feat: automatically install test-certificate and validate they are installed on LocalMachine for signtool-verify tasks
#232
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wmmc88
commented
Oct 8, 2024
wmmc88
commented
Oct 9, 2024
Signed-off-by: Melvin Wang <melvin.mc.wang@gmail.com>
wmmc88
changed the title
signtool-verify task to align with Windows requirementssigntool-verify tasks
wmmc88
commented
Oct 12, 2024
| pub fn install_certificate_condition_script() -> anyhow::Result<()> { | ||
| condition_script(|| { | ||
| if is_wdrlocaltestcert_installed()? { | ||
| let cargo_make_task_name = env::var(CARGO_MAKE_CURRENT_TASK_NAME_ENV_VAR) |
There was a problem hiding this comment.
Cargo make needs uprev to min 0.37.22 to get bugfix
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Users often make the mistake of installing the test-signed certificate to
Current Userstore instead ofLocal Machine. Thesigntool-verifycargo-make tasks were originally added to help diagnose these issues.Using
/kpwithsigntoolto validate kernel signing policy is not possible since the test-cert will terminate at a root that isn't trusted by windows: https://learn.microsoft.com/en-us/windows-hardware/drivers/install/test-signing . Using/pais not sufficient since it will pass even when the certificate is only installed inCurrent User. Additional checks were added to make sure that on top of/papassing, the certificate is also installed in theLocal MachinestoresCertificate Management Enhancements:
rust-driver-makefile.tomlfile. This includes theinstall-certificateandvalidate-certificate-installedtasks, which ensure that theWDRLocalTestCertcertificate is correctly installed and validated per Windows requirements. (crates/wdk-build/rust-driver-makefile.toml) [1] [2]cargo_make.rsfor handling certificate installation, validation, and checking if the process is running with admin privileges. (crates/wdk-build/src/cargo_make.rs)README.mdto include instructions for installing and validating certificates. (README.md)Workflow and Utility Enhancements:
WDK_BUILD_ENABLE_SIGNTOOL_VERIFYfor signature verification. (.github/workflows/build.yaml)utils.rsfor checking admin privileges using Windows APIs. (crates/wdk-build/src/utils.rs)closes microsoft/Windows-rust-driver-samples#30