From 5293dfc1a7f71e45d03c991af2fab7b868030b39 Mon Sep 17 00:00:00 2001
From: Simon Rozman <simon@rozman.si>
Date: Tue, 19 Nov 2024 10:30:13 +0100
Subject: [PATCH] Upgrade code signing

This adds support for Microsoft Azure Trusted Signing and removes
signing of the Debug binaries to minimize the Trusted Signing API
volume.

Signed-off-by: Simon Rozman <simon@rozman.si>
---
 MSI/MSIBuild          |   2 +-
 MakefilePlatCfg.mak   | Bin 10312 -> 11062 bytes
 README.md             |  23 +++++++++++++++++------
 include/Debug.props   |   5 -----
 include/Release.props |  11 ++++++++---
 5 files changed, 26 insertions(+), 15 deletions(-)

diff --git a/MSI/MSIBuild b/MSI/MSIBuild
index b8364de..eccce8c 160000
--- a/MSI/MSIBuild
+++ b/MSI/MSIBuild
@@ -1 +1 @@
-Subproject commit b8364dea81f39b321d726317a9dcbf6b13a455e0
+Subproject commit eccce8c523c9193c1e3a627e4dd8a80cd3cd5703
diff --git a/MakefilePlatCfg.mak b/MakefilePlatCfg.mak
index 4fbca07799548c5e72e4f59743a6f5304dd4918f..786e4af1f42d3645962fddb5866c84747d4a02e7 100644
GIT binary patch
delta 583
zcmb`DO-{m46on59Fb>=RX|zb9MdQyvM}%rZf{K8|K_^m*q7+P965^zb=tf9LT!VXX
zGk$#<HOSDs+;{)pyZ4;))_m>GEqlEvS7$m`U6*(_E0i{}xxKUK+ucIiP@7_%b`gI|
z)K&-EmZeSZs+t@Z-@(fAbfKYqMVcta21?}6i!>!q6sS+$=FPpv++)0>nnuI{S^oOb
z{2a5PocZ={+Be-E2tIe-7)&kpwsd8HH^7$fc9<|_V!#|v&$<K26L(&Tse~)AB}>@i
zC2W5B3!JBYmh53iI$&VWQ1CR<u@1?rdI3Phx}4MmvcVs+?iU@0?ucVStU?@OgKv^Q
t!e0Nove~=6ReM0A1dUEuULhI+AXh0tuaLT9)Qj<}RP!MhE>25pg%3e7Y&!q|

delta 28
kcmdlMb|PSdk{Y`UgDZm@gTmz1YSx<z)WR4iuh8lP0EScvMF0Q*

diff --git a/README.md b/README.md
index 1e933e9..4d349cd 100644
--- a/README.md
+++ b/README.md
@@ -101,14 +101,25 @@ The product compilation references wxWidgets libraries using `WXWIN` environment
 
 ### Digital Signing of Build Outputs
 
-In order to have the build process digitally sign output files, one should provide the following:
+In order to have the build process digitally sign the Release output files, one should setup either:
 
-1. A signing certificate installed in the current user’s certificate store.
-2. The following variables in the environment:
-  - `ManifestCertificateThumbprint` - set the value to certificate’s SHA1 thumbprint (hexadecimal, without spaces, i.e. `bc0d8da45f9eeefcbe4e334e1fc262804df88d7e`).
-  - `ManifestTimestampRFC3161Url` - set the value to URL used to perform RFC3161 timestamp signature (i.e. `http://sha256timestamp.ws.symantec.com/sha256/timestamp`). In order to perform timestamp signing successfully, the computer running the build should be online and able to access this URL.
+- Local signing:
+   1. A signing certificate/hardware key
+   2. The following variables in the environment:
+      - `ManifestCertificateThumbprint` - set the value to certificate’s SHA1 thumbprint (hexadecimal, without spaces, e.g. `bc0d8da45f9eeefcbe4e334e1fc262804df88d7e`).
+      - `ManifestTimestampRFC3161Url` - set the value to URL used to perform timestamp signature (e.g. `http://sha256timestamp.ws.symantec.com/sha256/timestamp`, `http://timestamp.digicert.com` etc.). In order to perform the timestamp signing successfully, the computer running the build should be online and able to access this URL.
 
-Please note that only Release builds are configured for timestamp signing. Debug configurations do not attempt to timestamp sign the resulting DLL and EXE files in order to speed up the building process and enable offline building.
+- Microsoft Trusted Signing:
+   1. Install [Trusted Signing dlib package](https://www.nuget.org/packages/Microsoft.Trusted.Signing.Client):
+      ```cmd
+      nuget install Microsoft.Trusted.Signing.Client -Version 1.0.53 -x`
+      ```
+   2. Provide a [`manifest.json`](https://learn.microsoft.com/en-us/azure/trusted-signing/how-to-signing-integrations#create-a-json-file) file and place it at `%APPDATA%\Microsoft.Trusted.Signing.Client.json`:
+      ```cmd
+      notepad "%APPDATA%\Microsoft.Trusted.Signing.Client.json"
+      ```
+
+Debug configurations are not digitally signed by design.
 
 ### Building
 
diff --git a/include/Debug.props b/include/Debug.props
index bda7427..5e5f201 100644
--- a/include/Debug.props
+++ b/include/Debug.props
@@ -20,9 +20,4 @@
       <EnableCOMDATFolding>false</EnableCOMDATFolding>
     </Link>
   </ItemDefinitionGroup>
-  <Target Name="Sign" Condition="'$(ManifestCertificateThumbprint)' != '' and ('$(ConfigurationType)' == 'Application' or '$(ConfigurationType)' == 'DynamicLibrary')" AfterTargets="_Manifest" BeforeTargets="RegisterOutput" Inputs="$(OutDir)$(TargetName)$(TargetExt)" Outputs="$(IntDir)$(TargetName).sign">
-    <Message Text="Signing output file..." />
-    <Exec Command="signtool.exe sign /sha1 &quot;%ManifestCertificateThumbprint%&quot; /fd sha256 /q &quot;$(OutDir)$(TargetName)$(TargetExt)&quot;" />
-    <Touch Files="$(IntDir)$(TargetName).sign" AlwaysCreate="true" />
-  </Target>
 </Project>
\ No newline at end of file
diff --git a/include/Release.props b/include/Release.props
index d3100ed..4109659 100644
--- a/include/Release.props
+++ b/include/Release.props
@@ -26,9 +26,14 @@
       <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ResourceCompile>
   </ItemDefinitionGroup>
-  <Target Name="Sign" Condition="'$(ManifestCertificateThumbprint)' != '' and ('$(ConfigurationType)' == 'Application' or '$(ConfigurationType)' == 'DynamicLibrary')" AfterTargets="_Manifest" BeforeTargets="RegisterOutput" Inputs="$(OutDir)$(TargetName)$(TargetExt)" Outputs="$(IntDir)$(TargetName).sign">
-    <Message Text="Signing output file..." />
-    <Exec Command="signtool.exe sign /sha1 &quot;%ManifestCertificateThumbprint%&quot; /fd sha256 /tr &quot;%ManifestTimestampRFC3161Url%&quot; /td sha256 /q &quot;$(OutDir)$(TargetName)$(TargetExt)&quot;" />
+  <Target Name="SignLocal" Condition="('$(ConfigurationType)' == 'Application' or '$(ConfigurationType)' == 'DynamicLibrary') and '$(ManifestCertificateThumbprint)' != ''"
+    AfterTargets="_Manifest" BeforeTargets="RegisterOutput" Inputs="$(OutDir)$(TargetName)$(TargetExt)" Outputs="$(IntDir)$(TargetName).sign">
+    <Exec Command="signtool.exe sign /sha1 &quot;$(ManifestCertificateThumbprint)&quot; /fd SHA256 /tr &quot;$(ManifestTimestampRFC3161Url)&quot; /td SHA256 /q &quot;$(TargetPath)&quot;" />
+    <Touch Files="$(IntDir)$(TargetName).sign" AlwaysCreate="true" />
+  </Target>
+  <Target Name="SignAzure" Condition="('$(ConfigurationType)' == 'Application' or '$(ConfigurationType)' == 'DynamicLibrary') and exists('$(APPDATA)\Microsoft.Trusted.Signing.Client.json')"
+    AfterTargets="_Manifest" BeforeTargets="RegisterOutput" Inputs="$(OutDir)$(TargetName)$(TargetExt)" Outputs="$(IntDir)$(TargetName).sign">
+    <Exec Command="signtool.exe sign /dlib &quot;$(USERPROFILE)\.nuget\packages\microsoft.trusted.signing.client\1.0.53\bin\$(PreferredToolArchitecture)\Azure.CodeSigning.Dlib.dll&quot; /dmdf &quot;$(APPDATA)\Microsoft.Trusted.Signing.Client.json&quot; /fd SHA256 /tr &quot;http://timestamp.acs.microsoft.com&quot; /td SHA256 /q &quot;$(TargetPath)&quot;" />
     <Touch Files="$(IntDir)$(TargetName).sign" AlwaysCreate="true" />
   </Target>
 </Project>
\ No newline at end of file