From 3396f9cf97b1c4c875e253408f856e5a03b37c32 Mon Sep 17 00:00:00 2001
From: Simon Rozman <simon@rozman.si>
Date: Tue, 6 Nov 2018 16:42:25 +0100
Subject: [PATCH] Force SHA-256 digest for timestamp signatures

Comodo timestamp server defaults to SHA-1. To make sure timestamp
signatures are SHA-256, add appropriate signtool.exe flag.
---
 MSI/MSIBuild            |   2 +-
 MakefileLangPlatCfg.mak | Bin 5978 -> 6000 bytes
 include/Release.props   |   2 +-
 3 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/MSI/MSIBuild b/MSI/MSIBuild
index 06230f6..332709b 160000
--- a/MSI/MSIBuild
+++ b/MSI/MSIBuild
@@ -1 +1 @@
-Subproject commit 06230f6ebd386a0e8f559d3857634dfa83cb73e3
+Subproject commit 332709b1d0349ec52255725c5da8f78c08296cca
diff --git a/MakefileLangPlatCfg.mak b/MakefileLangPlatCfg.mak
index 53d06d3fbe18a53d8b3392be03f1d6228aabe8ac..7b5c651a13073ce03421d67b1d6580a32e524edc 100644
GIT binary patch
delta 30
lcmcbm_d#!ihOl4>LkfceLoq`JLn4C_gDHdAW@TY>7667D2N(bV

delta 12
TcmeyMcS~=BhVW)PVIvj*BZ>q}

diff --git a/include/Release.props b/include/Release.props
index 4eddaa6..33b5740 100644
--- a/include/Release.props
+++ b/include/Release.props
@@ -43,7 +43,7 @@
   <ItemGroup />
   <Target Name="Sign" Condition="'$(ManifestCertificateThumbprint)' != '' and ('$(ConfigurationType)' == 'Application' or '$(ConfigurationType)' == 'DynamicLibrary')" AfterTargets="_Manifest" BeforeTargets="RegisterOutput" Inputs="$(OutDir)$(TargetName)$(TargetExt)" Outputs="$(IntDir)$(TargetName).sign">
     <Message Text="Signing output file..." />
-    <Exec Command="signtool.exe sign /sha1 &quot;%ManifestCertificateThumbprint%&quot; /fd sha256 /tr &quot;%ManifestTimestampRFC3161Url%&quot; /q &quot;$(OutDir)$(TargetName)$(TargetExt)&quot;" />
+    <Exec Command="signtool.exe sign /sha1 &quot;%ManifestCertificateThumbprint%&quot; /fd sha256 /tr &quot;%ManifestTimestampRFC3161Url%&quot; /td sha256 /q &quot;$(OutDir)$(TargetName)$(TargetExt)&quot;" />
     <Touch Files="$(IntDir)$(TargetName).sign" AlwaysCreate="true" />
   </Target>
 </Project>
\ No newline at end of file