Commit def7e3d
tools: upgrade Windows digital signature to SHA256
signtool still defaults to SHA1, which is vulnerable to certain
collisions. This switches to SHA256, which is stronger and which also
matches the hash function used by the signing certificate.
Technically, `/fd certHash` would be a better choice, but I don't know
if it is widely supported.
PR-URL: #47206
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>1 parent 0b78ac5 commit def7e3d
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -3,7 +3,7 @@ | |||
| 3 | 3 | set timeservers=(http://timestamp.globalsign.com/scripts/timestamp.dll http://timestamp.comodoca.com/authenticode http://timestamp.verisign.com/scripts/timestamp.dll http://tsa.starfieldtech.com) | |
| 4 | 4 | ||
| 5 | 5 | for %%s in %timeservers% do ( | |
| 6 | - signtool sign /a /d "Node.js" /du "https://nodejs.org" /t %%s %1 | ||
| 6 | + signtool sign /a /d "Node.js" /du "https://nodejs.org" /fd SHA256 /t %%s %1 | ||
| 7 | 7 | if not ERRORLEVEL 1 ( | |
| 8 | 8 | echo Successfully signed %1 using timeserver %%s | |
| 9 | 9 | exit /b 0 | |
0 commit comments