Force SHA-256 digest for timestamp signatures

Comodo timestamp server defaults to SHA-1. To make sure timestamp signatures are SHA-256, add appropriate signtool.exe flag.
Amebis · Nov 6, 2018 · 3396f9c · 3396f9c
1 parent f6ce76d
commit 3396f9c
Show file tree

Hide file tree

Showing 3 changed files with 2 additions and 2 deletions.
diff --git a/MSI/MSIBuild b/MSI/MSIBuild
diff --git a/MakefileLangPlatCfg.mak b/MakefileLangPlatCfg.mak
diff --git a/include/Release.props b/include/Release.props
@@ -43,7 +43,7 @@
   <ItemGroup />
   <Target Name="Sign" Condition="'$(ManifestCertificateThumbprint)' != '' and ('$(ConfigurationType)' == 'Application' or '$(ConfigurationType)' == 'DynamicLibrary')" AfterTargets="_Manifest" BeforeTargets="RegisterOutput" Inputs="$(OutDir)$(TargetName)$(TargetExt)" Outputs="$(IntDir)$(TargetName).sign">
     <Message Text="Signing output file..." />
-    <Exec Command="signtool.exe sign /sha1 &quot;%ManifestCertificateThumbprint%&quot; /fd sha256 /tr &quot;%ManifestTimestampRFC3161Url%&quot; /q &quot;$(OutDir)$(TargetName)$(TargetExt)&quot;" />
+    <Exec Command="signtool.exe sign /sha1 &quot;%ManifestCertificateThumbprint%&quot; /fd sha256 /tr &quot;%ManifestTimestampRFC3161Url%&quot; /td sha256 /q &quot;$(OutDir)$(TargetName)$(TargetExt)&quot;" />
     <Touch Files="$(IntDir)$(TargetName).sign" AlwaysCreate="true" />
   </Target>
 </Project>