Added support for custom agent code signing cert and code signing fixes.
Ylian Saint-Hilaire committed
May 28, 2022 at 22:59 UTC
3e44d64c19ecf5e0fec9803e61113033fd1b4c93
2 files changed
+10
-7
authenticode.js
+5
-4
@@ -51,8 +51,8 @@ function createOutFile(args, filename) {
51
}
52
53
// Load certificates and private key from PEM files
54
-function loadCertificates(args) {
55
- var certs = [], keys = [], pemFileNames = args.pem;
54
+function loadCertificates(pemFileNames) {
55
+ var certs = [], keys = [];
56
if (pemFileNames == null) return;
57
if (typeof pemFileNames == 'string') { pemFileNames = [pemFileNames]; }
58
for (var i in pemFileNames) {
@@ -421,7 +421,7 @@ function start() {
421
if (command == 'sign') { // Sign an executable
422
if (typeof args.exe != 'string') { console.log("Missing --exe [filename]"); return; }
423
createOutFile(args, args.exe);
424
- const cert = loadCertificates(args);
424
+ const cert = loadCertificates(args.pem);
425
if (cert == null) { console.log("Unable to load certificate and/or private key, generating test certificate."); }
426
console.log("Signing to " + args.out); exe.sign(cert, args); console.log("Done.");
427
}
@@ -449,4 +449,5 @@ function start() {
449
if (require.main === module) { start(); }
450
451
// Exports
452
-module.exports.createAuthenticodeHandler = createAuthenticodeHandler;
\ No newline at end of file
452
+module.exports.createAuthenticodeHandler = createAuthenticodeHandler;
453
+module.exports.loadCertificates = loadCertificates;
\ No newline at end of file
meshcentral.js
+5
-3
@@ -2847,9 +2847,11 @@ function CreateMeshCentralServer(config, args) {
2847
var objx = domain, suffix = '';
2848
if (domain.id == '') { objx = obj; } else { suffix = '-' + domain.id; objx.meshAgentBinaries = {}; }
2849
2850
- // Get agent code signature certificate ready with the full cert chain
2851
- var agentSignCertInfo = null;
2852
- if (obj.certificates.codesign) {
2850
+ // Check if a custom agent signing certificate is available
2851
+ var agentSignCertInfo = require('./authenticode.js').loadCertificates([ obj.path.join(obj.datapath, 'agentsigningcert.pem') ]);
2852
+
2853
+ // If not using a custom signing cert, get agent code signature certificate ready with the full cert chain
2854
+ if ((agentSignCertInfo == null) && (obj.certificates.codesign != null)) {
2855
agentSignCertInfo = {
2856
cert: obj.certificateOperations.forge.pki.certificateFromPem(obj.certificates.codesign.cert),
2857
key: obj.certificateOperations.forge.pki.privateKeyFromPem(obj.certificates.codesign.key),