Skip to content

Extend driver signature verification to cover full package (.sys, .cat, .inf) - #1044

Merged
kostyanf14 merged 1 commit into
HCK-CI:masterfrom
jamepark4:enhance-driver-sign-verification
Jul 29, 2026
Merged

Extend driver signature verification to cover full package (.sys, .cat, .inf)#1044
kostyanf14 merged 1 commit into
HCK-CI:masterfrom
jamepark4:enhance-driver-sign-verification

Conversation

@jamepark4

@jamepark4 jamepark4 commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

With 2f277e0 landing tests have the capacity to install signtool to extend signature verification.

Previously only checked the .sys Authenticode signature. Now also verifies the .cat catalog signature and, when signtool is available via @signtool_path@, cross-checks .sys and .inf hashes against the catalog. Degrades gracefully when signtool is not configured. Test case json would need to provide expected path to the signtool e.g.:

  {
      "name": "driver_sign_check",
      "description": "Verify @driver_module@ driver package signature (.sys, .cat, .inf)",
      "test_system_ref": "VIRT-VSOCK-005",
      "timeout": 60,
      "test_steps": [
          {
              "desc": "Verify driver package signature",
              "guest_run_file": "lib/engines/functest/tests/scripts/verify_driver_signed.ps1",
              "expected_output_contains": "PASS:",
              "timeout": 30,
              "variables": {
                  "@signtool_path@": "@sw_path@\\Signtool_amd64_HLK.exe"
              }
          }
      ]
  }

@gemini-code-assist

gemini-code-assist Bot commented Jul 17, 2026

Copy link
Copy Markdown

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

@YanVugenfirer
YanVugenfirer requested a review from kostyanf14 July 18, 2026 19:13
@kostyanf14
kostyanf14 marked this pull request as ready for review July 20, 2026 08:32
Copilot AI review requested due to automatic review settings July 20, 2026 08:32
Copilot AI reviewed Jul 20, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR enhances the Functest driver signature verification script to validate the entire installed driver package, not just the .sys, and optionally performs stronger catalog membership checks when signtool is provided.

Changes:

  • Extends verification to check Authenticode signatures for both the driver .sys and the package .cat.
  • Adds optional signtool-based verification to ensure .sys and .inf hashes are present in the .cat catalog when @signtool_path@ is configured.
  • Implements graceful degradation when signtool is not provided or not found (still performs Authenticode checks and exits success with a warning).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread lib/engines/functest/tests/scripts/verify_driver_signed.ps1 Outdated
kostyanf14
kostyanf14 reviewed Jul 20, 2026
View reviewed changes
Comment thread lib/engines/functest/tests/scripts/verify_driver_signed.ps1 Outdated
Comment on lines +17 to +19
$sys = Get-ChildItem $drvDir -Filter "${module}.sys" | Select-Object -First 1
$cat = Get-ChildItem $drvDir -Filter '*.cat' | Select-Object -First 1
$inf = Get-ChildItem $drvDir -Filter "${module}.inf" | Select-Object -First 1

@kostyanf14 kostyanf14 Jul 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After installation, Windows will move driver.inf to oem<N>.inf. This check can work only with the driver binary folder, but not with installed drivers.

@YanVugenfirer Maybe create 2 tests:

  1. check installer driver (sys only)
  2. check provided binaries that were used for installation (sys, cat, inf)

kostyanf14
kostyanf14 reviewed Jul 20, 2026
View reviewed changes
Comment thread lib/engines/functest/tests/scripts/verify_driver_signed.ps1 Outdated
@YanVugenfirer

YanVugenfirer commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

@kostyanf14 I think we want two tests:

  1. Test the driver package before installation. This is the "static" test.
  2. Test installed package(s) with sigverif - this is the test from the OS perspective after installation. Important because we saw issue with all kind of corner scenarios of dual certificates or signatures for specific OSes.

@jamepark4
jamepark4 force-pushed the enhance-driver-sign-verification branch from da313b2 to c2f8ade Compare July 20, 2026 15:08
@jamepark4 @claude
Extend driver signature verification for pre-installation
d586b3a 
Created two new test cases:
 * driver_package_check: which now checks .sys, .cat, and .inf when doing
 signature authentication
 * driver_signtool_check: which leverages extra-software to run signtool
 verification on the driver.

Both are designed to run as a pre-installation check.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: jamepark4 <jparker@redhat.com>
@jamepark4
jamepark4 force-pushed the enhance-driver-sign-verification branch from c2f8ade to d586b3a Compare July 24, 2026 16:25
@jamepark4

jamepark4 commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

@kostyanf14 I think we want two tests:

1. Test the driver package before installation. This is the "static" test.

2. Test installed package(s) with sigverif - this is the test from the OS perspective after installation. Important because we saw issue with all kind of corner scenarios of dual certificates or signatures for specific OSes.

Thanks @kostyanf14 and @YanVugenfirer based on your feedback I removed any changes to the post installation signature check and create two new pre-install checks. One that does analysis on .sys, .inf, and .cat and one that would leverage signtool if it is supplied to the test suite. I wanted to create two pre-install checks just to allow for better granularity of control and debuggability if there were any issues surrounding using the signtool.

@kostyanf14
kostyanf14 merged commit 4947cb9 into HCK-CI:master Jul 29, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@YanVugenfirer YanVugenfirer YanVugenfirer approved these changes
@kostyanf14 kostyanf14 kostyanf14 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@jamepark4 @YanVugenfirer @kostyanf14