Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Possibly unused floppy/oracle-cert.cer for VirtualBox has expired on 3/2019 #222

Closed
arizvisa opened this issue Jan 18, 2020 · 1 comment
Closed

Possibly unused floppy/oracle-cert.cer for VirtualBox has expired on 3/2019 #222

arizvisa opened this issue Jan 18, 2020 · 1 comment
Assignees
@arizvisa
Labels
enhancement This will introduce or improve an already existing capability

Comments

@arizvisa
Copy link
Contributor

arizvisa commented Jan 18, 2020 •
edited
Loading

It seems like the oracle certificate that we bundle in floppy/oracle-cert.cer has expired in march of last year. This was introduced by commit 384b4fa back in 2017.

It appears to be used for VirtualBox guest additions as it has the code-signing attribute set. But just for the sake of comprehensiveness, let's verify...

  1. This certificate doesn't appear to be used by script/vmtool.bat as that script looks for Oracle's certificate in the vbox guest additions iso and then installs that one. The name that it looks for is vbox*.cer under the %VBOX_SETUP_DIR%/cert directory. This path is determined by searching for VBoxWindowsAdditions-$arch.exe and using the directory that contains it.

  2. We've also been downloading everything over http and the cert is missing a common name, so we can't use it here either.

I vote removing this as commit 0e22a26 supersedes its necessity.
@arizvisa arizvisa added the enhancement This will introduce or improve an already existing capability label Jan 18, 2020
@arizvisa arizvisa mentioned this issue Jan 18, 2020
Merged
@arizvisa arizvisa changed the title Possibly unused floppy/oracle-cert.cer for VirtualBox has expired on 5/2019 Possibly unused floppy/oracle-cert.cer for VirtualBox has expired on 3/2019 Jan 18, 2020
@arizvisa arizvisa self-assigned this Jan 18, 2020
This was referenced Jan 18, 2020
Closed
Closed
arizvisa added a commit that referenced this issue Jan 18, 2020
@arizvisa
Merge pull request #223 from arizvisa/GH-222
c3cfa6a 
Clean up unused files (floppy/oracle-cert.cer) leftover from merging PR #91 

PR #91 actually supersedes the usage of floppy/oracle-cert.cer when installing VirtualBox and so this code-signing certificate (which expired in 2019/03 anyways) is not in use anymore.
This was referenced Jan 18, 2020
Merged
Merged
@arizvisa
Copy link
Contributor Author

This was fixed by PR #223.

@arizvisa arizvisa mentioned this issue Jan 18, 2020
Open
daxgames pushed a commit to daxgames/boxcutter_windows that referenced this issue Feb 26, 2020
@arizvisa
Merge pull request boxcutter#223 from arizvisa/boxcutterGH-222
1194fc2 
Clean up unused files (floppy/oracle-cert.cer) leftover from merging PR boxcutter#91 

PR boxcutter#91 actually supersedes the usage of floppy/oracle-cert.cer when installing VirtualBox and so this code-signing certificate (which expired in 2019/03 anyways) is not in use anymore.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@arizvisa arizvisa

Labels
enhancement This will introduce or improve an already existing capability
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@arizvisa