-
Notifications
You must be signed in to change notification settings - Fork 131
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
5 changed files
with
97 additions
and
103 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,33 +1,30 @@ | ||
| /* | ||
| OpenSSL based Authenticode signing for PE/MSI/Java CAB files. | ||
| OpenSSL based Authenticode signing for PE/MSI/Java CAB files. | ||
|
|
||
| Copyright (C) 2005-2014 Per Allansson <[email protected]> | ||
| Copyright (C) 2018 Michał Trojnara <[email protected]> | ||
| Copyright (C) 2005-2014 Per Allansson <[email protected]> | ||
| Copyright (C) 2018 Michał Trojnara <[email protected]> | ||
|
|
||
| This program is free software: you can redistribute it and/or modify | ||
| it under the terms of the GNU General Public License as published by | ||
| the Free Software Foundation, either version 3 of the License, or | ||
| (at your option) any later version. | ||
| This program is free software: you can redistribute it and/or modify | ||
| it under the terms of the GNU General Public License as published by | ||
| the Free Software Foundation, either version 3 of the License, or | ||
| (at your option) any later version. | ||
|
|
||
| This program is distributed in the hope that it will be useful, | ||
| but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| GNU General Public License for more details. | ||
| This program is distributed in the hope that it will be useful, | ||
| but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| GNU General Public License for more details. | ||
|
|
||
| You should have received a copy of the GNU General Public License | ||
| along with this program. If not, see <http://www.gnu.org/licenses/>. | ||
|
|
||
| In addition, as a special exception, the copyright holders give | ||
| permission to link the code of portions of this program with the | ||
| OpenSSL library under certain conditions as described in each | ||
| individual source file, and distribute linked combinations | ||
| including the two. | ||
| You must obey the GNU General Public License in all respects | ||
| for all of the code used other than OpenSSL. If you modify | ||
| file(s) with this exception, you may extend this exception to your | ||
| version of the file(s), but you are not obligated to do so. If you | ||
| do not wish to do so, delete this exception statement from your | ||
| version. If you delete this exception statement from all source | ||
| files in the program, then also delete it here. | ||
| */ | ||
| You should have received a copy of the GNU General Public License | ||
| along with this program. If not, see <http://www.gnu.org/licenses/>. | ||
|
|
||
| In addition, as a special exception, the copyright holders give | ||
| permission to link the code of portions of this program with the | ||
| OpenSSL library under certain conditions as described in each | ||
| individual source file, and distribute linked combinations | ||
| including the two. | ||
| You must obey the GNU General Public License in all respects | ||
| for all of the code used other than OpenSSL. If you modify | ||
| file(s) with this exception, you may extend this exception to your | ||
| version of the file(s), but you are not obligated to do so. If you | ||
| do not wish to do so, delete this exception statement from your | ||
| version. If you delete this exception statement from all source | ||
| files in the program, then also delete it here. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,14 @@ | ||
| osslsigncode | ||
| ============ | ||
|
|
||
|
|
||
| == WHAT IS IT? | ||
| ## WHAT IS IT? | ||
|
|
||
| osslsigncode is a small tool that implements part of the functionality | ||
| of the Microsoft tool signtool.exe - more exactly the Authenticode | ||
| signing and timestamping. But osslsigncode is based on OpenSSL and cURL, | ||
| and thus should be able to compile on most platforms where these exist. | ||
|
|
||
|
|
||
| == WHY? | ||
| ## WHY? | ||
|
|
||
| Why not use signtool.exe? Because I don't want to go to a Windows | ||
| machine every time I need to sign a binary - I can compile and build | ||
|
|
@@ -19,26 +17,24 @@ since the signtool.exe makes good use of the CryptoAPI in Windows, and | |
| these APIs aren't (yet?) fully implemented in Wine, so the signtool.exe | ||
| tool would fail. And, so, osslsigncode was born. | ||
|
|
||
|
|
||
| == WHAT CAN IT DO? | ||
| ## WHAT CAN IT DO? | ||
|
|
||
| It can sign and timestamp PE (EXE/SYS/DLL/etc), CAB and MSI files. It supports | ||
| the equivalent of signtool.exe's "-j javasign.dll -jp low", i.e. add a | ||
| valid signature for a CAB file containing Java files. It supports getting | ||
| the timestamp through a proxy as well. It also supports signature verification, | ||
| removal and extraction. | ||
|
|
||
|
|
||
| == INSTALLATION | ||
| ## INSTALLATION | ||
|
|
||
| The usual way: | ||
|
|
||
| ``` | ||
| ./configure | ||
| make | ||
| make install | ||
| ``` | ||
|
|
||
|
|
||
| == USAGE | ||
| ## USAGE | ||
|
|
||
| Before you can sign a file you need a Software Publishing | ||
| Certificate (spc) and a corresponding private key. | ||
|
|
@@ -54,39 +50,39 @@ key which must be a key file in DER or PEM format, or if osslsigncode was | |
| compiled against OpenSSL 1.0.0 or later, in PVK format. | ||
|
|
||
| To sign a PE or MSI file you can now do: | ||
|
|
||
| ``` | ||
| osslsigncode sign -certs <cert-file> -key <der-key-file> \ | ||
| -n "Your Application" -i http://www.yourwebsite.com/ \ | ||
| -in yourapp.exe -out yourapp-signed.exe | ||
|
|
||
| -n "Your Application" -i http://www.yourwebsite.com/ \ | ||
| -in yourapp.exe -out yourapp-signed.exe | ||
| ``` | ||
| or if you are using a PEM or PVK key file with a password together | ||
| with a PEM certificate: | ||
|
|
||
| ``` | ||
| osslsigncode sign -certs <cert-file> \ | ||
| -key <key-file> -pass <key-password> \ | ||
| -n "Your Application" -i http://www.yourwebsite.com/ \ | ||
| -in yourapp.exe -out yourapp-signed.exe | ||
|
|
||
| -key <key-file> -pass <key-password> \ | ||
| -n "Your Application" -i http://www.yourwebsite.com/ \ | ||
| -in yourapp.exe -out yourapp-signed.exe | ||
| ``` | ||
| or if you want to add a timestamp as well: | ||
|
|
||
| ``` | ||
| osslsigncode sign -certs <cert-file> -key <key-file> \ | ||
| -n "Your Application" -i http://www.yourwebsite.com/ \ | ||
| -t http://timestamp.verisign.com/scripts/timstamp.dll \ | ||
| -in yourapp.exe -out yourapp-signed.exe | ||
|
|
||
| -n "Your Application" -i http://www.yourwebsite.com/ \ | ||
| -t http://timestamp.verisign.com/scripts/timstamp.dll \ | ||
| -in yourapp.exe -out yourapp-signed.exe | ||
| ``` | ||
| You can use a certificate and key stored in a PKCS#12 container: | ||
|
|
||
| ``` | ||
| osslsigncode sign -pkcs12 <pkcs12-file> -pass <pkcs12-password> \ | ||
| -n "Your Application" -i http://www.yourwebsite.com/ \ | ||
| -in yourapp.exe -out yourapp-signed.exe | ||
|
|
||
| -n "Your Application" -i http://www.yourwebsite.com/ \ | ||
| -in yourapp.exe -out yourapp-signed.exe | ||
| ``` | ||
| To sign a CAB file containing java class files: | ||
|
|
||
| ``` | ||
| osslsigncode sign -certs <cert-file> -key <key-file> \ | ||
| -n "Your Application" -i http://www.yourwebsite.com/ \ | ||
| -jp low \ | ||
| -in yourapp.cab -out yourapp-signed.cab | ||
|
|
||
| -n "Your Application" -i http://www.yourwebsite.com/ \ | ||
| -jp low \ | ||
| -in yourapp.cab -out yourapp-signed.cab | ||
| ``` | ||
| Only the 'low' parameter is currently supported. | ||
|
|
||
| You can check that the signed file is correct by right-clicking | ||
|
|
@@ -95,9 +91,7 @@ and then choose the signature from the list, and click on | |
| Details. You should then be presented with a dialog that says | ||
| amongst other things that "This digital signature is OK". | ||
|
|
||
|
|
||
|
|
||
| == CONVERTING FROM PVK TO DER | ||
| ## CONVERTING FROM PVK TO DER | ||
|
|
||
| (This guide was written by Ryan Rubley) | ||
|
|
||
|
|
@@ -116,22 +110,24 @@ use instead of your *.spc file. It's the same basic thing, in a different format | |
| For your PVK file, you will need to download a little utility called | ||
| PVK.EXE. This can currently be downloaded at | ||
|
|
||
| http://support.globalsign.net/en/objectsign/PVK.zip | ||
| http://support.globalsign.net/en/objectsign/PVK.zip | ||
|
|
||
| Run: pvk -in foo.pvk -nocrypt -out foo.pem | ||
| Run: | ||
| ``` | ||
| pvk -in foo.pvk -nocrypt -out foo.pem | ||
| ``` | ||
|
|
||
| This will convert your PVK file to a PEM file. | ||
| From there, you can copy the PEM file to a Linux box, and run: | ||
|
|
||
| ``` | ||
| openssl rsa -outform der -in foo.pem -out foo.der | ||
|
|
||
| ``` | ||
| This will convert your PEM file to a DER file. | ||
|
|
||
| You need the *.p7b and *.der files to use osslsigncode, instead of your | ||
| *.spc and *.pvk files. | ||
|
|
||
|
|
||
| == BUGS, QUESTIONS etc. | ||
| ## BUGS, QUESTIONS etc. | ||
|
|
||
| Send an email to [email protected] | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters