Explicit select SHA256 for code signing on windows #4823
Conversation
|
IMO its just a change in hash strength. Changing it to the more secure sha256 should make no difference IMO. Do we hardcode the hashes somewhere else? |
|
We can just give it a try. I will add a commit on top of this for SHA256 merge it and ask a windows user if anything it wrong. In case yes, quickly revert. Unfortunately we need to do this in main because of the secrets. |
|
Does it really have to be on main? Can't we just quickly create a different branch based on main in the mixxx repo? |
CMakeLists.txt
Outdated
| @@ -1326,9 +1326,9 @@ if(WIN32) | |||
| set(WINDOWS_CODESIGN_CERTIFICATE_PATH "$ENV{WINDOWS_CODESIGN_CERTIFICATE_PATH}" CACHE STRING "Path to signtool certificate") | |||
| set(WINDOWS_CODESIGN_CERTIFICATE_PASSWORD "$ENV{WINDOWS_CODESIGN_CERTIFICATE_PASSWORD}" CACHE STRING "Password of signtool certificate") | |||
| if("${WINDOWS_CODESIGN_CERTIFICATE_PATH}" STREQUAL "" AND "${WINDOWS_CODESIGN_CERTIFICATE_PASSWORD}" STREQUAL "") | |||
| set(WINDOWS_CODESIGN_ARGS /a /t http://timestamp.verisign.com/scripts/timstamp.dll CACHE STRING "parameters for signtool (list)") | |||
| set(WINDOWS_CODESIGN_ARGS /fd SHA256 /a /t http://timestamp.verisign.com/scripts/timstamp.dll CACHE STRING "parameters for signtool (list)") | |||
There was a problem hiding this comment.
we also need to specify the timestamp digest algorithm.
See the note at the top of the page: https://docs.microsoft.com/en-us/windows/win32/seccrypto/signtool
There was a problem hiding this comment.
I'm actually not sure about that anymore. We don't actually timestamp the build right now. I don't know what the purpose of that would be.
There was a problem hiding this comment.
Nevermind, we aren't timestamping the build right now anyways.
daschuer
changed the title
|
You also need to set the timestamp digest algorithm The build succeeded but it doesn't actually do any timestamping because we didn't specify |
|
Closed in favor of #4824 |
This fixes the following error message:
This restores the original behavior as a band aid. I have no clue what it means to switch to the recommended /fd SHA256