Repository navigation
fix(release): the Authenticode gate pins Artifact Signing's issuer and EKU, so a trusted self-signed CN=Matt Gradwohl certificate no longer passes (#2990) [backport 0.9] - #3021
Merged
Conversation
…d EKU, so a trusted self-signed CN=Matt Gradwohl certificate no longer passes (#2990) (#3000) * fix(release): the Authenticode gate also pins Artifact Signing's issuer and extended key usage, so a trusted self-signed CN=Matt Gradwohl certificate no longer passes (#2990) cmake/VerifyWindowsSignatures.cmake accepted any Valid, timestamped signature whose signer CN was TASKSMACK_EXPECTED_SIGNER. It now also requires the signer certificate's issuer to be like TASKSMACK_EXPECTED_ISSUER (default "CN=Microsoft ID Verified CS [AE]OC CA [0-9][0-9], O=Microsoft Corporation, C=US"; the dry run's certificate is issued by "... EOC CA 04 ...") and one of its extended key usages to be like TASKSMACK_EXPECTED_EKU (default 1.3.6.1.4.1.311.97.*; the certificate carries 1.3.6.1.4.1.311.97.1.0 and its identity validation's own 1.3.6.1.4.1.311.97.<id>). Both are stable across the certificates' few-day rotation, and the issuer pattern survives a CA rollover. The CN and same-subject checks stay. The decision is now one PowerShell function, Test-TaskSmackSignatures, which the script can write out (TASKSMACK_WRITE_SIGNATURE_CHECK) without checking anything. tools/test-verify-windows-signatures.ps1 (CTest VerifyWindowsSignaturesScript, pwsh-script) calls it with certificates made in memory with CertificateRequest: a self-signed CN=Matt Gradwohl one, an internal CA's and a lookalike CA name fail, the Azure-shaped chain passes, also across a rotation onto CA 05. Nothing is signed, stored or trusted. Both new options are CMake cache options beside TASKSMACK_EXPECTED_SIGNER and reach CPack's pre-build check through CPackProjectConfig.cmake.in; tools/verify-windows-signatures.ps1 takes optional -ExpectedIssuer/-ExpectedEku and otherwise uses the script's defaults, so release.yml needs no change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(release): the expected-issuer row describes the pattern without a bracket pair the link audit reads as a reference (#2990) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 2bc934d)
mgradwohl
added
bug
mgradwohl
enabled auto-merge (squash)
October 26, 2026 05:18
github-actions
Bot
added
documentation
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #3000 to
release/0.9for v0.9.1. The backport action couldn't cherry-pick it, so I did it by hand withgit cherry-pick -x.There was one conflict, a modify/delete on
tools/verify-windows-signatures.ps1. That file exists only on main (#2946), so I resolved it withgit rm. release/0.9 keeps its inline signature check in release.yml (cmake -DTASKSMACK_VERIFY_DIR=... -P repo/cmake/VerifyWindowsSignatures.cmake). That check now picks up the issuer and EKU pins from the defaults, with no workflow change.Checked on this branch:
tools/test-verify-windows-signatures.ps1passes. Its in-memory certificates cover self-signedCN=Matt Gradwohl(fails), the Azure-shaped chain (passes), a CA rollover, an AOC CA, and a wrong EKU or issuer (fails). #3000's agent also ran the inline-style call on this cherry-picked tree against the real signed exes from dry run 40245228873, and it printed OK.Fixes #2990 on release/0.9.
🤖 Generated with Claude Code