diff --git a/.gitignore b/.gitignore index 8deb83ff..246a0508 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -cert/*.pem -cert/*.pfx +cert/*.pem +cert/*.pfx diff --git a/cert/libssl-3-x64.dll b/cert/libssl-3-x64.dll deleted file mode 100644 index 7133e995..00000000 Binary files a/cert/libssl-3-x64.dll and /dev/null differ diff --git a/cert/openssl.cnf b/cert/openssl.cnf deleted file mode 100644 index 2833b6f3..00000000 --- a/cert/openssl.cnf +++ /dev/null @@ -1,390 +0,0 @@ -# -# OpenSSL example configuration file. -# See doc/man5/config.pod for more info. -# -# This is mostly being used for generation of certificate requests, -# but may be used for auto loading of providers - -# Note that you can include other files from the main configuration -# file using the .include directive. -#.include filename - -# This definition stops the following lines choking if HOME isn't -# defined. -HOME = . - -# Use this in order to automatically load providers. -openssl_conf = openssl_init - -# Comment out the next line to ignore configuration errors -config_diagnostics = 1 - -# Extra OBJECT IDENTIFIER info: -# oid_file = $ENV::HOME/.oid -oid_section = new_oids - -# To use this configuration file with the "-extfile" option of the -# "openssl x509" utility, name here the section containing the -# X.509v3 extensions to use: -# extensions = -# (Alternatively, use a configuration file that has only -# X.509v3 extensions in its main [= default] section.) - -[ new_oids ] -# We can add new OIDs in here for use by 'ca', 'req' and 'ts'. -# Add a simple OID like this: -# testoid1=1.2.3.4 -# Or use config file substitution like this: -# testoid2=${testoid1}.5.6 - -# Policies used by the TSA examples. -tsa_policy1 = 1.2.3.4.1 -tsa_policy2 = 1.2.3.4.5.6 -tsa_policy3 = 1.2.3.4.5.7 - -# For FIPS -# Optionally include a file that is generated by the OpenSSL fipsinstall -# application. This file contains configuration data required by the OpenSSL -# fips provider. It contains a named section e.g. [fips_sect] which is -# referenced from the [provider_sect] below. -# Refer to the OpenSSL security policy for more information. -# .include fipsmodule.cnf - -[openssl_init] -providers = provider_sect - -# List of providers to load -[provider_sect] -default = default_sect -# The fips section name should match the section name inside the -# included fipsmodule.cnf. -# fips = fips_sect - -# If no providers are activated explicitly, the default one is activated implicitly. -# See man 7 OSSL_PROVIDER-default for more details. -# -# If you add a section explicitly activating any other provider(s), you most -# probably need to explicitly activate the default provider, otherwise it -# becomes unavailable in openssl. As a consequence applications depending on -# OpenSSL may not work correctly which could lead to significant system -# problems including inability to remotely access the system. -[default_sect] -# activate = 1 - - -#################################################################### -[ ca ] -default_ca = CA_default # The default ca section - -#################################################################### -[ CA_default ] - -dir = ./demoCA # Where everything is kept -certs = $dir/certs # Where the issued certs are kept -crl_dir = $dir/crl # Where the issued crl are kept -database = $dir/index.txt # database index file. -#unique_subject = no # Set to 'no' to allow creation of - # several certs with same subject. -new_certs_dir = $dir/newcerts # default place for new certs. - -certificate = $dir/cacert.pem # The CA certificate -serial = $dir/serial # The current serial number -crlnumber = $dir/crlnumber # the current crl number - # must be commented out to leave a V1 CRL -crl = $dir/crl.pem # The current CRL -private_key = $dir/private/cakey.pem # The private key - -x509_extensions = usr_cert # The extensions to add to the cert - -# Comment out the following two lines for the "traditional" -# (and highly broken) format. -name_opt = ca_default # Subject Name options -cert_opt = ca_default # Certificate field options - -# Extension copying option: use with caution. -# copy_extensions = copy - -# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs -# so this is commented out by default to leave a V1 CRL. -# crlnumber must also be commented out to leave a V1 CRL. -# crl_extensions = crl_ext - -default_days = 365 # how long to certify for -default_crl_days= 30 # how long before next CRL -default_md = default # use public key default MD -preserve = no # keep passed DN ordering - -# A few difference way of specifying how similar the request should look -# For type CA, the listed attributes must be the same, and the optional -# and supplied fields are just that :-) -policy = policy_match - -# For the CA policy -[ policy_match ] -countryName = match -stateOrProvinceName = match -organizationName = match -organizationalUnitName = optional -commonName = supplied -emailAddress = optional - -# For the 'anything' policy -# At this point in time, you must list all acceptable 'object' -# types. -[ policy_anything ] -countryName = optional -stateOrProvinceName = optional -localityName = optional -organizationName = optional -organizationalUnitName = optional -commonName = supplied -emailAddress = optional - -#################################################################### -[ req ] -default_bits = 2048 -default_keyfile = privkey.pem -distinguished_name = req_distinguished_name -attributes = req_attributes -x509_extensions = v3_ca # The extensions to add to the self signed cert - -# Passwords for private keys if not present they will be prompted for -# input_password = secret -# output_password = secret - -# This sets a mask for permitted string types. There are several options. -# default: PrintableString, T61String, BMPString. -# pkix : PrintableString, BMPString (PKIX recommendation before 2004) -# utf8only: only UTF8Strings (PKIX recommendation after 2004). -# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings). -# MASK:XXXX a literal mask value. -# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings. -string_mask = utf8only - -# req_extensions = v3_req # The extensions to add to a certificate request - -[ req_distinguished_name ] -countryName = Country Name (2 letter code) -countryName_default = AU -countryName_min = 2 -countryName_max = 2 - -stateOrProvinceName = State or Province Name (full name) -stateOrProvinceName_default = Some-State - -localityName = Locality Name (eg, city) - -0.organizationName = Organization Name (eg, company) -0.organizationName_default = Internet Widgits Pty Ltd - -# we can do this but it is not needed normally :-) -#1.organizationName = Second Organization Name (eg, company) -#1.organizationName_default = World Wide Web Pty Ltd - -organizationalUnitName = Organizational Unit Name (eg, section) -#organizationalUnitName_default = - -commonName = Common Name (e.g. server FQDN or YOUR name) -commonName_max = 64 - -emailAddress = Email Address -emailAddress_max = 64 - -# SET-ex3 = SET extension number 3 - -[ req_attributes ] -challengePassword = A challenge password -challengePassword_min = 4 -challengePassword_max = 20 - -unstructuredName = An optional company name - -[ usr_cert ] - -# These extensions are added when 'ca' signs a request. - -# This goes against PKIX guidelines but some CAs do it and some software -# requires this to avoid interpreting an end user certificate as a CA. - -basicConstraints=CA:FALSE - -# This is typical in keyUsage for a client certificate. -# keyUsage = nonRepudiation, digitalSignature, keyEncipherment - -# PKIX recommendations harmless if included in all certificates. -subjectKeyIdentifier=hash -authorityKeyIdentifier=keyid,issuer - -# This stuff is for subjectAltName and issuerAltname. -# Import the email address. -# subjectAltName=email:copy -# An alternative to produce certificates that aren't -# deprecated according to PKIX. -# subjectAltName=email:move - -# Copy subject details -# issuerAltName=issuer:copy - -# This is required for TSA certificates. -# extendedKeyUsage = critical,timeStamping - -[ v3_req ] - -# Extensions to add to a certificate request - -basicConstraints = CA:FALSE -keyUsage = nonRepudiation, digitalSignature, keyEncipherment - -[ v3_ca ] - - -# Extensions for a typical CA - - -# PKIX recommendation. - -subjectKeyIdentifier=hash - -authorityKeyIdentifier=keyid:always,issuer - -basicConstraints = critical,CA:true - -# Key usage: this is typical for a CA certificate. However since it will -# prevent it being used as an test self-signed certificate it is best -# left out by default. -# keyUsage = cRLSign, keyCertSign - -# Include email address in subject alt name: another PKIX recommendation -# subjectAltName=email:copy -# Copy issuer details -# issuerAltName=issuer:copy - -# DER hex encoding of an extension: beware experts only! -# obj=DER:02:03 -# Where 'obj' is a standard or added object -# You can even override a supported extension: -# basicConstraints= critical, DER:30:03:01:01:FF - -[ crl_ext ] - -# CRL extensions. -# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL. - -# issuerAltName=issuer:copy -authorityKeyIdentifier=keyid:always - -[ proxy_cert_ext ] -# These extensions should be added when creating a proxy certificate - -# This goes against PKIX guidelines but some CAs do it and some software -# requires this to avoid interpreting an end user certificate as a CA. - -basicConstraints=CA:FALSE - -# This is typical in keyUsage for a client certificate. -# keyUsage = nonRepudiation, digitalSignature, keyEncipherment - -# PKIX recommendations harmless if included in all certificates. -subjectKeyIdentifier=hash -authorityKeyIdentifier=keyid,issuer - -# This stuff is for subjectAltName and issuerAltname. -# Import the email address. -# subjectAltName=email:copy -# An alternative to produce certificates that aren't -# deprecated according to PKIX. -# subjectAltName=email:move - -# Copy subject details -# issuerAltName=issuer:copy - -# This really needs to be in place for it to be a proxy certificate. -proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo - -#################################################################### -[ tsa ] - -default_tsa = tsa_config1 # the default TSA section - -[ tsa_config1 ] - -# These are used by the TSA reply generation only. -dir = ./demoCA # TSA root directory -serial = $dir/tsaserial # The current serial number (mandatory) -crypto_device = builtin # OpenSSL engine to use for signing -signer_cert = $dir/tsacert.pem # The TSA signing certificate - # (optional) -certs = $dir/cacert.pem # Certificate chain to include in reply - # (optional) -signer_key = $dir/private/tsakey.pem # The TSA private key (optional) -signer_digest = sha256 # Signing digest to use. (Optional) -default_policy = tsa_policy1 # Policy if request did not specify it - # (optional) -other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional) -digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory) -accuracy = secs:1, millisecs:500, microsecs:100 # (optional) -clock_precision_digits = 0 # number of digits after dot. (optional) -ordering = yes # Is ordering defined for timestamps? - # (optional, default: no) -tsa_name = yes # Must the TSA name be included in the reply? - # (optional, default: no) -ess_cert_id_chain = no # Must the ESS cert id chain be included? - # (optional, default: no) -ess_cert_id_alg = sha256 # algorithm to compute certificate - # identifier (optional, default: sha256) - -[insta] # CMP using Insta Demo CA -# Message transfer -server = pki.certificate.fi:8700 -# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080 -# tls_use = 0 -path = pkix/ - -# Server authentication -recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer -ignore_keyusage = 1 # potentially needed quirk -unprotected_errors = 1 # potentially needed quirk -extracertsout = insta.extracerts.pem - -# Client authentication -ref = 3078 # user identification -secret = pass:insta # can be used for both client and server side - -# Generic message options -cmd = ir # default operation, can be overridden on cmd line with, e.g., kur - -# Certificate enrollment -subject = "/CN=openssl-cmp-test" -newkey = insta.priv.pem -out_trusted = apps/insta.ca.crt # does not include keyUsage digitalSignature -certout = insta.cert.pem - -[pbm] # Password-based protection for Insta CA -# Server and client authentication -ref = $insta::ref # 3078 -secret = $insta::secret # pass:insta - -[signature] # Signature-based protection for Insta CA -# Server authentication -trusted = $insta::out_trusted # apps/insta.ca.crt - -# Client authentication -secret = # disable PBM -key = $insta::newkey # insta.priv.pem -cert = $insta::certout # insta.cert.pem - -[ir] -cmd = ir - -[cr] -cmd = cr - -[kur] -# Certificate update -cmd = kur -oldcert = $insta::certout # insta.cert.pem - -[rr] -# Certificate revocation -cmd = rr -oldcert = $insta::certout # insta.cert.pem diff --git a/cert/openssl.exe b/cert/openssl.exe deleted file mode 100644 index 57bb0bc4..00000000 Binary files a/cert/openssl.exe and /dev/null differ diff --git a/cert/openssl/SOURCE.txt b/cert/openssl/SOURCE.txt new file mode 100644 index 00000000..243431e6 --- /dev/null +++ b/cert/openssl/SOURCE.txt @@ -0,0 +1,186 @@ +#### INFO + +https://github.com/openssl/openssl + +VERSION: https://github.com/openssl/openssl/tree/openssl-3.3.1 + +Pre-compiled binaries provided by Shining Light Productions (https://slproweb.com/products/Win32OpenSSL.html) + +#### LICENSE + + Apache License + Version 2.0, January 2004 + https://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS diff --git a/cert/libcrypto-3-x64.dll b/cert/openssl/libcrypto-3-x64.dll similarity index 61% rename from cert/libcrypto-3-x64.dll rename to cert/openssl/libcrypto-3-x64.dll index 4b97d7e9..704a666f 100644 Binary files a/cert/libcrypto-3-x64.dll and b/cert/openssl/libcrypto-3-x64.dll differ diff --git a/cert/openssl/libssl-3-x64.dll b/cert/openssl/libssl-3-x64.dll new file mode 100644 index 00000000..1760a2b9 Binary files /dev/null and b/cert/openssl/libssl-3-x64.dll differ diff --git a/cert/openssl/openssl.exe b/cert/openssl/openssl.exe new file mode 100644 index 00000000..0faf569e Binary files /dev/null and b/cert/openssl/openssl.exe differ diff --git a/cert/sign_helper.bat b/cert/sign_helper.bat index 34c09e4e..1c09b8f9 100644 --- a/cert/sign_helper.bat +++ b/cert/sign_helper.bat @@ -1,102 +1,97 @@ -@echo off - -setlocal - -set /a exit=0 - -set "file=%~1" -if not defined file ( - set /a exit=1 - goto :end_script -) - -pushd "%~dp0" -set "OPENSSL_CONF=%cd%\openssl.cnf" - -set "filename=%random%" -for %%A in ("%file%") do ( - set "filename=%random%-%%~nxA" -) - -:re_pvt -call :gen_rnd rr -set "pvt_file=%cd%\prvt-%rr%-%filename%.pem" -:: parallel build can generate same rand number -if exist "%pvt_file%" ( - goto :re_pvt -) - -:re_cer -call :gen_rnd rr -set "cer_file=%cd%\cert-%rr%-%filename%.pem" -:: parallel build can generate same rand number -if exist "%cer_file%" ( - goto :re_cer -) - -:re_pfx -call :gen_rnd rr -set "pfx_file=%cd%\cfx-%rr%-%filename%.pfx" -:: parallel build can generate same rand number -if exist "%pfx_file%" ( - goto :re_pfx -) - -set "openssl_exe=%cd%\openssl.exe" -set "signtool_exe=%cd%\signtool.exe" - -popd - -call "%openssl_exe%" req -newkey rsa:2048 -nodes -keyout "%pvt_file%" -x509 -days 5525 -out "%cer_file%" ^ - -subj "/O=GSE/CN=GSE" ^ - -addext "extendedKeyUsage=codeSigning" ^ - -addext "basicConstraints=critical,CA:true" ^ - -addext "subjectAltName=email:GSE,DNS:GSE,DNS:GSE" ^ - -addext "keyUsage=digitalSignature,keyEncipherment" ^ - -addext "authorityKeyIdentifier=keyid,issuer:always" ^ - -addext "crlDistributionPoints=URI:GSE" ^ - -addext "subjectKeyIdentifier=hash" ^ - -addext "issuerAltName=issuer:copy" ^ - -addext "nsComment=GSE" ^ - -extensions v3_req -set /a exit+=%errorlevel% -if %exit% neq 0 ( - goto :end_script -) - -call "%openssl_exe%" pkcs12 -export -out "%pfx_file%" -inkey "%pvt_file%" -in "%cer_file%" -passout pass: -set /a exit+=%errorlevel% - -del /f /q "%cer_file%" -del /f /q "%pvt_file%" - -if %exit% neq 0 ( - goto :end_script -) - -call "%signtool_exe%" sign /d "GSE" /fd sha256 /f "%pfx_file%" /p "" "%~1" -set /a exit+=%errorlevel% -if %exit% neq 0 ( - goto :end_script -) - -del /f /q "%pfx_file%" - -:end_script -endlocal -exit /b %exit% - - -:: when every project is built in parallel '/MP' with Visual Studio, -:: the regular random variable might be the same, causing racing -:: this will waste some time and hopefully generate a different number -:: 1: (ref) out random number -:gen_rnd - setlocal enabledelayedexpansion - for /l %%A in (1, 1, 10) do ( - set "_r=!random!" - ) -endlocal & ( - set "%~1=%random%" - exit /b -) +@echo off +setlocal EnableDelayedExpansion +cd /d "%~dp0" + +set "ROOT=%cd%" +set "OPENSSL_EXE=%ROOT%\openssl\openssl.exe" +set "SIGNTOOL_EXE=%ROOT%\signtool\signtool.exe" + +set "FILE=%~1" +if not defined FILE ( + goto :end_script_with_err +) + +set "FILENAME=%random%" +for %%A in ("%FILE%") do ( + set "FILENAME=%random%-%%~nxA" +) + +:re_pvt +call :gen_rnd rr +set "PVT_FILE=%ROOT%\prvt-%rr%-%FILENAME%.pem" +:: parallel build can generate same rand number +if exist "%PVT_FILE%" ( + goto :re_pvt +) + +:re_cer +call :gen_rnd rr +set "CER_FILE=%ROOT%\cert-%rr%-%FILENAME%.pem" +:: parallel build can generate same rand number +if exist "%CER_FILE%" ( + goto :re_cer +) + +:re_pfx +call :gen_rnd rr +set "PFX_FILE=%ROOT%\cfx-%rr%-%FILENAME%.pfx" +:: parallel build can generate same rand number +if exist "%PFX_FILE%" ( + goto :re_pfx +) + +call "%OPENSSL_EXE%" req -newkey rsa:2048 -nodes -keyout "%PVT_FILE%" -x509 -days 5525 -out "%CER_FILE%" ^ + -subj "/O=GSE/CN=GSE" ^ + -addext "extendedKeyUsage=codeSigning" ^ + -addext "basicConstraints=critical,CA:true" ^ + -addext "subjectAltName=email:GSE,DNS:GSE,DNS:GSE" ^ + -addext "keyUsage=digitalSignature,keyEncipherment" ^ + -addext "authorityKeyIdentifier=keyid,issuer:always" ^ + -addext "crlDistributionPoints=URI:GSE" ^ + -addext "subjectKeyIdentifier=hash" ^ + -addext "issuerAltName=issuer:copy" ^ + -addext "nsComment=GSE" ^ + -extensions v3_req +if %errorlevel% neq 0 ( + goto :end_script_with_err +) + +call "%OPENSSL_EXE%" pkcs12 -export -out "%PFX_FILE%" -inkey "%PVT_FILE%" -in "%CER_FILE%" -passout pass: + +del /f /q "%CER_FILE%" +del /f /q "%PVT_FILE%" + +if %errorlevel% neq 0 ( + goto :end_script_with_err +) + +call "%SIGNTOOL_EXE%" sign /d "GSE" /fd sha256 /f "%PFX_FILE%" /p "" "%FILE%" + +del /f /q "%PFX_FILE%" + +if %errorlevel% neq 0 ( + goto :end_script_with_err +) + +:: exit without error +:end_script + endlocal + exit /b 0 + +:: exit with error +:end_script_with_err + endlocal + exit /b 1 + +:: when every project is built in parallel '/MP' with Visual Studio, +:: the regular random variable might be the same, causing racing +:: this will waste some time and hopefully generate a different number +:: 1: (ref) out random number +:gen_rnd + setlocal EnableDelayedExpansion + for /l %%A in (1, 1, 10) do ( + set "_r=!random!" + ) + endlocal + set "%~1=%random%" + exit /b diff --git a/cert/signtool.exe b/cert/signtool.exe deleted file mode 100644 index b34d5379..00000000 Binary files a/cert/signtool.exe and /dev/null differ diff --git a/cert/signtool/SOURCE.txt b/cert/signtool/SOURCE.txt new file mode 100644 index 00000000..d9962850 --- /dev/null +++ b/cert/signtool/SOURCE.txt @@ -0,0 +1,5 @@ +#### INFO + +https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool + +VERSION: Windows SDK 10.0.22621.0 diff --git a/cert/signtool/signtool.exe b/cert/signtool/signtool.exe new file mode 100644 index 00000000..3a59f1bd Binary files /dev/null and b/cert/signtool/signtool.exe differ diff --git a/cert/ssleay32.dll b/cert/ssleay32.dll deleted file mode 100644 index f4b5c75b..00000000 Binary files a/cert/ssleay32.dll and /dev/null differ