OpenVPN / tap-windows6

Windows TAP driver (NDIS 6)
Other
794 stars 237 forks source link

How to off Test Signing in buildtap.py #169

Open lucidmaj7 opened 4 months ago

lucidmaj7 commented 4 months ago

Since File Digest Algorithm is not set in the test signing settings of the visual studio project, it is attempted with sha1. However, sha1 is not supported and sha256 is recommended. (sha1 is deprecated.)

When building with buildtap.py, it tries test signing by default, but the build fails for this reason.

  The driver will be test-signed. Driver signing options can be changed from the project properties.
  Sign Inputs: C:\Users\..............\tap0000.sys
  C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x86\signtool.exe sign /ph /sha1 "E81EDA6C7D8D72045CADBEA3FE0625EDEF77C047"
SIGNTASK : SignTool error : No file digest algorithm specified. Please specify the digest algorithm with the /fd flag. Using /fd SHA256 is recomme
nded and more secure than SHA1. Calling signtool with /fd sha1 is equivalent to the previous behavior. In order to select the hash algorithm used
in the signing certificate's signature, use the /fd certHash option. [C:\Users\.......\tap-windows6\src\tap-windows6.vcxproj]

I wish it was possible to build without testsign.

lucidmaj7 commented 4 months ago

Adding /p:SignMode=Off to msbuild.exe turns test signing off.

  def build_ewdk(self, project_file, arch):
        self.run_ewdk('msbuild.exe /p:SignMode=Off %s /p:Configuration=%s /p:Platform=%s' % (
               project_file,
               self.configuration,
               self.architecture_platform_map[arch]
               ))