Windows Driver Signing

[Aryan-sharma11]

🛡️ Windows Driver Signing

Prerequisites & Organization Setup

• Request official Minifilter Altitude from Microsoft
• Obtain a Code Signing solution compatible with CI
  • Prefer a cloud/HSM-backed signing solution for CI
• Register with Windows Hardware Dev Center (WHDC)
  • Requires the EV cert above
  • Need to create Org account (Kubearmor account in our case)

---

Build Infrastructure (In process)

• SHA-256 digest algorithm configured (<FileDigestAlgorithm>sha256</FileDigestAlgorithm> in all build configs)
• /integritycheck linker flag set on x64 configs
• CatalogFile = kubearmor.cat declared in kubearmor.inf
• PnpLockdown = 1 set in kubearmor.inf
• DriverTargetPlatform = Universal in all build configs
• CI pipeline builds driver (.sys + .inf), service binary (.exe), and MSI installer
• CI uploads Windows assets (.zip, .msi, sha256sums-windows.txt) to GitHub release

---

Code Signing (dev/pre-release)

Driver loads on machines with Secure Boot OFF

• Add kubearmor.ddf for makecab packaging
• Add inf2cat step to generate kubearmor.cat
  • Targets: 10_X64, Server10_X64
• Sign kubearmor.sys with SHA-256 + RFC 3161 timestamp
• Sign kubearmor.cat
• Sign user-mode artifacts with Authenticode
  • kubearmor.exe
  • kubearmor_<version>_Windows_x86_64.msi
• Add WINDOWS_CERT_PFX and WINDOWS_CERT_PASS as CI secrets
• Document test-mode verification
  • bcdedit /set testsigning on
  • Import test certificate into Root and TrustedPublisher

---

Production Release Signing

Driver loads on default Windows 10/11 with Secure Boot ON

• First manual submission via WHDC portal
  • Package driver (.sys, .inf, .cat) into signed .cab
• Pack WHDC-signed driver into the final WiX MSI

---

Testing and Verification

Required for Windows Server support and full WHQL certification via the Hardware Lab Kit (HLK).

• Set up Windows HLK (Hardware Lab Kit) test environment
• Run Filter Driver HLK test suite against kubearmor.sys
• Submit HLK package to WHDC for full WHQL certification
• Validate on Windows Server 2019, 2022, 2025