0dc122cb2e
The one-step "signtool sign /fd sha256" fails on the build host with 0xc0000225 before the PIN is asked for, because crypt32 converts the legacy CryptoAPI key handle to a CNG one for SHA-2 digests, and no CNG provider is registered under the name of Certum's crypto3 CSP. Rebinding to cryptoCertum3 KSP is not an option, as it cannot see the Common profile's code-signing key. signtool's split flow avoids the conversion, so pkg/win32/sign-files.bat now does the signing in /dg, /ds, /di, timestamp and verify steps, with one PIN prompt per call as before. Make.bat's :SIGN_FILES and Inno Setup's SignTool both go through it, the latter via cmd /c. Also default PGADMIN_SIGNTOOL_DIR to SDK 10.0.26100.0, the one installed on the host, and match the PIN dialog on "Logowanie do profilu zwyk" so that a Secure profile prompt is never answered with the Common PIN. SIGNING.md gains the full setup procedure, the root cause and the split signing flow.
8 lines
274 B
Plaintext
8 lines
274 B
Plaintext
# Auto detect text files and normalize end of lines to LF (\n)
|
|
* text=auto eol=lf
|
|
|
|
# Make.bat has always been stored with CRLF; the blanket eol=lf above would
|
|
# silently rewrite the whole file the first time anything touches it.
|
|
Make.bat -text
|
|
pkg/win32/*.bat text eol=crlf
|