windows: add multiple timestamps

[gdams]

fixes: adoptium/temurin-build#1963

test job: https://ci.adoptopenjdk.net/job/build-scripts/job/release/job/standalone_create_installer_windows/117/console

[karianna]

@gdams - did it work?

[douph1]

proposed fix and some improvement here gdams#1

[karianna]

proposed fix and some improvement here gdams#1

CC @gdams

[douph1]

another timeout seen yesterday

[gdams]

okay this is updated and ready to go, In principle, this could go in before the CPU releases to avoid the need for a rebuild if the signing job fails due to timeout

CC @karianna

[douph1]

We have a little pb here .. it seems a lot of url are different for sha1/sha256 sign
and we do both : >REM Dual-Signing with SHA-1/SHA-256 requires Win 8.1 SDK or later.

So we must add a param to url or manage two different list of url ..
Also some timestamp service seems to use same url for both sha1/sha256 .. but this is not clear to me

• A lot of references spell it timstamp.dll and not timestamp.dll and it is a dead service :
  https://knowledge.digicert.com/alerts/migration-of-legacy-verisign-and-symantec-time-stamping-services

It must be replaced with SHA1/SHA256 http://timestamp.digicert.com?alg=sha256

Also comodoca don't use /authenticode anymore

https://support.comodo.com/index.php?/Knowledgebase/Article/View/68/0/time-stamping-server

https://gist.github.com/Manouchehri/fd754e402d98430243455713efada710#gistcomment-3342213

But sectigo (comodoca) is only the certificate of sha1's certificate chain expired on May 31st, 2020. It's not a surprise. This certificate has long been prescribed.

Also for sha256 : http://timestamp.comodoca.com?td=sha256

So maybe we must probably append sha1/sha256 to url used with signtools when we required one or the other algo

We probably can use more timestamp server list as this maintained list : https://gist.github.com/Manouchehri/fd754e402d98430243455713efada710
(if we lower the retry delay)

https://stackoverflow.com/questions/9714798/http-timestamp-verisign-com-scripts-timstamp-dll-not-available

Sorry to not help so much as I'm not on Windows and can't test which timestamp url/service works ..

[karianna]

We have a little pb here .. it seems a lot of url are different for sha1/sha256 sign
and we do both : >REM Dual-Signing with SHA-1/SHA-256 requires Win 8.1 SDK or later.

So we must add a param to url or manage two different list of url ..
Also some timestamp service seems to use same url for both sha1/sha256 .. but this is not clear to me

• A lot of references spell it timstamp.dll and not timestamp.dll and it is a dead service :
  https://knowledge.digicert.com/alerts/migration-of-legacy-verisign-and-symantec-time-stamping-services

It must be replaced with SHA1/SHA256 http://timestamp.digicert.com?alg=sha256

Also comodoca don't use /authenticode anymore

https://support.comodo.com/index.php?/Knowledgebase/Article/View/68/0/time-stamping-server

https://gist.github.com/Manouchehri/fd754e402d98430243455713efada710#gistcomment-3342213

But sectigo (comodoca) is only the certificate of sha1's certificate chain expired on May 31st, 2020. It's not a surprise. This certificate has long been prescribed.

Also for sha256 : http://timestamp.comodoca.com?td=sha256

So maybe we must probably append sha1/sha256 to url used with signtools when we required one or the other algo

We probably can use more timestamp server list as this maintained list : https://gist.github.com/Manouchehri/fd754e402d98430243455713efada710
(if we lower the retry delay)

https://stackoverflow.com/questions/9714798/http-timestamp-verisign-com-scripts-timstamp-dll-not-available

Sorry to not help so much as I'm not on Windows and can't test which timestamp url/service works ..

CC - @gdams JIC

[douph1]

I have try to signing localy a exe and see that signing with" -fd sha56" like we did override the first sha1 signature.
So double signing doesn't work at this time .. but it must be possible with two certs

[douph1]

and dual signing msi are visibly particulary painfull
https://social.msdn.microsoft.com/Forums/ie/en-US/d4b70ecd-a883-4289-8047-cc9cde28b492/sha1-sha256-dualsigning-for-msi?forum=windowssecurity

https://support.ksoftware.net/support/solutions/articles/217399-how-do-i-dual-sign-a-file-

MSI and other file formats typically do not support dual signing.

If all our msi are already signed only with sha256 can't we stick with that ?
It will simplify script and timestamp server list

[gdams]

@douph1 after talking to some MSFT folks, SHA1 signing has been deprecated for some time. They recommend that we just use SHA256 so I'll update the PR.

[karianna]

@douph1 can you review again?

[douph1]

I will asap

[douph1]

I have done the last modifications here gdams#2
please review and merge @gdams then I will approve this one

[gdams]

@douph1 merged! thanks