fix(portable-trust): accept ACS/Microsoft RFC3161 timestamp tokens - #30
Merged
Marc-André Moreau (mamoreau-devolutions) merged 2 commits intoAug 11, 2026
Merged
Conversation
Parse fractional-second TSTInfo genTime (Microsoft ACS) and rewrite nested timestamp SignedData bags to drop attribute-certificate CertificateChoices the cms crate cannot decode, so --require-valid-timestamp works with AuthRoot.
Prepare release packaging after the portable ACS/Microsoft RFC3161 timestamp trust fix.
Marc-André Moreau (mamoreau-devolutions)
requested a review
from a team
as a code owner
August 11, 2026 15:47
Marc-André Moreau (mamoreau-devolutions)
merged commit Aug 11, 2026
c78b20c
into
master
36 checks passed
Marc-André Moreau (mamoreau-devolutions)
deleted the
copilot/acs-timestamp-trust-bug
branch
August 11, 2026 18:31
Marc-André Moreau (mamoreau-devolutions)
added a commit
to Devolutions/windbg-tool
that referenced
this pull request
Aug 11, 2026
## Summary
- Windows packages dry-run failed validating ACS-signed PEs: `timestamp
required by policy but no cryptographically valid trusted RFC3161
timestamp token was found`.
- Signatures were good (Windows Authenticode Valid). The bug was in
**psign 0.6.1** portable RFC3161 trust.
## Fix
- Bump CI `psign-tool` pin to **0.6.2** (`psign-tool-linux-x64.zip`
SHA256 updated).
- Restore full portable trust policy for project-owned PEs:
```
psign-tool portable trust-verify-pe \
--prefer-timestamp-signing-time \
--require-valid-timestamp \
--allow-loose-signing-cert \
--online-aia
```
- Keep `verify-pe` + signer CN checks for project-owned and Microsoft
runtime PEs.
- Keep an explicit embedded RFC3161 attribute presence check on
project-owned PEs for clearer failures.
## Upstream
- psign fix: Devolutions/psign#30
- psign release:
https://github.com/Devolutions/psign/releases/tag/v0.6.2
## Failed run
https://github.com/Devolutions/windbg-tool/actions/runs/31491249545/job/93780036559
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Portable
trust-verify-pe --require-valid-timestamprejected real Microsoft ACS / Azure Trusted Signing PE signatures and Microsoft runtime DLLs that Windows accepts as Valid.Root cause
Two bugs in
crates/psign-authenticode-trust/src/rfc3161_extract.rs:TSTInfo.genTime— ACS emits e.g.20260810234021.194Z; strictderGeneralizedTimerejected them, so trusted extract returnedNone.CertificateChoices [1]entries thecmscrate cannot decode, so nestedSignedDatadecode failed (e.g.dbghelp.dll).Fix
genTimeparse (fractional seconds truncated to whole seconds forUtcDate).SignedDatabefore decode: keep only X.509 SEQUENCE certs; drop attr-cert choices and CRLs (not needed for imprint / CMS sig / TSA chain).docs/authenticode-trust-stack.md,docs/rust-sip-gaps.md.Validation
cargo test/clippy -p psign-authenticode-trustpass.Consumer notes (windbg-tool)
A release after merge (e.g. 0.6.2) is needed for Linux CI to pin the published
psign-toolzip + SHA256 — unreleased worktree builds cannot be used in release CI.Recommended ACS PE verify flags after the bump:
Test plan
--require-valid-timestampdbghelp.dllwith--require-valid-timestamp