server/docs/signpath/msi-file-apollo.artifact-config.xml
Rama main · réplica de lectura del repositorio original.
<?xml version="1.0" encoding="utf-8"?>
<!--
REVIEW COPY of the SignPath portal artifact configuration for slug "msi-file-apollo".
The portal is the source of truth; editing this file does NOT change signing.
See docs/signpath/README.md.
Slug: msi-file-apollo
Used by: .github/workflows/ci-windows.yml (MSI signing request),
scripts/signpath_sign.ps1 (.msi branch)
Purpose: deep-sign every FIRST-PARTY PE inside the MSI, then sign the MSI
container itself. Order matters: nested PEs first, the
<authenticode-sign/> directly under <msi-file> signs the container LAST.
STRATEGY 1 (recommended): explicit enumeration of first-party PEs only.
This NEVER touches the genuinely third-party files (SudoVDA.dll + sudovda.cat,
signed by sudovda@su.mk; nefconc.exe, signed by Nefarius; nvngx_truehdr.dll,
the NVIDIA RTX Video SDK runtime), nor any file a catalog hashes.
Only two files in the whole package are catalog-bound, because each driver's
INF copies exactly one binary:
SunshineVirtualDisplayDriver.dll ([SourceDisksFiles] lists only it)
VibeshineVhfGamepad.dll ([VibeshineVhfGamepad.CopyFiles] ditto)
Signing either changes the bytes its catalog attests to and the driver stops
installing. Everything else beside them is fair game.
The Sunshine virtual-display catalog is intentionally signed here. Its DLL
remains untouched because the catalog hashes it; signing the catalog itself
lets the installer establish the SignPath publisher without changing the
catalog-bound driver DLL.
THE VHF GAMEPAD DRIVER IS DIFFERENT and is signed here. SignPath is not
available on Nonary/libvirtualgamepad, so that package can never arrive
production-signed; it is consumed unsigned and signed as part of this
request. Two files, and only these two:
- VibeshineVhfGamepad.cat <catalog-file>, because a driver package is
trusted through its catalogue, not through a signature on the driver
binary. This is what makes the driver installable.
- VibeshineVhfGamepadDeviceSetup.exe <pe-file>. It is safe to sign only
because it is NOT listed in the INF's [VibeshineVhfGamepad.CopyFiles]
section, so the catalogue does not hash it.
VibeshineVhfGamepad.dll MUST NOT be added. The catalogue hashes it, so
signing it changes the hash the catalogue attests to and the driver stops
installing. Its integrity comes from the signed .cat, which is exactly how
Windows validates a driver package.
NOTE: the path= values are the file's logical path inside the MSI (install
layout). The WiX package installs under the Apollo directory, so top-level
app files use the "Apollo/" prefix. Confirm against a built MSI's File table
if an entry reports 0 matches.
-->
<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
<msi-file>
<!-- install root ("Apollo/") -->
<pe-file path="Apollo/sunshine.exe"><authenticode-sign/></pe-file>
<pe-file path="Apollo/uninstall.exe"><authenticode-sign/></pe-file>
<pe-file path="Apollo/libwebrtc.dll"><authenticode-sign/></pe-file>
<pe-file path="Apollo/zlib1.dll"><authenticode-sign/></pe-file>
<pe-file path="Apollo/vibeshine_truehdr.dll"><authenticode-sign/></pe-file>
<!-- Apollo/tools\ -->
<pe-file path="Apollo/tools/sunshinesvc.exe"><authenticode-sign/></pe-file>
<pe-file path="Apollo/tools/dxgi-info.exe"><authenticode-sign/></pe-file>
<pe-file path="Apollo/tools/audio-info.exe"><authenticode-sign/></pe-file>
<pe-file path="Apollo/tools/playnite-launcher.exe"><authenticode-sign/></pe-file>
<pe-file path="Apollo/tools/sunshine_wgc_capture.exe"><authenticode-sign/></pe-file>
<pe-file path="Apollo/tools/sunshine_display_helper.exe"><authenticode-sign/></pe-file>
<!--
ArtLight virtual display driver. Its catalog was previously signed only by
a SELF-SIGNED certificate that install.ps1 pushes into the machine's
Trusted Root store to make Windows accept it. Signing it here means the
catalog chains to a real CA and that root no longer has to be installed.
The probe and the Vulkan layer beside it were shipping unsigned outright.
Neither is named by the INF, so neither is catalog-bound, and both are
ours to sign.
-->
<catalog-file path="Apollo/drivers/sunshine/SunshineVirtualDisplayDriver.cat"
min-matches="1" max-matches="1">
<authenticode-sign/>
</catalog-file>
<pe-file path="Apollo/drivers/sunshine/virtualdisplay_probe.exe"
min-matches="1" max-matches="1">
<authenticode-sign/>
</pe-file>
<pe-file path="Apollo/drivers/sunshine/vulkan-layer/VkLayer_sunshine_hdr.dll"
min-matches="1" max-matches="1">
<authenticode-sign/>
</pe-file>
<!--
ArtLight VHF gamepad driver. Present only when the installer is built
with SUNSHINE_BUNDLE_VHF_GAMEPAD_DRIVER=ON, so both entries are optional:
min-matches="0" keeps a build without the payload from failing the whole
request.
-->
<catalog-file path="Apollo/drivers/vhf-gamepad/driver/VibeshineVhfGamepad.cat"
min-matches="0" max-matches="1">
<authenticode-sign/>
</catalog-file>
<pe-file path="Apollo/drivers/vhf-gamepad/tools/VibeshineVhfGamepadDeviceSetup.exe"
min-matches="0" max-matches="1">
<authenticode-sign/>
</pe-file>
<!--
DO NOT add these. Two reasons, and they are different reasons:
Catalog-bound. Signing changes the hash its catalog attests to:
Apollo/drivers/sunshine/SunshineVirtualDisplayDriver.dll
Apollo/drivers/vhf-gamepad/driver/VibeshineVhfGamepad.dll
Third-party, already signed by their own publishers. Re-signing would
both misattribute them and break sudovda's catalog:
Apollo/drivers/sudovda/SudoVDA.dll (+ sudovda.cat) CN=sudovda@su.mk
Apollo/drivers/sudovda/nefconc.exe CN=Nefarius Software Solutions e.U.
Apollo/drivers/sunshine/nefconc.exe CN=Nefarius Software Solutions e.U.
nvngx_truehdr.dll NVIDIA RTX Video SDK runtime
-->
<!-- sign the MSI container LAST -->
<authenticode-sign/>
</msi-file>
</artifact-configuration>
<!--
STRATEGY 2 (alternative): scoped wildcards. Only use after confirming no
catalog-bound driver DLLs live under the matched roots. Scope includes to
"Apollo/" and "Apollo/tools" so the drivers\ subtree is NOT swept in.
min-matches/max-matches
default to 1, so always set them or a wildcard matching any other count fails
the whole request.
<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
<msi-file>
<pe-file-set>
<include path="Apollo/*.exe" min-matches="0" max-matches="unbounded"/>
<include path="Apollo/*.dll" min-matches="0" max-matches="unbounded"/>
<include path="Apollo/tools/*.exe" min-matches="0" max-matches="unbounded"/>
<include path="Apollo/tools/*.dll" min-matches="0" max-matches="unbounded"/>
<for-each><authenticode-sign/></for-each>
</pe-file-set>
<authenticode-sign/>
</msi-file>
</artifact-configuration>
-->