-
Notifications
You must be signed in to change notification settings - Fork 940
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add signatureVerified flag for each signature #994
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
General question, does warnings
reflect also discrepancies like hash of the file does not match the hash in the signature, the signature of the hash is not the same as the one in authenticated attributes, ...? What about expiration? Previously we neglected the expiration dates as far as I remember and would consider the signature valid because if the hash matches and the signature is expired, we can't reliably tell that whether the signature is OK without verification in the whole chain and that's something we didn't want to do and we just stick with what we can verify statically. I would like to have a list of possible warnings and when can the warning occur before we proceed with this.
Expiration is not looked at, the only part regarding the certificate chain that is checked is the existence of the signing certificate. Regarding the possible warnings, I'll split them into 2 parts - warnings regarding a signature and warnings regarding counter-signatures. Signature warnings (PKCS7 structure):
CounterSignature warnings:
|
I have also removed version != 1 warning because there are samples with different versions that Windows accepts and it's not reflected by the old Authenticode specification. |
lets run TC tests |
Add a flag for each signature that represents if the signature and its signer were successfully verified (digest matches etc.) in the same manner as the previous implementation.