3 ms·
I'm not familiar with how code signing for PE executables is performed, but I imagine it's done as a seperate step after compilation? If so, what matters is th
by throwaway7767 11y ago
I'm not familiar with how code signing for PE executables is performed, but I imagine it's done as a seperate step after compilation?
If so, what matters is that the binary pre-signing is reproducible. Ideally we should be able to remove the signature for the binary, build our own, and get a bit-identical binary.
- geofft 11y agoYeah, it's done as a separate step, and I believe it's an independent section of the file (such that you can add and remove it at will). If you recompile a bit-identical unsigned binary, you should be able to take the previous signature (including third-party timestamp!) and snap it onto that binary. You just have to treat that signature itself as data. I believe this is actually roughly the approach Debian wants to take with Secure Boot: build the loader (which is a PE binary), sign it on a secure machine, then drop the signature into the Debian source package and rebuild it. That way anyone can grab the Debian source package and `dpkg-buildpackage` it and get a validly signed bootloader, provided they haven't changed the sources and they're using the same toolchain.
- voltagex_ 11y agoWow, I didn't even think of this usecase before seeing it mentioned here. I hope they make some kind of reproducible-pbuilder which pulls the right version of the toolchains - pbulder/sbuild/cowbuild can be really difficult to set up.