Skip to content

Commit 4d78c04

Browse files
juenglinjuenglin
committed
CI: vendor the emSign Root CS CA - G3 cross-certificate for the trust probe
The code-signing intermediates are issued by the cross-signed emSign Root CS CA - G3, which the test hosts' chains do not carry. Without it a trusted emSign ECC Root CA - G3 would still produce PartialChain and be mistaken for a missing trust anchor.
1 parent 464c5db commit 4d78c04

4 files changed

Lines changed: 60 additions & 13 deletions

File tree

‎.spdx-ignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,4 @@ cuda_core/cuda/**/*.pyi
2424

2525
# Third-party eMudhra disclosure data, kept byte-identical to the published files
2626
ci/tools/runner_trust_probe_chains/**
27+
ci/tools/runner_trust_probe_issuers/**

‎ci/tools/runner_trust_probe.ps1‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -51,19 +51,24 @@ Record-Check 'emSign ECC Root CA - G3 store state' 'INFO' "LocalMachine\Root=$in
5151
# Pass = explicitly distrusted, or the chain no longer reaches a trusted root
5252
# (the hosted images have removed the roots rather than enabling the disallowed CTL).
5353
$certs = @(Get-EmudhraIntermediates)
54-
# The vendored host chains carry the non-root issuer (emSign Root TLS CA - G3). Supplying
55-
# it keeps a missing parent from being mistaken for a missing trust anchor.
56-
$issuerCerts = @(
57-
Get-ChildItem -LiteralPath (Join-Path $PSScriptRoot 'runner_trust_probe_chains') -Filter '*.pem' |
58-
ForEach-Object {
59-
[regex]::Matches((Get-Content -LiteralPath $_.FullName -Raw), '-----BEGIN CERTIFICATE-----([^-]+)-----END CERTIFICATE-----') |
60-
ForEach-Object {
61-
[System.Security.Cryptography.X509Certificates.X509Certificate2]::new([System.Convert]::FromBase64String(($_.Groups[1].Value -replace '\s', '')))
62-
}
63-
}
64-
)
65-
if ($issuerCerts.Count -eq 0) {
66-
throw "No certificates found in $PSScriptRoot\runner_trust_probe_chains."
54+
# Supply the non-root issuers so a missing parent is not mistaken for a missing trust
55+
# anchor: emSign Root TLS CA - G3 comes with the vendored host chains, and
56+
# emSign Root CS CA - G3 (cross-signed by emSign ECC Root CA - G3) with the issuers.
57+
$issuerCerts = @()
58+
foreach ($dirName in 'runner_trust_probe_chains', 'runner_trust_probe_issuers') {
59+
$found = @(
60+
Get-ChildItem -LiteralPath (Join-Path $PSScriptRoot $dirName) -Filter '*.pem' |
61+
ForEach-Object {
62+
[regex]::Matches((Get-Content -LiteralPath $_.FullName -Raw), '-----BEGIN CERTIFICATE-----([^-]+)-----END CERTIFICATE-----') |
63+
ForEach-Object {
64+
[System.Security.Cryptography.X509Certificates.X509Certificate2]::new([System.Convert]::FromBase64String(($_.Groups[1].Value -replace '\s', '')))
65+
}
66+
}
67+
)
68+
if ($found.Count -eq 0) {
69+
throw "No certificates found in $PSScriptRoot\$dirName."
70+
}
71+
$issuerCerts += $found
6772
}
6873
$usable = @()
6974
$states = @()

‎ci/tools/runner_trust_probe_issuers/README.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
Issuer certificates for the Windows runner trust probe
2+
======================================================
3+
4+
ci/tools/runner_trust_probe.ps1 passes these certificates to Windows chain
5+
building, together with the chains in ../runner_trust_probe_chains, so a missing
6+
parent certificate is not mistaken for a missing trust anchor.
7+
8+
emsign-root-cs-ca-g3-cross.pem
9+
emSign Root CS CA - G3, issued by emSign ECC Root CA - G3 (the
10+
cross-certificate of the self-signed emSign Root CS CA - G3). It is the
11+
issuer of the two native code-signing intermediates (EM OV CS CA - G3B
12+
and G3C), which the test hosts' chains do not cover.
13+
14+
Source: https://repository.emsign.com/certs/crosssign/rootcscag3.crt
15+
(DER; converted to PEM without other changes)
16+
SHA-256: 7137FA71AD46BA686F746D1014AC57E8E6C6E9AF4AA2F73C0C44A5CF27DEBB59
17+
Valid: 2024-07-11 to 2039-07-09
18+
Checked: same public key as the self-signed emSign Root CS CA - G3, and
19+
its key verifies the signatures of both code-signing
20+
intermediates in impacted-intermediates.json.

‎ci/tools/runner_trust_probe_issuers/emsign-root-cs-ca-g3-cross.pem‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDaDCCAu2gAwIBAgIPFMZ1TpPl2UxjjT/JD612MAoGCCqGSM49BAMDMGsxCzAJ
3+
BgNVBAYTAklOMRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVkaHJh
4+
IFRlY2hub2xvZ2llcyBMaW1pdGVkMSAwHgYDVQQDExdlbVNpZ24gRUNDIFJvb3Qg
5+
Q0EgLSBHMzAeFw0yNDA3MTExNjEwMzBaFw0zOTA3MDkxODMwMDBaMFUxCzAJBgNV
6+
BAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMR8w
7+
HQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMHYwEAYHKoZIzj0CAQYFK4EE
8+
ACIDYgAESl9kM5D0VA/Og76dz5Xzw1hnGQ4fSR9993/qBkkvI48pXQVKOdyHCgAZ
9+
ThgWejQ8OpFRiTISjpabn4tfRFOYuzhApR/XxGbkg9X+2cEtbyghF9CdoF91W22V
10+
/R2EVe4xo4IBazCCAWcwHwYDVR0jBBgwFoAUfF0ChBPUzIqbgc4XHC4pHpxIY0Iw
11+
HQYDVR0OBBYEFGh0A/iFyo1UUFcdFuDI3kUNq80tMBMGA1UdJQQMMAoGCCsGAQUF
12+
BwMDMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwOi8vcmVw
13+
b3NpdG9yeS5lbXNpZ24uY29tMHgGCCsGAQUFBwEBBGwwajAiBggrBgEFBQcwAYYW
14+
aHR0cDovL29jc3AuZW1zaWduLmNvbTBEBggrBgEFBQcwAoY4aHR0cDovL3JlcG9z
15+
aXRvcnkuZW1zaWduLmNvbS9jZXJ0cy9lbVNpZ25FQ0NSb290Q0FHMy5jcnQwMwYD
16+
VR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5lbXNpZ24uY29tP1Jvb3RDQUczLmNy
17+
bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAKBggqhkjOPQQD
18+
AwNpADBmAjEAuFH6M20dolyKkZ9AD7DsgJyo8MkQTAc05niLQzoyqo60+mYdtseW
19+
P2tOfXULs3XBAjEA7r4peOh9eWi+vDbjD8kB2lxRGYW2n/I2+KTLKYAOzp/9GBmx
20+
x0cnzyQU+QX3koAd
21+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)