Update Windows signing certificate SHA hash in Makefile
#4946
Conversation
|
That's entirely possible; there's definitely a chance we don't need this. |
bk2204
left a comment
bk2204
left a comment
There was a problem hiding this comment.
It is possible we don't need this, but since the alternative is that our release fails and I'd like for at least our next release to be rather boring considering the problems we had last time, let's go ahead with this. We can investigate further with our test repo and see if it's not needed in the future, and if so, remove it.
Also, I'm sure you already thought of this, but since I didn't see the cert myself, this is specifically the certificate fingerprint, and not a hash of the PKCS#12 file, so you'd need to query OpenSSL for this directly if you didn't.
|
Actually, OpenSSL says the certificate SHA-1 should be The thing I did here is this: I think the hash you provided is that of the PKCS#12 file, which I don't think is what Windows wants here. |
The Git LFS signing certificate for Windows binaries has changed, so we update the default signing certificate SHA-1 hash in the Makefile. (The last update was in 2019 in PR git-lfs#3623.) The commands used to generate this hash were: openssl pkcs12 -info -in codesign.pfx -out foo.pem openssl x509 -text -in foo.pem -fingerprint | \ grep Fingerprint | sed 's/^SHA1 Fingerprint=//' | \ sed 's/://g' | tr [:upper:] [:lower:] h/t kb2204 for the info on the fingerprint
chrisd8088
force-pushed
the
update-windows-cert-sha
branch
from
7187bd3 to
16eec17
Compare
|
Thanks for the correction, @bk2204 -- I think I've updated this again now with the expected hash of the fingerprint. |
The Git LFS signing certificate for Windows binaries has changed, so we update the default signing certificate SHA-1 hash in the Makefile. (The last update was in commit 16eec17 of PR git-lfs#4946 in 2022.) The commands used to generate this hash were: openssl pkcs12 -info -in codesign.pfx -out codesign.pem openssl x509 -text -in codesign.pem -fingerprint | \ grep Fingerprint | sed 's/^SHA1 Fingerprint=//' | \ sed 's/://g' | tr [:upper:] [:lower:]
3 participants
The Git LFS signing certificate for Windows binaries has changed, so we update the default signing certificate SHA-1 hash in the
Makefile.(The last update was in 2019 in PR #3623.)