From f943510140b067645a42864a99a5e196f64cccc6 Mon Sep 17 00:00:00 2001
From: Simon Rozman <simon@rozman.si>
Date: Wed, 13 Oct 2021 09:16:00 +0200
Subject: [PATCH] Upgrade code signing to SHA-256

Signed-off-by: Simon Rozman <simon@rozman.si>
---
 include/Debug.props   | 8 +-------
 include/Release.props | 8 +-------
 2 files changed, 2 insertions(+), 14 deletions(-)

diff --git a/include/Debug.props b/include/Debug.props
index a2debe8..423df30 100644
--- a/include/Debug.props
+++ b/include/Debug.props
@@ -40,13 +40,7 @@
   <ItemGroup />
   <Target Name="Sign" Condition="'$(ManifestCertificateThumbprint)' != '' and ('$(ConfigurationType)' == 'Application' or '$(ConfigurationType)' == 'DynamicLibrary')" AfterTargets="_Manifest" BeforeTargets="RegisterOutput" Inputs="$(OutDir)$(TargetName)$(TargetExt)" Outputs="$(IntDir)$(TargetName).sign">
     <Message Text="Signing output file..." />
-    <!--
-        To make Windows XP and Vista compliant signatures, the binaries have to be signed using SHA1.
-        <SignFile> switches to SHA256 if the signing certificate is SHA256.
-        Reverted to signtool.exe until we can drop Windows XP and Vista support.
-    -->
-    <!--<SignFile CertificateThumbprint="$(ManifestCertificateThumbprint)" SigningTarget="$(OutDir)$(TargetName)$(TargetExt)" />-->
-    <Exec Command="signtool.exe sign /du &quot;https://www.amebis.si&quot; /sha1 &quot;%ManifestCertificateThumbprint%&quot; /fd sha1 /q &quot;$(TargetPath)&quot;" />
+    <Exec Command="signtool.exe sign /du &quot;https://www.amebis.si&quot; /sha1 &quot;%ManifestCertificateThumbprint%&quot; /fd sha256 /q &quot;$(TargetPath)&quot;" />
     <Touch Files="$(IntDir)$(TargetName).sign" AlwaysCreate="true" />
   </Target>
 </Project>
\ No newline at end of file
diff --git a/include/Release.props b/include/Release.props
index 0c5f888..e2f4838 100644
--- a/include/Release.props
+++ b/include/Release.props
@@ -41,13 +41,7 @@
   <ItemGroup />
   <Target Name="Sign" Condition="'$(ManifestCertificateThumbprint)' != '' and ('$(ConfigurationType)' == 'Application' or '$(ConfigurationType)' == 'DynamicLibrary')" AfterTargets="_Manifest" BeforeTargets="RegisterOutput" Inputs="$(OutDir)$(TargetName)$(TargetExt)" Outputs="$(IntDir)$(TargetName).sign">
     <Message Text="Signing output file..." />
-    <!--
-        To make Windows XP and Vista compliant signatures, the binaries have to be signed using SHA1.
-        <SignFile> switches to SHA256 if the signing certificate is SHA256.
-        Reverted to signtool.exe until we can drop Windows XP and Vista support.
-    -->
-    <!--<SignFile CertificateThumbprint="$(ManifestCertificateThumbprint)" TimestampUrl="$(ManifestTimestampUrl)" SigningTarget="$(OutDir)$(TargetName)$(TargetExt)" />-->
-    <Exec Command="signtool.exe sign /du &quot;https://www.amebis.si&quot; /sha1 &quot;%ManifestCertificateThumbprint%&quot; /fd sha1 /t &quot;%ManifestTimestampUrl%&quot; /q &quot;$(TargetPath)&quot;" />
+    <Exec Command="signtool.exe sign /sha1 &quot;%ManifestCertificateThumbprint%&quot; /fd sha256 /tr &quot;%ManifestTimestampRFC3161Url%&quot; /td sha256 /q &quot;$(TargetPath)&quot;" />
     <Touch Files="$(IntDir)$(TargetName).sign" AlwaysCreate="true" />
   </Target>
 </Project>
\ No newline at end of file