Skip to content

feat: added option to sign wgt using custom certificates #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Georift merged 2 commits into from
Dec 16, 2024
Merged

feat: added option to sign wgt using custom certificates #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
17876e4
feat: added option to sign wgt using custom certificates
danielospina-b Dec 3, 2024
331ab4c
Merge branch 'main' into main
Georift Dec 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
FROM vitalets/tizen-webos-sdk

COPY entrypoint.sh .
COPY entrypoint.sh profile.xml ./

# jq for quickly parsing the TV name from the API endpoint
RUN apt update && apt install jq -y && rm -rf /var/lib/apt/lists/* && rm -rf /var/cache/apt/*
Expand Down
24 changes: 18 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,20 +39,26 @@ Follow the [Samsung uninstall instructions](https://www.samsung.com/in/support/t
#### Installation
- Run the command below, replacing first argument with the IP of your Samsung TV
- If you just want to install the default build, do not put anything after the IP address.
- (Optional) You can provide preferred [jellyfin-tizen-builds](https://github.com/jeppevinkel/jellyfin-tizen-builds) option (Jellyfin / Jellyfin-TrueHD / Jellyfin-master / Jellyfin-master-TrueHD / Jellyfin-secondary) as second argument. By default, Jellyfin option is used.
- (Optional) You can provide preferred [jellyfin-tizen-builds releases](https://github.com/jeppevinkel/jellyfin-tizen-builds/releases) release tag URL as third argument. By default, latest version is used. This is useful if you want to install older Jellyfin Tizen Client version.

- (Optional) You can provide preferred [jellyfin-tizen-builds](https://github.com/jeppevinkel/jellyfin-tizen-builds) option (Jellyfin / Jellyfin-TrueHD / Jellyfin-master / Jellyfin-master-TrueHD / Jellyfin-secondary) as second argument. By default, Jellyfin option is used.
- (Optional) You can provide preferred [jellyfin-tizen-builds releases](https://github.com/jeppevinkel/jellyfin-tizen-builds/releases) release tag URL as third argument. By default, latest version is used. This is useful if you want to install older Jellyfin Tizen Client version.
- (Optional) You can provide a custom Samsung certificate by mounting the `.p12` files at `/certificates/` and providing the certificate password as fourth argument.
- If you do not want to use either of these options and just install the default build, do not put anything after the IP address.

```bash
docker run --rm ghcr.io/georift/install-jellyfin-tizen <samsung tv ip> [build option] [tag url]
docker run --rm ghcr.io/georift/install-jellyfin-tizen <samsung tv ip> [build option] [tag url] [certificate password]
```

Example:
Examples:

```bash
docker run --rm ghcr.io/georift/install-jellyfin-tizen 192.168.0.10 Jellyfin-TrueHD "https://github.com/jeppevinkel/jellyfin-tizen-builds/releases/tag/2024-05-13-0139"
```

```bash
docker run --rm -v "$(pwd)/author.p12":/certificates/author.p12 -v "$(pwd)/distributor.p12":/certificates/distributor.p12 ghcr.io/georift/install-jellyfin-tizen 192.168.0.10 Jellyfin "" 'CertPassw0rd!' # Third argument empty to use latest tag
```

### Validating Success
#### Common Errors

- `library initialization failed - unable to allocate file descriptor table - out of memory`
Expand All @@ -77,7 +83,7 @@ Tizen application is successfully installed.
Total time: 00:00:12.205
```

At this point you can find jellyfin on your TV by navigating to Apps -> Downloaded (scroll down), where you'll find Jellyfin.
At this point you can find jellyfin on your TV by navigating to Apps -> Downloaded (scroll down), there you'll find Jellyfin.

## Supported Platforms

Expand All @@ -95,6 +101,12 @@ If it outputs: **x86_64** you're good. If not, reinstall docker, with the needed
Then use the ```--platform linux/amd64"``` argument on the original command. This should look something like this:
```docker run --rm --platform linux/amd64 ghcr.io/georift/install-jellyfin-tizen <samsung tv ip> <build option> <tag url>```

- `install failed[118, -12], reason: Check certificate error : :Invalid certificate chain with certificate in signature.`

Recent TV models require the installation packages to be signed with a custom certificate for your specific TV.

See [official documentation](https://developer.samsung.com/smarttv/develop/getting-started/setting-up-sdk/creating-certificates.html) on creating your certificate and use the custom certificate arguments.

## Credits

This project is possible thanks to these projects:
Expand Down
23 changes: 20 additions & 3 deletions entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,17 @@ else
TAG=$(echo $TAG_URL | sed 's#.*/##');
fi

if [ -z "$4" ]; then
echo "Certificate information not provided, using default dev certificate."
else
if [ -f /certificates/author.p12 ] && [ -f /certificates/distributor.p12 ]; then
CERTIFICATE_PASSWORD=$4
else
echo "Certificate information provided but certificate files not found."
exit 1
fi
fi

DOWNLOAD_URL=$(echo https://github.com/jeppevinkel/jellyfin-tizen-builds/releases/download/${TAG}/${JELLYFIN_BUILD_OPTION}.wgt);

echo ""
Expand All @@ -48,9 +59,15 @@ if [ -z "$TV_NAME" ]; then
fi
echo "Found TV name: $TV_NAME"

echo "Attempting to install jellyfin-tizen-builds $JELLYFIN_BUILD_OPTION.wgt from release: $TAG"
echo "$DOWNLOAD_URL"
echo "Downloading jellyfin-tizen-builds $JELLYFIN_BUILD_OPTION.wgt from release: $TAG"
wget -q --show-progress "$DOWNLOAD_URL"; echo ""

wget -q --show-progress "$DOWNLOAD_URL"
if ! [ -z "$CERTIFICATE_PASSWORD" ]; then
echo "Attempting to sign package using provided certificate"
sed -i "s/_CERTIFICATEPASSWORD_/$CERTIFICATE_PASSWORD/" profile.xml
sed -i '/<\/profile>/ r profile.xml' /home/developer/tizen-studio-data/profile/profiles.xml
tizen package -t wgt -s custom -- $JELLYFIN_BUILD_OPTION.wgt

@mmaday mmaday Nov 9, 2024 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It'd be nice to verify the signing attempt worked. It doesn't look like tizen returns valid exit codes, but you can check the the last file modification times to see if's worked:

       package_mtime=$(stat -c %Y $JELLYFIN_BUILD_OPTION.wgt)
       tizen package -t wgt -s custom -- $JELLYFIN_BUILD_OPTION.wgt
       signed_package_mtime=$(stat -c %Y $JELLYFIN_BUILD_OPTION.wgt)
       [ $package_mtime -eq $signed_package_mtime ] && echo "Error signing package. Verify your certificate password is correct." && exit 1

@danielospina-b danielospina-b Dec 3, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like the idea, I'm unable to test it now so I think we can get this merged as is and you can send a PR with the change.

fi

echo "Attempting to install jellyfin-tizen-builds $JELLYFIN_BUILD_OPTION.wgt from release: $TAG"
tizen install -n $JELLYFIN_BUILD_OPTION.wgt -t "$TV_NAME"
Comment thread
danielospina-b marked this conversation as resolved.
5 changes: 5 additions & 0 deletions profile.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
<profile name="custom">
<profileitem ca="" distributor="0" key="/certificates/author.p12" password="_CERTIFICATEPASSWORD_" rootca=""/>
<profileitem ca="" distributor="1" key="/certificates/distributor.p12" password="_CERTIFICATEPASSWORD_" rootca=""/>
<profileitem ca="" distributor="2" key="" password="" rootca=""/>
</profile>