Which tools do Oracle use signing Windows build?

Discussions related to using the OSE version of VirtualBox.
Post Reply
NTI
Posts: 21
Joined: 23. Jul 2015, 12:35

Which tools do Oracle use signing Windows build?

Post by NTI »

I have built VBox OSE 5.0.0 on Windows 7 (x86) and set up self signing to sign the build. I'd like to load a custom virtual PCI device plugin into a VM from VBox. The plugin (dll) has been signed with a code-signing key from GoDaddy. Unfortunately, it failed when I tried to load the dll using the VBox that I built.

When I checked VBox source code, it showed that it failed loading from VBox when it checked the attribute of “Sigining Time” (1.2.840.113549.1.9.5) in my certificate. In the VBox source code, it expected the type enum of this attribute (pAttrib->enmType) to be RTCRPKCS7ATTRIBUTETYPE_UNKNOWN. However, it turned out to be RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME when I debugged to check. I think there's bug about the attribute checking (..\src\VBox\Runtime\common\crypto\pkcs7-sanity.cpp). But anyway, given other commercial signed dlls can be loaded, I'm thinking maybe we shouldn't have the attribute "Signing Time" in the certificate in the first place.

There are no options from signtool.exe (the one I use on Windows) to set signing time on or off. It doesn't appear in the certificate’s properties when I right click to check any signed dlls from Windows Explorer. I don't know whether it's because of the signing tools which make a difference of attaching additional attributes to certificate or not. I'd like to know how Oracle normally does the signing. Does anyone have any idea about it?
Post Reply