD_TARGET_ARCH).exe: \
    … …  
    263319                       $(if-expr defined(VBOX_SIGN_ADDITIONS) && defined(VBOX_SIGNING_MODE), \
    264320                        '/DVBOX_SIGN_ADDITIONS=1' \
    265                         $(if-expr defined(VBOX_WITH_GA_ROOT_CERTS_INCLUDED)            ,'/DVBOX_WITH_GA_ROOT_CERTS_INCLUDED=1',) \
    266                         $(if-expr defined(VBOX_WITH_GA_ROOT_VERISIGN_G5)               ,'/DVBOX_WITH_GA_ROOT_VERISIGN_G5=1',) \
    267                         $(if-expr defined(VBOX_WITH_GA_ROOT_DIGICERT_ASSURED_ID)       ,'/DVBOX_WITH_GA_ROOT_DIGICERT_ASSURED_ID=1',) \
    268                         $(if-expr defined(VBOX_WITH_GA_ROOT_DIGICERT_HIGH_ASSURANCE_EV),'/DVBOX_WITH_GA_ROOT_DIGICERT_HIGH_ASSURANCE_EV=1',) \
    269                                 $(if-expr defined(VBOX_WITH_VBOX_LEGACY_TS_CA)                 ,'/DVBOX_WITH_VBOX_LEGACY_TS_CA=1') \
     321                                $(if-expr defined(VBOX_WITH_VBOX_LEGACY_TS_CA),'/DVBOX_WITH_VBOX_LEGACY_TS_CA=1') \
    270322                       ,) \
    271323                        $(if $(VBOX_INSTALLER_ADD_LANGUAGES),'/DVBOX_INSTALLER_ADD_LANGUAGES=1') \

  • trunk/src/VBox/Additions/WINNT/Installer/VBoxGuestAdditionsW2KXP.nsh

    r96696 r96766  
    161161
    162162!ifdef VBOX_SIGN_ADDITIONS
    163   !ifdef VBOX_WITH_GA_ROOT_VERISIGN_G5 | VBOX_WITH_GA_ROOT_DIGICERT_ASSURED_ID | VBOX_WITH_GA_ROOT_DIGICERT_HIGH_ASSURANCE_EV
    164 
    165163;;
    166 ; Checks
    167 ;
    168 ; @param    pop1    The RDN of the certificate.
    169 ; @param    pop2    Filename (cert dir) if we're shipping it (VBOX_WITH_GA_ROOT_CERTS_INCLUDED).
    170 ; @param    pop3    The direct download URL link.
    171 ; @param    pop4    The message to display if missing.
    172 ;
    173 Function W2K_RootCertCheck
    174   ;
    175   ; Prolog: Save $0, $1, $2, $3 and move the parameters into them. Also save $4 for results.
    176   ;
     164; Run VBoxCertUtil to install the given certificate if absent on the system.
     165;
     166; @param    pop1    The certificate file.
     167; @param    pop2    Short description.
     168;
     169Function   W2K_InstallRootCert
     170  ; Prolog: Save $0 & $1 and move the parameters into them.
    177171  Push    $0
    178   Exch    4
     172  Exch    2
    179173  Push    $1
    180   Exch    4
    181   Push    $2
    182   Exch    4
    183   Push    $3
    184   Exch    4
    185   Pop     $0                                ; RDN
    186   Pop     $1                                ; Filename
    187   Pop     $2                                ; Direct URL
    188   Pop     $3                                ; Missing message
    189   Push    $4
    190 
    191   ;
    192   ; Run VBoxCertUtil to check.
    193   ;
    194   ${LogVerbose} "Checking if $0 is installed ..."
    195   ${If} ${Silent}
    196     nsExec::ExecToStack "$\"$INSTDIR\cert\VBoxCertUtil.exe$\" root-exists $\"$0$\""
    197     Exch 1
    198     Pop  $4                                 ; output
    199     ${LogVerbose} "$4"
    200     Pop  $4                                 ; exit code
    201   ${Else}
    202     nsExec::ExecToLog   "$\"$INSTDIR\cert\VBoxCertUtil.exe$\" root-exists $\"$0$\""
    203     Pop  $4                                 ; exit code
    204   ${EndIf}
    205   ${LogVerbose} "Exit code: $4"
    206 
    207   ;
    208   ; VBoxCertUtil terminates with exit code 10 if not found, 0 if found and something else on failure.
    209   ;
    210   ${If} $4 == 0
    211     ${LogVerbose} "Root certificate is present."
    212   ${ElseIf} $4 == 10
    213   !ifdef VBOX_WITH_GA_ROOT_CERTS_INCLUDED
    214     ${LogVerbose} "Root certificate is _NOT_ present.  Installing it ..."
    215     ${CmdExecute} "$\"$INSTDIR\cert\VBoxCertUtil.exe$\" add-root $\"$INSTDIR\cert\$1$\"" 'non-zero-exitcode=abort'
    216   !else
    217     ${LogVerbose} "Root certificate is _NOT_ present.  The certificate can be downloaded from $2 and installed using '$INSTDIR\cert\VBoxCertUtil.exe'."
    218     MessageBox MB_YESNO $3 /SD IDYES IDYES l_dont_abort
    219     Abort "Missing signing root certificate $0"
    220 l_dont_abort:
    221   !endif
    222   ${ElseIf} $R4 <> 0
    223     ${LogVerbose} "Unable to determine whether the root certificate was present. Assuming the worst."
    224     Abort "Error when checking whether signing root certificate '$0' was present: $4"
    225   ${EndIf}
    226 
    227   ;
    228   ; Epilog: Restore $0-$4 (we return nothing).
    229   ;
    230   Pop     $4
    231   Pop     $3
     174  Exch    2
     175  Pop     $0                                ; Filename
     176  Pop     $1                                ; Description.
     177
     178  ; Do the work.
     179  ${LogVerbose} "Installing $1 ('$0') if missing ..."
     180  ${CmdExecute} "$\"$INSTDIR\cert\VBoxCertUtil.exe$\" add-root --add-if-new $\"$INSTDIR\cert\$0$\"" 'non-zero-exitcode=abort'
     181
     182  ; Epilog: Restore $0 & $1 (we return nothing).
    232183  Pop     $2
    233184  Pop     $1
    234185  Pop     $0
    235186FunctionEnd
    236   !endif
    237187!endif
    238188
    … …  
    263213!ifdef VBOX_SIGN_ADDITIONS
    264214  ;
    265   ; When installing signed GAs, we need to check whether the root certs are
    266   ; present, we use VBoxCertUtil for this task.  This utility is also used
    267   ; for installing missing root certs we can ship, like the special timestamp
    268   ; root further down.
     215  ; When installing signed GAs, we need to make sure that the associated root
     216  ; certs are present, we use VBoxCertUtil for this task.
    269217  ;
    270218  ${LogVerbose} "Installing VBoxCertUtil.exe ..."
    271219  SetOutPath "$INSTDIR\cert"
    272220  FILE "$%PATH_OUT%\bin\additions\VBoxCertUtil.exe"
    273   !ifdef VBOX_WITH_VBOX_LEGACY_TS_CA
    274   FILE "$%PATH_OUT%\bin\additions\vbox-legacy-timestamp-ca.cer"
    275   !endif
    276   !ifdef VBOX_WITH_GA_ROOT_CERTS_INCLUDED
    277     !ifdef VBOX_WITH_GA_ROOT_VERISIGN_G5
    278   FILE "$%PATH_OUT%\bin\additions\root-versign-pca3-g5.cer"
    279     !endif
    280     !ifdef VBOX_WITH_GA_ROOT_DIGICERT_ASSURED_ID
    281   FILE "$%PATH_OUT%\bin\additions\root-digicert-assured-id.cer"
    282     !endif
    283     !ifdef VBOX_WITH_GA_ROOT_DIGICERT_HIGH_ASSURANCE_EV
    284   FILE "$%PATH_OUT%\bin\additions\root-digicert-high-assurance-ev.cer"
    285     !endif
    286   !endif
    287 
    288   ; Now that the files are in place, do the checking.
    289   !ifdef VBOX_WITH_GA_ROOT_VERISIGN_G5
    290   Push $(VBOX_CA_CHECK_VERISIGN_G5)
    291   Push "http://cacerts.digicert.com/pca3-g5.crt"
    292   Push "root-versign-pca3-g5.cer"
    293   Push "C=US; O=VeriSign, Inc.; OU=VeriSign Trust Network; OU=(c) 2006 VeriSign, Inc. - For authorized use only; CN=VeriSign Class 3 Public Primary Certification Authority - G5"
    294   Call W2K_RootCertCheck
    295   !endif
    296 
    297   !ifdef VBOX_WITH_GA_ROOT_DIGICERT_ASSURED_ID
    298   Push $(VBOX_CA_CHECK_DIGICERT_ASSURED_ID)
    299   Push "https://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt"
    300   Push "root-digicert-assured-id.cer"
    301   Push "C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert Assured ID Root CA"
    302   Call W2K_RootCertCheck
    303   !endif
    304 
    305   !ifdef VBOX_WITH_GA_ROOT_DIGICERT_HIGH_ASSURANCE_EV
    306   Push $(VBOX_CA_CHECK_DIGICERT_HIGH_ASSURANCE_EV)
    307   Push "https://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt"
    308   Push "root-digicert-high-assurance-ev.cer"
    309   Push "C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert High Assurance EV Root CA"
    310   Call W2K_RootCertCheck
    311   !endif
    312 
    313   !ifdef VBOX_WITH_VBOX_LEGACY_TS_CA
    314   ;
    315   ; Install the legacy timestamp CA if required/requested.
    316   ;
    317 
    318   ; If not explicitly specified, let the detected Windows version decide what to do.
    319   ; On guest OSes < Windows 10 we always go for the PreW10 drivers and install our legacy timestamp CA.
     221  !if  "$%VBOX_GA_CERT_ROOT_SHA1%" != "none"
     222  FILE "$%PATH_OUT%\bin\additions\$%VBOX_GA_CERT_ROOT_SHA1%"
     223  !endif
     224  !if  "$%VBOX_GA_CERT_ROOT_SHA1_TS%" != "none"
     225  FILE "$%PATH_OUT%\bin\additions\$%VBOX_GA_CERT_ROOT_SHA1_TS%"
     226  !endif
     227  !if  "$%VBOX_GA_CERT_ROOT_SHA2%" != "none"
     228  FILE "$%PATH_OUT%\bin\additions\$%VBOX_GA_CERT_ROOT_SHA2%"
     229  !endif
     230  !if  "$%VBOX_GA_CERT_ROOT_SHA2_TS%" != "none"
     231  FILE "$%PATH_OUT%\bin\additions\$%VBOX_GA_CERT_ROOT_SHA2_TS%"
     232  !endif
     233  !if  "$%VBOX_GA_CERT_ROOT_SHA2_R3%" != "none"
     234  FILE "$%PATH_OUT%\bin\additions\$%VBOX_GA_CERT_ROOT_SHA2_R3%"
     235  !endif
     236  !if  "$%VBOX_GA_CERT_ROOT_SHA2_R3_TS%" != "none"
     237  FILE "$%PATH_OUT%\bin\additions\$%VBOX_GA_CERT_ROOT_SHA2_R3_TS%"
     238  !endif
     239
     240  ;
     241  ; Install the certificates if missing.
     242  ;
     243  !if  "$%VBOX_GA_CERT_ROOT_SHA1%" != "none"
     244  Push "SHA-1 root"
     245  Push "$%VBOX_GA_CERT_ROOT_SHA1%"
     246  Call W2K_InstallRootCert
     247  !endif
     248  !if  "$%VBOX_GA_CERT_ROOT_SHA1_TS%" != "none"
     249    !ifdef VBOX_WITH_VBOX_LEGACY_TS_CA
     250  ; If not explicitly specified, let the detected Windows version decide what
     251  ; to do. On guest OSes < Windows 10 we always go for the PreW10 security
     252  ; catalog files (.cat) and there we install our legacy timestamp CA by default.
    320253  ${If}    $g_bInstallTimestampCA == "unset"
    321254  ${AndIf} $g_strWinVersion != "10"
    322255      StrCpy $g_bInstallTimestampCA "true"
    323256  ${EndIf}
    324 
    325257  ${If} $g_bInstallTimestampCA == "true"
    326     ${LogVerbose} "Installing legacy timestamp CA certificate ..."
    327     ${CmdExecute} "$\"$INSTDIR\cert\VBoxCertUtil.exe$\" add-root $\"$INSTDIR\cert\vbox-legacy-timestamp-ca.cer$\"" 'non-zero-exitcode=log'
    328     ${CmdExecute} "$\"$INSTDIR\cert\VBoxCertUtil.exe$\" display-all" 'non-zero-exitcode=log'
    329   ${EndIf}
    330   !endif ; VBOX_WITH_VBOX_LEGACY_TS_CA
    331 
     258    Push "SHA-1 timestamp root"
     259    Push "$%VBOX_GA_CERT_ROOT_SHA1_TS%"
     260    Call W2K_InstallRootCert
     261  ${EndIf}
     262    !else
     263  Push "SHA-1 timestamp root"
     264  Push "$%VBOX_GA_CERT_ROOT_SHA1_TS%"
     265  Call W2K_InstallRootCert
     266    !endif ; VBOX_WITH_VBOX_LEGACY_TS_CA
     267  !endif
     268
     269  ; XP sp3 and later can make use of SHA-2 certs. Windows 2000 cannot.
     270  ; Note that VBOX_GA_CERT_ROOT_SHA1 may be a SHA-2 cert, the hash algorithm
     271  ; refers to the windows signature structures not the certificate.
     272  ${If} $g_strWinVersion != "2000"
     273  !if  "$%VBOX_GA_CERT_ROOT_SHA2%" != "none"
     274    Push "SHA-2 root"
     275    Push "$%VBOX_GA_CERT_ROOT_SHA2%"
     276    Call W2K_InstallRootCert
     277  !endif
     278  !if  "$%VBOX_GA_CERT_ROOT_SHA2_TS%" != "none"
     279    Push "SHA-2 timestamp root"
     280    Push "$%VBOX_GA_CERT_ROOT_SHA2_TS%"
     281    Call W2K_InstallRootCert
     282  !endif
     283  !if  "$%VBOX_GA_CERT_ROOT_SHA2_R3%" != "none"
     284    Push "SHA-2 ring-3 root"
     285    Push "$%VBOX_GA_CERT_ROOT_SHA2_R3%"
     286    Call W2K_InstallRootCert
     287  !endif
     288  !if  "$%VBOX_GA_CERT_ROOT_SHA2_R3_TS%" != "none"
     289    Push "SHA-2 ring-3 timestamp root"
     290    Push "$%VBOX_GA_CERT_ROOT_SHA2_R3_TS%"
     291    Call W2K_InstallRootCert
     292  !endif
     293  ${EndIf}
     294
     295  ; Log the certificates present on the system.
     296  ${CmdExecute} "$\"$INSTDIR\cert\VBoxCertUtil.exe$\" display-all" 'non-zero-exitcode=log'
    332297!endif ; VBOX_SIGN_ADDITIONS
    333298

  • trunk/src/VBox/Additions/WINNT/tools/Makefile.kmk

    r96692 r96766  
    4444
    4545#
    46 # Install all the certificates we use here.
    47 #
    48 INSTALLS += AdditionsInstCertFiles
    49 AdditionsInstCertFiles_TEMPLATE = VBoxGuestR3Exe
    50 AdditionsInstCertFiles_SOURCES  =
    51 AdditionsInstCertFiles_CLEAN    =
    52 ifdef VBOX_SIGNING_MODE
    53  define def_VBoxAdditionsInstCertFiles
    54   AdditionsInstCertFiles_SOURCES += $$(AdditionsInstCertFiles_0_OUTDIR)/$(1)=>$1
    55   AdditionsInstCertFiles_CLEAN   += $$(AdditionsInstCertFiles_0_OUTDIR)/$(1)
    56   $$$$(AdditionsInstCertFiles_0_OUTDIR)/$(1): $$(2) | $$$$(dir $$$$@) $(VBOX_RTSIGNTOOL)
    57         $(QUIET)$(RM) -f -- "$$@"
    58         $(VBOX_RTSIGNTOOL) extract-exe-signer-cert --signature-index $3 --exe "$$<" --output "$$@" --der
    59  endef
    60 
    61  if !defined(VBOX_CERTIFICATE_SHA2_SUBJECT_NAME) && !$(intersects win all 1,$(VBOX_WITH_CORP_CODE_SIGNING))
    62   $(evalcall2 def_VBoxAdditionsInstCertFiles,vbox.cer,$(VBOX_PATH_ADDITIONS)/VBoxGuest.sys,0)
    63  else
    64   $(evalcall2 def_VBoxAdditionsInstCertFiles,vbox-sha1.cer,$(VBOX_PATH_ADDITIONS)/VBoxGuest.sys,0)
    65   $(evalcall2 def_VBoxAdditionsInstCertFiles,vbox-sha256.cer,$(VBOX_PATH_ADDITIONS)/VBoxGuest.sys,1)
    66   if $(intersects win_planb,$(VBOX_WITH_CORP_CODE_SIGNING))
    67    $(evalcall2 def_VBoxAdditionsInstCertFiles,vbox-sha256-r3.cer,$(VBOX_PATH_ADDITIONS)/VBoxCertUtil.exe,1)
    68   endif
    69  endif
    70  ifdef VBOX_WITH_VBOX_LEGACY_TS_CA
    71 AdditionsInstCertFiles_SOURCES += $(VBOX_LEGACY_TS_CA_FILE)=>vbox-legacy-timestamp-ca.cer
    72  endif
    73  ifdef VBOX_WITH_GA_ROOT_CERTS_INCLUDED
    74   ifdef VBOX_WITH_GA_ROOT_VERISIGN_G5
    75 AdditionsInstCertFiles_SOURCES += \
    76         $(VBOX_PATH_SRC_CERTIFICATES)/CaRoot-VeriSignPca3G5-18dad19e267de8bb4a2158cdcc6b3b4a.crt=>root-versign-pca3-g5.cer
    77   endif
    78   ifdef VBOX_WITH_GA_ROOT_DIGICERT_ASSURED_ID
    79 AdditionsInstCertFiles_SOURCES += \
    80         $(VBOX_PATH_SRC_CERTIFICATES)/CaRoot-DigiCertAssuredIDRootCA-0ce7e0e517d846fe8fe560fc1bf03039.crt=>root-digicert-assured-id.cer
    81   endif
    82   ifdef VBOX_WITH_GA_ROOT_DIGICERT_HIGH_ASSURANCE_EV
    83 AdditionsInstCertFiles_SOURCES += \
    84         $(VBOX_PATH_SRC_CERTIFICATES)/CaRoot-DigiCertHighAssuranceEVRootCA-02ac5c266a0b409b8f0b79f2ae462577.crt=>root-digicert-high-assurance-ev.cer
    85   endif
    86  endif
    87 endif
    88 
    89 #
    9046# Install the registry file for bypassing the Windows 11 installer checks.
    9147#
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette