From e9e5f38f8eb2945effc510e3db0d57a56f5e26bb Mon Sep 17 00:00:00 2001 From: Raul Metsma Date: Tue, 25 Aug 2026 10:22:41 +0300 Subject: [PATCH] Generate ephemeral APPX signing key IB-9060 Signed-off-by: Raul Metsma --- .github/workflows/build.yml | 1 + client/CMakeLists.txt | 11 ++++---- client/SignAppx.ps1 | 50 ++++++++++++++++++++++++++++++++++++ qdigidoc4.pfx | Bin 2694 -> 0 bytes 4 files changed, 57 insertions(+), 5 deletions(-) create mode 100644 client/SignAppx.ps1 delete mode 100644 qdigidoc4.pfx diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index d690d1c84..bef91faaa 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -207,6 +207,7 @@ jobs: path: | build/*.msi build/*.appx + build/*.cer coverity: name: Run Coverity tests if: github.repository == 'open-eid/DigiDoc4-Client' && contains(github.ref, 'coverity_scan') diff --git a/client/CMakeLists.txt b/client/CMakeLists.txt index 475f57341..9b0b63f1b 100644 --- a/client/CMakeLists.txt +++ b/client/CMakeLists.txt @@ -271,12 +271,13 @@ elseif(WIN32) --skip-plugin-types generic,networkinformation,iconengines --exclude-plugins qjpeg,qico,qgif,qcertonlybackend,qschannelbackend appx COMMAND ${CMAKE_COMMAND} -E copy ${LIBS_PATH}/digidoc-tool.exe appx COMMAND makeappx.exe pack -d appx -p ${MSI_FILE}.appx - # https://msdn.microsoft.com/en-us/library/windows/desktop/jj835832(v=vs.85).aspx - #Popups GUI - #COMMAND MakeCert.exe /n "CN=8BBBE4D8-620A-4884-A12A-72F1A2030D8B" /r /h 0 /eku "1.3.6.1.5.5.7.3.3,1.3.6.1.4.1.311.10.3.13" /m 120 /a sha256 /sv qdigidoc4.pvk qdigidoc4.cer - #COMMAND Pvk2Pfx.exe /pvk qdigidoc4.pvk /spc qdigidoc4.cer /pfx qdigidoc4.pfx /f - COMMAND signtool.exe sign -f ${CMAKE_SOURCE_DIR}/qdigidoc4.pfx -fd SHA256 -v ${MSI_FILE}.appx + COMMAND powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass + -File ${CMAKE_CURRENT_SOURCE_DIR}/SignAppx.ps1 + -PackagePath ${MSI_FILE}.appx + -ManifestPath AppxManifest.xml + -CertificatePath ${MSI_FILE}.cer WORKING_DIRECTORY ${CMAKE_BINARY_DIR} + VERBATIM ) else() find_package( Threads REQUIRED ) diff --git a/client/SignAppx.ps1 b/client/SignAppx.ps1 new file mode 100644 index 000000000..2bd16b647 --- /dev/null +++ b/client/SignAppx.ps1 @@ -0,0 +1,50 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: LGPL-2.1-or-later + +param( + [Parameter(Mandatory = $true)] + [string] $PackagePath, + + [Parameter(Mandatory = $true)] + [string] $ManifestPath, + + [Parameter(Mandatory = $true)] + [string] $CertificatePath +) + +$ErrorActionPreference = 'Stop' +$certificate = $null + +try { + [xml] $manifest = Get-Content -LiteralPath $ManifestPath -Raw + $publisher = $manifest.Package.Identity.Publisher + if ([string]::IsNullOrWhiteSpace($publisher)) { + throw "The Appx manifest does not define a publisher." + } + + $certificate = New-SelfSignedCertificate ` + -Type Custom ` + -Subject $publisher ` + -FriendlyName 'DigiDoc4 ephemeral Appx test certificate' ` + -CertStoreLocation 'Cert:\CurrentUser\My' ` + -Provider 'Microsoft Software Key Storage Provider' ` + -KeyAlgorithm RSA ` + -KeyLength 2048 ` + -HashAlgorithm SHA256 ` + -KeyExportPolicy NonExportable ` + -KeyUsage DigitalSignature ` + -TextExtension @('2.5.29.37={text}1.3.6.1.5.5.7.3.3,1.3.6.1.4.1.311.10.3.13', '2.5.29.19={text}') ` + -NotAfter (Get-Date).AddDays(30) + + Export-Certificate -Cert $certificate -FilePath $CertificatePath -Type CERT -Force | Out-Null + + & signtool.exe sign /v /s My /sha1 $certificate.Thumbprint /fd SHA256 $PackagePath + if ($LASTEXITCODE -ne 0) { + throw "SignTool failed with exit code $LASTEXITCODE." + } +} +finally { + if ($null -ne $certificate) { + Remove-Item -LiteralPath "Cert:\CurrentUser\My\$($certificate.Thumbprint)" -DeleteKey + } +} diff --git a/qdigidoc4.pfx b/qdigidoc4.pfx deleted file mode 100644 index 6c4e0fe2a4c55e2cf5996223d3cd01415b0f880b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2694 zcmZXVc{tSj9>;%UHYV$o8QDS!!!TonEFpw!BU|gB zolMlRwn!#RvNTR&ChnY`d(V09bD!_?`F=m|*Ju0h^TkmR6dn*5M?su`@nKTTQ?>*^ za8MBip$4HKl(|>|M}hJFPYAjVp+Nt{QJ@=K`wH9lpDKO?h^L4G*~L*HJ2*)g;=h>N zToA%*O$k)iTDQ*S;eo$`P#}}RE*MclLB?p#Ec%URRE%9G$y~{_(`Q1evuiX}mp0_t zu?;&@pPjoBptV6x8TdSUwWofgzurTrc1YB+_IHt;M~=yo{3Rr z>cFZ=fo*O>+ucTcR$&J*T$?x8W-gL4Dr(n?UTpMYq9TtZ;8AWUSadW~dC%MNkjzanMfDLcc5_KFmLo%DKc;65x?=%a9^tZ9imP^cTV!4f`k}U z?a6W)Vpd*y!bavbZ84xBKjif8HhL4g_A{rSBxbV_$Pm0Q;|Unm#g)l^aY?wI>6N~i zH4V<*B@8rcD=G5WiUz-^MeA$T5 z>YK$?f4ENpPrde6=d06+{g#)$ol(pvAr8*kJSKcCEZaYe+i#}$OxYu?k_PD1{5T7? zTQ^A>L4}dzpF0(I7&=~e=S#TVr4bSMc|&(>f}p-VqCws{ z+8{4i_l}j|m884z=Ir@WiUbqb@-n`4QzWtGqRg7hJnXj)q^+28bF7pf`*L`UJtyQ^ zGA(he@%QMr!{eVB@HaiknyYqU9qPUJRc#QT#^Pft4xW=E`WPx?UO}hR*NQjqm6i)d zZ#!m(M^_8w8z-q^?41V_?%bJ#)gIiEJcXGkH zL!iT1>koEKA5RVE3;MH^61y$(>va%jG0B}np4C3nqG?Kdbqa|GR~~3glcOwr-h1b? zfF9mgX8MGF5_x3RwdQOp?(;keB9>kLHS!kntyD~UgDQJzwCegrO+jAE7s9(E*OK{hLDEuhq#$l6QBLp?TugdORB!*eDJq)itOb@719@nVP|0#1yU%vsdnzhALv6xjQd&8 zIIa4FfM#lQ=kkX$iQ;xFes;`(?Xi%}=3N)08(Ha}Y zi*x15Q_g%o-@liH?9EPxf6jJw-+6z!#WJH92gayb)M8_F%T`ZKl?pbLyhZ=kRg`El zwyNK5Re1)(C~FM_>lR0N6C`b~Ier-TobfrTntW?~UK)+8Q*WFSwYpv6EV}B4Z0Aw$ zQ!g32w#5z?AYW(&cSEsI=!u0Tl7SS3Pj?FRv?qKk8F#F0V`BH&?(y+}ygGsP_sP+GnWv2&Z0U<}U5AogpNZ-oQo({Yj*_Xb-fTQe*8o9)IhK!n;=<@ zKA$25FEqkmox$z@dtLI0;$aX72mk<_2aHb{27-VnS|T7kQQ8Ku1_A(IARGt*BDm%c zL;^B^J@@{L1Op_lGUoc1fKV1myi#s8}*fwoe1g(9=ERScc2gi^U+S;bT|rGqfXFXR}%l5sc2D zjAK=sVdNeWHX&VJ-%2;bf9{7D-StoHeYh8+CA)6C5>W5l#y*x3OL#x@70Pj>W%qYK z0~@h*%htfgE1dbNJlCOvo3s_G**=Psb%e-FnN8u~H96ECg{Ge1XmVruLzOdnVCW?Y zTVyO$|7ApPZW{jW`RYe+o6(aK-SM5HVUONK8D2YQ?S0)lK=@`w5n1r%V3yF`yy{>j z;q9+ z0=ABd=)mJ2UukqK-x@KIYO~%}DS1F=<3?aTG4XxK>Fl^6I<|u2inq ze#*#yIqUDP_jSj~?nKQYvm<~zQ$nPqbctH#!huZ;)Iet)T;t69m&+w3odOQ=jTjxD z4V|-8$Pn1g0HjZ~NR=nSSu(WmJ*Tlr!%7gmN6|^%(C~8Gq&|xs3!KbRmgRbi#sx+F z*zXDlHq1bo?-FWz1ZS{slwU{H*y2ts;;#}^B^k;?Shj?zKm_}nXjaW50Ua5-cWp*E zT&``YWLQt{$MGjY60#*VsZvvg@bB-o2-nFLB)2)HhU>bc$EPdMfMGq8%HqX;saa|e zFhSlMQ70soh%Sk7a^jAv)|35r1^(DQzc(>Lf0iJCa0rlcCJnq;W|zkes(RA+n7O5~ zI;?erLIY{3##@-i?)?e^HPjW&asOju>>`b;t1t5&?P15lz8-AMpF^rYfl|&HKDJh> zN0{Gq^|_k2W+}m<<7gP-YosjYvYUX+OJ<jb`I=^K~Q3k(|@QizMqP3zfj~z!0>!mz8EkHC?VU z6lQYLp?u<*ew#-Dp4x?bkssif*^n?b463;t{}fvHr?l`^DX2!2p`^W$F&;orU7uC@RG