[tor-commits] [tor-browser-spec/master] Bug 15538: Document authenticode signing

[gk at torproject.org]

commit 87de7243b91c9a9d452ad02f202b53402d7a3a31
Author: Georg Koppen <gk at torproject.org>
Date:   Mon Apr 4 14:10:26 2016 +0000

    Bug 15538: Document authenticode signing
    
    Thanks to a cypherpunk who suggested looking for missing intermediate
    certificates. And thanks to a second cypherpunk (who might be the same
    as the first one) for preparing a patch.
---
 processes/AuthenticodeSigning | 110 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 110 insertions(+)

diff --git a/processes/AuthenticodeSigning b/processes/AuthenticodeSigning
new file mode 100644
index 0000000..453fb55
--- /dev/null
+++ b/processes/AuthenticodeSigning
@@ -0,0 +1,110 @@
+Signing Tor Browser bundles for Windows on a Linux machine
+==========================================================
+
+These instructions are for our current token donated to us by Digicert. It is an
+Aladdin eToken pro 72k.
+
+Software needed:
+----------------
+
+1) osslsigncode
+
+ - any stable version > 1.7.1 will do; using the Git mirror at
+   http://git.code.sf.net/p/osslsigncode/osslsigncode/ commit
+   e72a1937d1a13e87074e4584f012f13e03fc1d64 is working fine
+
+2) SafeNetAuthenticationClient (eToken middleware)
+
+ - version 9.0.43 (for Ubuntu 12.04+ and Debian Wheezy+); the SHA-256 sum of
+   SafeNetAuthenticationClient-SAC_9_0_43_Linux.zip is
+   50545F3FF8BC561634363E683500DCF817CB9A8B379177886F043D14C774A36E or the one
+   of the ISO file included in the archive:
+   31577e4590ea8c5dc0787fe1501d052dd7b4c0d7a4c4cfa25f6885f50415ee6c
+ - the core part is enough to get the signing going
+
+Installation
+------------
+
+1) Requirements
+
+- for the middleware: sudo apt-get install libccid pcscd openssl libpcsclite1
+- for the cert extraction/signing: sudo apt-get install opensc \
+                                                        libengine-pkcs11-openssl
+
+2) SafeNetAuthenticationClient
+
+- sudo dpkg -i SafenetAuthenticationClient-core-9.0.43-0_amd64.deb
+
+Signing and timestamping
+------------------------
+
+1) Getting the certificate
+
+- pkcs11-tool --module /usr/lib/libeTPkcs11.so --type cert --read-object \
+              --id c27eac1b263465cdd73630d94b0b92e674f01501 > tpo_cert.der
+- convert it to PEM: openssl x509 -in tpo_cert.der -inform der -outform pem \
+                     -out tpo_cert.crt
+
+2) Getting the intermediate certificate
+
+- torsocks wget https://www.digicert.com/CACerts/DigiCertEVCodeSigningCA-SHA2.crt
+- convert it to PEM: openssl x509 -in DigiCertEVCodeSigningCA-SHA2.crt \
+                     -inform der -outform pem -out middle_cert.crt
+- append it to tpo_cert.crt: cat middle_cert.crt >> tpo_cert.crt
+
+3) Signing the exectuable(s):
+
+- path/to/osslsigncode -pkcs11engine /usr/lib/engines/engine_pkcs11.so \
+                       -pkcs11module /usr/lib/libeTPkcs11.so           \
+                       -certs tpo_cert.crt                             \
+                       -key c27eac1b263465cdd73630d94b0b92e674f01501   \
+                       torbrowser-install-XXX.exe tb-XXX-signed.exe
+
+- pass the passphrase to osslsigncode in case you want to script the whole
+process by using `-pass $pass` as an additional commandline parameter
+
+4) Timestamping the executable(s):
+
+- path/to/osslsigncode add -t http://timestamp.digicert.com \
+                           -p socks://127.0.0.1:9050 \
+                           torbrowser-install-XXX.exe tb-XXX-timestamped.exe
+
+Note: the current tip of osslsigncode's master branch does not allow the
+decoupling of signing and timestamping. In order to do so one needs to apply
+the following patch:
+
+From 28b384e77fa0d4dd38751a0c72ab5976d2e38f75 Mon Sep 17 00:00:00 2001
+From: Georg Koppen <gk at torproject.org>
+Date: Fri, 5 Feb 2016 09:23:10 +0000
+Subject: [PATCH] Allow timestamping with the 'add' command
+
+
+diff --git a/osslsigncode.c b/osslsigncode.c
+index 32e37c8..2978c02 100644
+--- a/osslsigncode.c
++++ b/osslsigncode.c
+@@ -2556,16 +2556,16 @@ int main(int argc, char **argv)
+ 			if (--argc < 1) usage(argv0);
+ 			url = *(++argv);
+ #ifdef ENABLE_CURL
+-		} else if ((cmd == CMD_SIGN) && !strcmp(*argv, "-t")) {
++		} else if ((cmd == CMD_SIGN || cmd == CMD_ADD) && !strcmp(*argv, "-t")) {
+ 			if (--argc < 1) usage(argv0);
+ 			turl[nturl++] = *(++argv);
+-		} else if ((cmd == CMD_SIGN) && !strcmp(*argv, "-ts")) {
++		} else if ((cmd == CMD_SIGN || cmd == CMD_ADD) && !strcmp(*argv, "-ts")) {
+ 			if (--argc < 1) usage(argv0);
+ 			tsurl[ntsurl++] = *(++argv);
+-		} else if ((cmd == CMD_SIGN) && !strcmp(*argv, "-p")) {
++		} else if ((cmd == CMD_SIGN || cmd == CMD_ADD) && !strcmp(*argv, "-p")) {
+ 			if (--argc < 1) usage(argv0);
+ 			proxy = *(++argv);
+-		} else if ((cmd == CMD_SIGN) && !strcmp(*argv, "-noverifypeer")) {
++		} else if ((cmd == CMD_SIGN || cmd == CMD_ADD) && !strcmp(*argv, "-noverifypeer")) {
+ 			noverifypeer = 1;
+ #endif
+ 		} else if ((cmd == CMD_SIGN || cmd == CMD_ADD) && !strcmp(*argv, "-addUnauthenticatedBlob")) {
+--
+2.7.0
+
+