It seems like the oracle certificate that we bundle in floppy/oracle-cert.cer has expired in march of last year. This was introduced by commit 384b4fa3833bd29a6f74720e5a87592f3a4d4b25 back in 2017.
It appears to be used for VirtualBox guest additions as it has the code-signing attribute set. But just for the sake of comprehensiveness, let's verify...
This certificate doesn't appear to be used by script/vmtool.bat as that script looks for Oracle's certificate in the vbox guest additions iso and then installs that one. The name that it looks for is vbox*.cer under the %VBOX_SETUP_DIR%/cert directory. This path is determined by searching for VBoxWindowsAdditions-$arch.exe and using the directory that contains it.
We've also been downloading everything over http and the cert is missing a common name, so we can't use it here either.
I vote removing this as commit 0e22a26977094733dbe5aa1cd2623df4b7b65c3b supersedes its necessity.
arizvisa
commented
4 years ago
It seems like the oracle certificate that we bundle in
floppy/oracle-cert.cerhas expired in march of last year. This was introduced by commit 384b4fa3833bd29a6f74720e5a87592f3a4d4b25 back in 2017.It appears to be used for VirtualBox guest additions as it has the code-signing attribute set. But just for the sake of comprehensiveness, let's verify...
This certificate doesn't appear to be used by
script/vmtool.batas that script looks for Oracle's certificate in the vbox guest additions iso and then installs that one. The name that it looks for isvbox*.cerunder the%VBOX_SETUP_DIR%/certdirectory. This path is determined by searching forVBoxWindowsAdditions-$arch.exeand using the directory that contains it.We've also been downloading everything over http and the cert is missing a common name, so we can't use it here either.
I vote removing this as commit 0e22a26977094733dbe5aa1cd2623df4b7b65c3b supersedes its necessity.