starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-10-18 16:03:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ssh): pin portable fixture signer identities

Browse Source 
Co-authored-by: Orca <help@stably.ai>
This commit is contained in:
Jinwoo-H
2026-07-16 18:44:12 -04:00
co-authored by Orca
parent 85731b3fef
commit 130d57d951
5 changed files with 182 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ssh-relay-runtime-artifacts.yml
+33 -5
View File
@@ -1395,19 +1395,47 @@ jobs:
if ($libcryptoSha256 -ne $expectedLibcryptoSha256) {
throw "Official Windows OpenSSH libcrypto.dll hash mismatch: $libcryptoSha256"
}
# Why: Microsoft's immutable bundle preserves one unsigned upstream OpenSSL library.
# Why: the pinned fixture uses a distinct Microsoft-managed leaf for its upstream library.
$expectedLibcryptoSignerThumbprint = '587116075365AA15BCD8E4FA9CB31BE372B5DE51'
$libcryptoSignature = Get-AuthenticodeSignature -LiteralPath $libcrypto.FullName
if ($libcryptoSignature.Status -ne 'NotSigned') {
throw "Official Windows OpenSSH libcrypto.dll signature changed: $($libcryptoSignature.Status)"
$libcryptoCertificate = $libcryptoSignature.SignerCertificate
$libcryptoThumbprint = if ($null -eq $libcryptoCertificate) {
'<none>'
} else {
$libcryptoCertificate.Thumbprint.ToUpperInvariant()
}
$libcryptoSubject = if ($null -eq $libcryptoCertificate) {
'<none>'
} else {
$libcryptoCertificate.Subject
}
if (
$libcryptoSignature.Status -ne 'Valid' -or
$libcryptoThumbprint -ne $expectedLibcryptoSignerThumbprint -or
$libcryptoSubject -notmatch '(^|,\s*)CN=Microsoft 3rd Party Application Component(,|$)'
) {
throw "Official Windows OpenSSH libcrypto.dll signature identity is invalid: $($libcryptoSignature.Status), $libcryptoThumbprint, $libcryptoSubject"
}
$expectedExecutableSignerThumbprints = @(
'F5877012FBD62FABCBDC8D8CEE9C9585BA30DF79',
'3F56A45111684D454E231CFDC4DA5C8D370F9816'
)
foreach ($nativeFile in $nativeFiles) {
if ($nativeFile.Name -eq 'libcrypto.dll') { continue }
$signature = Get-AuthenticodeSignature -LiteralPath $nativeFile.FullName
$certificate = $signature.SignerCertificate
$thumbprint = if ($null -eq $certificate) {
'<none>'
} else {
$certificate.Thumbprint.ToUpperInvariant()
}
$subject = if ($null -eq $certificate) { '<none>' } else { $certificate.Subject }
if (
$signature.Status -ne 'Valid' -or
$signature.SignerCertificate.Subject -notmatch 'CN=Microsoft Corporation'
$expectedExecutableSignerThumbprints -notcontains $thumbprint -or
$subject -notmatch '(^|,\s*)CN=Microsoft Corporation(,|$)'
) {
throw "Official Windows OpenSSH fixture signature is invalid: $($nativeFile.Name)"
throw "Official Windows OpenSSH fixture signature identity is invalid: $($nativeFile.Name), $($signature.Status), $thumbprint, $subject"
}
}
$sshd = Join-Path $openSshRoot 'sshd.exe'