1075705 - install osslsigncode on linux signing machines

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[[e-mail] (:bhearsum)]

Attachment: install osslsigncode on linux signing machines

https://bugzilla.mozilla.org/show_bug.cgi?id=711210#c15 suggested that that the version in our EPEL repo (1.3.1) doesn't work, but my own tests have it signing without issue. The version may have changed since that comment.

In any case, it looks like I won't need to build a new one.

Comment 1

[[e-mail] (:bhearsum)]

Comment on attachment 8498328 [details] [diff] [review]
install osslsigncode on linux signing machines

Oof. Turns out my original test was done with Mono signcode. Our current version of osslsigncode doesn't seem to be working after all, or I'm doing it wrong. I also noticed that the current version we have doesn't support sha1 hashes (though I don't know what that means in this context). Need to look into this some more - removing review request for now.

Comment 2

[[e-mail] (:bhearsum)]

Comment on attachment 8498328 [details] [diff] [review]
install osslsigncode on linux signing machines

We definitely need a newer osslsigncode. The latest version available in EPEL only supports DER keys, which cannot be encrypted. The latest version supports PEM and PVK, which means we don't have to do any conversion. It also supports sha1 hashes and some options to pass in the passphrase. Sounds like it's a better thing all around. I need to get it built and uploaded to the Puppet servers, then I'll post a new patch.

Comment 3

[[e-mail] (:bhearsum)]

After much fuss I managed to get the latest osslsigncode (1.7.1) built. I'm having trouble getting it to sign our test.exe file, but I think that's going to be fixable. Once I make sure everything works by hand, I'll get the package ready to deploy.

Comment 4

[[e-mail] (:bhearsum)]

Woo, signing works fine with an actual Firefox binary - we probably need a 64-bit test binary to use as a test signing file. That doesn't blocking deploying osslsigncode though.

Comment 5

[[e-mail] (:bhearsum)]

Attachment: install osslsigncode on linux signing machines

After struggling with osslsigncode's terrible source package, I managed to get this built (needed to rerun aclocal and automake). I was surprised that I needed a custom repo for this, but I guess that's because there's a different version of it in EPEL?

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 8498881 [details] [diff] [review]
install osslsigncode on linux signing machines

You needed a custom repo because that's the best practice now :)