From 907985a0b9c730edaf20bd00c1205e54bcd0b9bd Mon Sep 17 00:00:00 2001 From: enricobuehler Date: Wed, 29 Jul 2026 12:58:53 +0200 Subject: [PATCH] docs(packaging/windows): record the driver-signing fingerprint MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The stable cert is live and CI is signing with it. Fills in the placeholder in both docs and adds the one-liner to check an installed driver against it. Thumbprint 4B8493E7CD565758D335F8F4F05C5A7261A13E02, verified off the .cer a real windows-host build produced on the runner, not from the key material: RSA 3072, valid to 2036, extensions 2.5.29.15/37/14 and nothing else. The decisive part is that the pf-vdisplay and gamepad bundles now carry the SAME thumbprint — the per-build fallback had each script mint its own 2048-bit cert, so they never matched. That is what proves the secret reached the build rather than the fallback quietly running again. Co-Authored-By: Claude Opus 5 (1M context) --- SECURITY.md | 3 ++- packaging/windows/README.md | 10 +++++++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 9f961a91..4faec965 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -74,7 +74,8 @@ us beyond the download itself. reach its code-signing certificate fails to build rather than falling back to a self-signed one. Check with `Get-AuthenticodeSignature punktfunk-host-setup-1.2.3.exe`. - **The Windows drivers** (virtual display, virtual gamepads) are signed with a stable self-signed - certificate, `CN=punktfunk-driver`, whose fingerprint is published in + certificate, `CN=punktfunk-driver` + (SHA-1 `4B8493E7CD565758D335F8F4F05C5A7261A13E02`), also published in [`packaging/windows/README.md`](packaging/windows/README.md). The installer has to add it to the machine's trusted roots for a self-signed driver to install at all, so — unlike the cases above — this signature does **not** authenticate the download: it gives the drivers a stable publisher diff --git a/packaging/windows/README.md b/packaging/windows/README.md index 70193eed..36102318 100644 --- a/packaging/windows/README.md +++ b/packaging/windows/README.md @@ -153,7 +153,15 @@ Our three UMDF drivers are signed with a **stable self-signed code-signing cert* is a **hard failure** (`-RequireSignedCert`, default `auto` off `GITHUB_REF`); canary and local builds still fall back to a per-build throwaway. -**Current fingerprint (SHA-1 thumbprint):** `` +**Current fingerprint (SHA-1 thumbprint):** `4B8493E7CD565758D335F8F4F05C5A7261A13E02` + +Verify a shipped driver against it: + +```powershell +$dll = Get-ChildItem C:\Windows\System32\DriverStore\FileRepository\pf_vdisplay*\pf_vdisplay.dll | + Select-Object -First 1 -Expand FullName +(Get-AuthenticodeSignature $dll).SignerCertificate.Thumbprint +``` Why stable matters here. The installer trusts the `.cer` that ships in the bundle (`certutil -addstore -f Root` + `TrustedPublisher`, `crates/punktfunk-host/src/windows/install.rs`),