mozilla-releng / mozilla-releng/scriptworker-scripts
[signingscript] run osslsigncode verify with known CA bundles
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 16
- Forks
- 38
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 14
Description
As a followup for https://bugzilla.mozilla.org/show_bug.cgi?id=1769081, one thing we could do to detect this kind of thing earlier is verify at signing time that (as far as we can determine) all supported windows versions will be able to verify our signed artifact, e.g. by storing CA bundles that contain the trusted CAs for each version and running osslsigncode against that.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the signingscript implementation and the linked Bugzilla report, then determine how signing currently handles verification. Done means storing CA bundles for supported Windows versions and running osslsigncode verify against them at signing time.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100