FreeDV
/
freedv-gui
mirror of https://github.com/drowe67/freedv-gui.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Enable use of remote USB token for signing automated Windows builds. (#1312) 

* Temporarily disable all but Windows CI builds for testing.

* Add logic to Windows CI build to sign with remote USB token.

* Temporarily disable ARM build to reduce runtime.

* Fix syntax errors.

* Fix another syntax error.

* Add forgotten pipe symbol.

* Fix SSH tunnel specification.

* Use full path to SSH key.

* Add separate SSH_USER secret for configuring SSH username.

* Need to create .ssh folder.

* Need to specify port for ssh-keyscan.

* chmod 600 private key.

* Need to pass -N to ssh to keep tunnel up.

* Create SSH tunnel just prior to building.

* Explicitly specify localhost for port forward hostname.

* Keep SSH connection alive.

* Ran into known segfault issue on 24.04.

* Update pkg-config.

* Kill SSH after completion of build.

* Revert "Temporarily disable ARM build to reduce runtime."

This reverts commit db1cee1ce9.

* Add macOS/Linux and GH Action info to documentation.

* Revert "Temporarily disable all but Windows CI builds for testing."

This reverts commit 4b76d359f3.

* Add additional information to documentation about remote USB keys.

* Add code signing documentation link to README.

* Add PR #1312 to changelog.

* Add support for signing with a second certificate.

* Fix typos.

* Ensure installer components get secondary signed too.

* Fix spurious codec2-related signing error.
ms-ubuntu-build-workaround
Mooneer Salem 2026-04-30 07:28:53 -07:00 committed by GitHub
parent 60fafff9bc
commit 97c464b7fc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
7 changed files with 219 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

87
.github/workflows/cmake-windows.yml vendored
View File

@ -27,7 +27,11 @@ jobs:
matrix:
arch: [x86_64, aarch64]
runs-on: ubuntu-24.04
runs-on: ubuntu-22.04
env:
PKCS11_PROXY_SOCKET: tcp://127.0.0.1:2222
FREEDV_WINDOWS_CODE_SIGNING_SSH_KEY: ${{ secrets.FREEDV_WINDOWS_CODE_SIGNING_SSH_KEY }}
steps:
- uses: actions/checkout@v6
@ -35,7 +39,9 @@ jobs:
- name: Install required packages
shell: bash
working-directory: ${{github.workspace}}
run: sudo apt-get install nsis autoconf automake libtool libltdl-dev
run: |
sudo apt-get update
sudo apt-get install nsis autoconf automake libtool libltdl-dev pkg-config
- name: Download MinGW LLVM
shell: bash
@ -44,23 +50,90 @@ jobs:
wget https://github.com/mstorsjo/llvm-mingw/releases/download/20251216/llvm-mingw-20251216-ucrt-ubuntu-22.04-x86_64.tar.xz
tar xvf llvm-mingw-20251216-ucrt-ubuntu-22.04-x86_64.tar.xz
- name: Configure freedv-gui
shell: bash
- name: Configure code signing tunnel
if: ${{ env.FREEDV_WINDOWS_CODE_SIGNING_SSH_KEY != '' }}
working-directory: ${{github.workspace}}
env:
FREEDV_WINDOWS_CODE_SIGNING_SSH_KEY: ${{ secrets.FREEDV_WINDOWS_CODE_SIGNING_SSH_KEY }}
run: |
cat <<EOF >code-sign.sshkey
${{ env.FREEDV_WINDOWS_CODE_SIGNING_SSH_KEY }}
EOF
chmod 600 code-sign.sshkey
mkdir -p ~/.ssh
ssh-keyscan -p ${{ secrets.FREEDV_WINDOWS_CODE_SIGNING_SSH_PORT}} ${{ secrets.FREEDV_WINDOWS_CODE_SIGNING_SSH_HOST}} >> ~/.ssh/known_hosts
- name: Configure code signing keys
if: ${{ env.FREEDV_WINDOWS_CODE_SIGNING_SSH_KEY != '' }}
working-directory: ${{github.workspace}}
env:
FREEDV_WINDOWS_CODE_SIGNING_INTERMEDIATE_CERTS: ${{ secrets.FREEDV_WINDOWS_CODE_SIGNING_INTERMEDIATE_CERTS }}
run: |
echo -n "${{secrets.FREEDV_WINDOWS_CODE_SIGNING_CERT}}" >freedv.cert
echo -n "${{secrets.FREEDV_WINDOWS_CODE_SIGNING_KEY}}" >freedv.key
echo -n "${{secrets.FREEDV_WINDOWS_SECONDARY_CODE_SIGNING_CERT}}" >freedv-secondary.cert
echo -n "${{secrets.FREEDV_WINDOWS_SECONDARY_CODE_SIGNING_KEY}}" >freedv-secondary.key
cat <<EOF >freedv.intermediatecerts
${{ env.FREEDV_WINDOWS_CODE_SIGNING_INTERMEDIATE_CERTS }}
EOF
- name: Configure code signing packages
if: ${{ env.FREEDV_WINDOWS_CODE_SIGNING_SSH_KEY != '' }}
working-directory: ${{github.workspace}}
run: |
sudo apt-get install pcsc-tools pcscd libfuse2 opensc opensc-pkcs11 libengine-pkcs11-openssl gnutls-bin
git clone https://github.com/mtrojnar/osslsigncode.git
cd osslsigncode
mkdir build
cd build
cmake ..
make -j$(nproc)
cd ${{github.workspace}}
git clone https://github.com/iksaif/pkcs11-proxy.git
cd pkcs11-proxy
mkdir build
cd build
cmake ..
make -j$(nproc)
- name: Configure freedv-gui (unsigned)
shell: bash
if: ${{ env.FREEDV_WINDOWS_CODE_SIGNING_SSH_KEY == '' }}
working-directory: ${{github.workspace}}
run: |
export WINEPREFIX=`pwd`/wine-env
export PATH=${{github.workspace}}/llvm-mingw-20251216-ucrt-ubuntu-22.04-x86_64/bin:$PATH
mkdir build_windows
cd build_windows
cmake -DENABLE_LTO=1 -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_TOOLCHAIN_FILE=${{github.workspace}}/cross-compile/freedv-mingw-llvm-${{ matrix.arch }}.cmake ..
- name: Build freedv-gui
- name: Configure freedv-gui (signed)
if: ${{ env.FREEDV_WINDOWS_CODE_SIGNING_SSH_KEY != '' }}
shell: bash
working-directory: ${{github.workspace}}
run: |
export PATH=${{github.workspace}}/llvm-mingw-20251216-ucrt-ubuntu-22.04-x86_64/bin:${{github.workspace}}/osslsigncode/build:$PATH
mkdir build_windows
cd build_windows
cmake -DENABLE_LTO=1 -DCMAKE_BUILD_TYPE=RelWithDebInfo -DSIGN_WINDOWS_BINARIES=1 -DPKCS11_MODULE=${{github.workspace}}/pkcs11-proxy/build/libpkcs11-proxy.so -DPKCS11_CERTIFICATE_FILE=${{github.workspace}}/freedv.cert -DPKCS11_KEY_FILE=${{github.workspace}}/freedv.key -DPKCS11_SECONDARY_CERTIFICATE_FILE=${{github.workspace}}/freedv-secondary.cert -DPKCS11_SECONDARY_KEY_FILE=${{github.workspace}}/freedv-secondary.key -DINTERMEDIATE_CERT_FILE=${{github.workspace}}/freedv.intermediatecerts -DCMAKE_TOOLCHAIN_FILE=${{github.workspace}}/cross-compile/freedv-mingw-llvm-${{ matrix.arch }}.cmake ..
- name: Build freedv-gui (unsigned)
if: ${{ env.FREEDV_WINDOWS_CODE_SIGNING_SSH_KEY == '' }}
shell: bash
working-directory: ${{github.workspace}}/build_windows
run: |
export PATH=${{github.workspace}}/llvm-mingw-20251216-ucrt-ubuntu-22.04-x86_64/bin:$PATH
export PATH=${{github.workspace}}/llvm-mingw-20251216-ucrt-ubuntu-22.04-x86_64/bin:${{github.workspace}}/osslsigncode/build:$PATH
make -j$(nproc) package
- name: Build freedv-gui (signed)
if: ${{ env.FREEDV_WINDOWS_CODE_SIGNING_SSH_KEY != '' }}
shell: bash
working-directory: ${{github.workspace}}/build_windows
run: |
export PATH=${{github.workspace}}/llvm-mingw-20251216-ucrt-ubuntu-22.04-x86_64/bin:${{github.workspace}}/osslsigncode/build:$PATH
ssh -fN -o "ServerAliveInterval 60" -p ${{ secrets.FREEDV_WINDOWS_CODE_SIGNING_SSH_PORT }} -i ${{github.workspace}}/code-sign.sshkey -L localhost:2222:127.0.0.1:2222 ${{ secrets.FREEDV_WINDOWS_CODE_SIGNING_SSH_USER }}@${{ secrets.FREEDV_WINDOWS_CODE_SIGNING_SSH_HOST }}
make -j$(nproc) package
killall ssh
- name: Calculate installer filename
shell: bash
id: installer-filename

15
CMakeLists.txt
View File

@ -250,6 +250,17 @@ if(SIGN_WINDOWS_BINARIES)
file(READ ${PKCS11_CERTIFICATE_FILE} PKCS11_CERTIFICATE_TMP)
string(REPLACE "\n" "" PKCS11_KEY "${PKCS11_KEY_TMP}")
string(REPLACE "\n" "" PKCS11_CERTIFICATE "${PKCS11_CERTIFICATE_TMP}")
if (DEFINED PKCS11_SECONDARY_KEY_FILE)
file(READ ${PKCS11_SECONDARY_KEY_FILE} PKCS11_SECONDARY_KEY_TMP)
string(REPLACE "\n" "" PKCS11_SECONDARY_KEY "${PKCS11_SECONDARY_KEY_TMP}")
endif (DEFINED PKCS11_SECONDARY_KEY_FILE)
if (DEFINED PKCS11_SECONDARY_CERTIFICATE_FILE)
file(READ ${PKCS11_SECONDARY_CERTIFICATE_FILE} PKCS11_SECONDARY_CERTIFICATE_TMP)
string(REPLACE "\n" "" PKCS11_SECONDARY_CERTIFICATE "${PKCS11_SECONDARY_CERTIFICATE_TMP}")
endif (DEFINED PKCS11_SECONDARY_CERTIFICATE_FILE)
endif(SIGN_WINDOWS_BINARIES)
if(USE_STATIC_DEPS)
@ -738,6 +749,10 @@ VIAddVersionKey \\\"GitHash\\\" \\\"${GIT_HASH}\\\"
# Add finalize command for NSIS so the installer/uninstaller can be
# signed too.
set(CPACK_NSIS_FINALIZE_CMD "mv %1 %1.tmp; ${OSSLSIGNCODE_BIN} sign -pkcs11engine ${PKCS11_ENGINE} -pkcs11module ${PKCS11_MODULE} -pkcs11cert \\\"${PKCS11_CERTIFICATE}\\\" -key \\\"${PKCS11_KEY}\\\" -h ${SIGN_HASH} -comm -ts ${TIMESTAMP_SERVER} -ac ${INTERMEDIATE_CERT_FILE} -n \\\"FreeDV - ${PROJECT_DESCRIPTION}\\\" -i \\\"https://freedv.org/\\\" -in %1.tmp -out %1")
if (PKCS11_SECONDARY_CERTIFICATE)
set(CPACK_NSIS_FINALIZE_CMD "${CPACK_NSIS_FINALIZE_CMD}; mv %1 %1.tmp; ${OSSLSIGNCODE_BIN} sign -nest -pkcs11engine ${PKCS11_ENGINE} -pkcs11module ${PKCS11_MODULE} -pkcs11cert \\\"${PKCS11_SECONDARY_CERTIFICATE}\\\" -key \\\"${PKCS11_SECONDARY_KEY}\\\" -h ${SIGN_HASH} -comm -ts ${TIMESTAMP_SERVER} -ac ${INTERMEDIATE_CERT_FILE} -n \\\"FreeDV - ${PROJECT_DESCRIPTION}\\\" -i \\\"https://freedv.org/\\\" -in %1.tmp -out %1")
endif (PKCS11_SECONDARY_CERTIFICATE)
message(STATUS "Windows installer finalize command: ${CPACK_NSIS_FINALIZE_CMD}")
endif(SIGN_WINDOWS_BINARIES)
include(CPack)

107
CODE_SIGNING.md
View File

@ -1,7 +1,13 @@
# Code Signing Certificate HOWTO
# Code Signing HOWTO
## Introduction
Code signing is a process by where a signature is embedded into an application's executable file. This signature can be validated by supported operating systems to ensure that the file is from a known source and hasn't been tampered with, and in fact is required for applications to run at all on some platforms (for example, macOS). This document contains information on how code signing works in the FreeDV project.
## Windows Code Signing
### Introduction
Windows has a built-in anti-virus/anti-malware mechanism called Windows Defender. As part of the protection the operating system provides,
it checks any .exe, .dll or installer files that are downloaded from the internet for a valid certificate. If one does not exist, Windows
displays a SmartScreen validation error message that requires additional steps from the user in order to bypass and continue installation.
@ -11,7 +17,7 @@ is infected with a virus.
To improve the FreeDV user experience, it was determined that the project should purchase a code signing certificate and begin signing
official releases.
## Prerequisites:
### Prerequisites:
* Pending EV code signing certificate order with [SignMyCode.com](https://signmycode.com) or another Sectigo reseller.
* NOTE: this costs a fair bit of money, so it's more cost effective to purchase 3 year validity instead of 1.
@ -20,7 +26,7 @@ official releases.
* Linux machine (Windows packages are currently generated using LLVM MinGW)
* Required packages: pcscd, pcsc-tools, libfuse2*, osslsigncode, opensc, opensc-pkcs11, libengine-pkcs11-openssl, gnutls-bin
## Installing SafeNet Authentication Client on Linux
### Installing SafeNet Authentication Client on Linux
Download SafeNet Authentication Client from [here](https://comodoca.my.salesforce.com/sfc/p/1N000002Ljih/a/3l000000GBKA/jByoGtRgjuh1HrkxbtiH5QE2asIHbqCTQJcCLBqd8.o) and install the Ubuntu package as follows:
@ -30,7 +36,7 @@ $ cd "SAC_10_8_R1 GA/Installation/Standard/Ubuntu-2204"
$ sudo dpkg -i safenetauthenticationclient_10.8.1050_amd64.deb
```
## Locating signing key and certificate on token
### Locating signing key and certificate on token
At the terminal, enter `p11tool --list-all --provider /usr/lib/libeToken.so`. Look for something
like the following:
@ -51,7 +57,7 @@ echo -n "pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=CB64B873EE27EF
echo -n "pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=CB64B873EE27EF1B;token=Software%20Freedom%20Conservancy%2C%20In;id=%87%7F%E9%6E%9E%86%84%43;object=Sectigo_20230908155653;type=cert" > ~/cert.url
```
## Signing binaries manually
### Signing binaries manually
Use something like the following command:
@ -68,7 +74,7 @@ Notes:
* The file specified by `-out` must not already exist. Otherwise, osslsigncode will error out.
* libeToken.so *must* be specified for osslsigncode. Other PKCS11 modules may work but haven't been tested.
## Signing using CMake
### Signing using CMake
To build a signed Windows version of FreeDV, pass in `-DSIGN_WINDOWS_BINARIES=1` as well as files containing the intermediare/root certificates, PKCS#11 key and certificate URLs. For example:
@ -80,6 +86,8 @@ $ make
$ make package
```
Additionally you can optionally provide `PKCS11_SECONDARY_KEY_FILE` and `PKCS11_SECONDARY_CERTIFICATE_FILE` to CMake to sign Windows binaries with a second certificate. For example, this would be done to help confer reputation on a new certificate using the reputation of an older certificate.
Other optional variables that can be set are as follows:
* `PKCS11_ENGINE` / `PKCS11_MODULE`: Paths to the PKCS11 engine and module libraries on your system. This is mainly used for those who aren't compiling on amd64 and/or aren't using a SafeNet token.
@ -90,9 +98,9 @@ You will be prompted for your token's PIN several times during the build process
*NOTE: The PIN prompts can be auto-filled by appending `?pin-value=xxxxxx` to the key's URL (where `xxxxxx` is your token's PIN). The best practice is to exclude the `?pin-value=xxxxxx` and manually enter the PIN each time, however.*
## Auto-building signed binaries for all supported architectures
### Auto-building signed binaries for all supported architectures
You can auto-build installers for all supported architectures (x86_64, i686, armv7, aarch64)
You can auto-build installers for all supported architectures (x86_64, aarch64)
by using the `build_signed_windows_release.sh` script as follows:
```
@ -104,13 +112,28 @@ when complete. This may take quite a while (for example, ~1 hour on a 2019 MacBo
*NOTE: Ensure that LLVM MinGW and osslsigncode are in your PATH before executing the above command.*
## Troubleshooting:
### Using a remotely hosted USB key
### I'm running a VMWare VM and the system doesn't detect my token
It is possible to connect to a remote server containing a USB token. This requires installing [pkcs11-proxy](https://github.com/iksaif/pkcs11-proxy) on both machines and setting needed environment on the build machine:
```
# On server with USB token, install SafeNet and all other needed packages and then run:
$ PKCS11_DAEMON_SOCKET="tcp://127.0.0.1:2345" pkcs11-daemon /usr/lib/libeToken.so
# On build machine
$ ssh -Nf -o "ServerAliveInterval 60" -L 2345:127.0.0.1:2345 username@server-name
$ mkdir build
$ cmake -DENABLE_LTO=1 -DCMAKE_BUILD_TYPE=RelWithDebInfo -DSIGN_WINDOWS_BINARIES=1 -DPKCS11_MODULE=/usr/lib/libpkcs11-proxy.so -DPKCS11_CERTIFICATE_FILE=~/cert.url -DPKCS11_KEY_FILE=~/key.url -DINTERMEDIATE_CERT_FILE=~/cacerts.crt -DCMAKE_TOOLCHAIN_FILE=/home/mooneer/freedv-gui/cross-compile/freedv-mingw-llvm-x86_64.cmake ..
$ PKCS11_PROXY_SOCKET="tcp://127.0.0.1:2345" make -j$(nproc) package
```
### Troubleshooting:
#### I'm running a VMWare VM and the system doesn't detect my token
Follow the instructions [here](https://support.yubico.com/hc/en-us/articles/360013647640-Troubleshooting-Device-Passthrough-with-VMware-Workstation-and-VMware-Fusion) to update your VM's .vmx file to allow the VM to take full control. This is a problem at least on macOS hosts, not sure on other platforms.
### "PC/SC not available. Smart card (CCID) protocols will not function." message on console
#### "PC/SC not available. Smart card (CCID) protocols will not function." message on console
Ensure that pcscd is running and enabled in systemctl:
@ -123,12 +146,12 @@ Created symlink /etc/systemd/system/sockets.target.wants/pcscd.socket → /lib/s
$
```
### File appears to sign successfully but fails to verify
#### File appears to sign successfully but fails to verify
This is likely due to a problem with the certificate. Open a technical support case with your certificate
provider as they may need to reissue.
### Windows Defender SmartScreen popups appear despite use of EV certificate
#### Windows Defender SmartScreen popups appear despite use of EV certificate
Some things to check:
@ -137,9 +160,65 @@ Some things to check:
3. OV certificates may need a couple of days at minimum to be accepted by Microsoft. It may be possible to accelerate this by sending the signed file to Microsoft for analysis.
4. Problems that will definitely require a re-issue:
* [ECDSA keys do not work well](https://vcsjones.dev/authenticode-and-ecc/) for code signing. Yes, this is still a problem in 2023 despite the date of the blog post. If you use your certificate vendor's token instead of your own, this isn't likely to be the problem but still worth noting here in case you're tempted to buy a YubiKey FIPS token (which supposedly works but never fully removed SmartScreen popups for the FreeDV project).
* If you're still tempted to bring your own token, note that the [CA Forum mandates a minimum RSA key length of 3072 bits](https://knowledge.digicert.com/alerts/code-signing-new-minimum-rsa-keysize.html). Anything shorter than that will definitely cause problems.
* If you're still tempted to bring your own token, note that the [CA Forum mandates a minimum RSA key length of 3072 bits](https://knowledge.digicert.com/alerts/code-signing-new-minimum-rsa-keysize.html). Anything shorter than that will definitely cause problems. (4096 bit RSA appears to be the current standard for code signing certificates as of 2026.)
Additionally, as of 2024, [Microsoft has changed how SmartScreen works](https://learn.microsoft.com/en-us/windows/apps/package-and-deploy/smartscreen-reputation). For the purposes of avoiding the SmartScreen popup, there is effectively no longer any difference between EV and OV certificates. This means that it may take some downloads after issuance of a new certificate before it becomes trusted by Microsoft. Signing with a second certificate (one that already has had use) may confer reputation on any newly-issued certificates and reduce the time required to trust those certificates.
## macOS Notarization
macOS notarization is effectively required by Apple in order to execute applications on that platform. This is done using the `notarytool` application. The current CMake scripts will automatically run this tool during the build process (replace everything in square brackets as appropriate):
```
$ xcrun notarytool store-credentials --apple-id "[Apple account username]" --password "[Apple password]" --team-id "[team ID]" [profile name] # Execute this once to save a profile to pass to builds
$ BUILD_TYPE=Release UT_ENABLE=0 UNIV_BUILD=1 BUILD_DEPS=1 CODESIGN_IDENTITY=[team ID] CODESIGN_KEYCHAIN_PROFILE=[profile name] ./build_osx.sh
```
Note that the above requires a macOS system to build (i.e. cross-compiling is not supported).
## Linux AppImage signing
For signing Linux AppImages, simply generate a private/public key pair in GPG and execute the following prior to generating the AppImage:
```
$ export LDAI_SIGN=1
$ export LDAI_SIGN_KEY="[GPG key ID]"
$ ./make-appimage.sh
```
Be sure to make backups of your public and private keys as it's impossible to regenerate one from the other if lost.
## Signing from GitHub Actions
The current GitHub Actions scripts for FreeDV support automated code signing and notarization of binaries on each push to the repository. To enable this, GitHub secrets need to be configured for each platform that requires code signing:
| Secret Name | Description | Required for Platform |
|---|---|---|
| `FREEDV_LINUX_CODE_SIGNING_KEY` | PEM encoded text containing the private key to use for signing Linux AppImages. | Linux |
| `FREEDV_LINUX_CODE_SIGNING_KEY_ID` | GPG key ID for the key provided by `FREEDV_LINUX_CODE_SIGNING_KEY`. | Linux |
| `FREEDV_LINUX_CODE_SIGNING_PUBLIC_KEY` | PEM encoded text containing the public key to use for signing Linux AppImages. | Linux |
| `FREEDV_MACOS_CODE_SIGNING_CERTIFICATE` | Apple Distribution certificate for the Apple account to use for notarization in PEM format. | macOS |
| `FREEDV_MACOS_CODE_SIGNING_PASSWORD` | Password to the Apple developer account being used for notarization. | macOS |
| `FREEDV_MACOS_CODE_SIGNING_USERNAME` | Username for the Apple developer account being used for notarization. | macOS |
| `FREEDV_WINDOWS_CODE_SIGNING_CERT` | PKCS11 URL for the certificate to use on the USB token. | Windows |
| `FREEDV_WINDOWS_CODE_SIGNING_INTERMEDIATE_CERTS` | PEM encoded text containing the intermediate certificates to embed into the signature. | Windows |
| `FREEDV_WINDOWS_CODE_SIGNING_KEY` | PKCS11 URL for the public/private key to use on the USB token. | Windows |
| `FREEDV_WINDOWS_CODE_SIGNING_SSH_HOST` | Hostname to connect to for the required SSH tunnel to the server with the USB token attached. | Windows |
| `FREEDV_WINDOWS_CODE_SIGNING_SSH_KEY` | Private key to use for connecting to `FREEDV_WINDOWS_CODE_SIGNING_SSH_HOST`. | Windows |
| `FREEDV_WINDOWS_CODE_SIGNING_SSH_PORT` | Port to use for connecting to the server with the USB token (i.e. 22 if the server is directly on the internet). | Windows |
| `FREEDV_WINDOWS_CODE_SIGNING_SSH_USER` | Username to use for connecting the required SSH tunnel to the server with the USB token attached. | Windows |
| `FREEDV_WINDOWS_CODE_SIGNING_SECONDARY_CERT` | PKCS11 URL for the secondary certificate to use on the USB token. | Windows* |
| `FREEDV_WINDOWS_CODE_SIGNING_SECONDARY_KEY` | PKCS11 URL for the public/private key to use on the USB token. | Windows* |
Additionally, for macOS, the team ID must be specified by adding a variable named `FREEDV_MACOS_CODE_SIGNING_TEAM_ID` with the appropriate value.
GitHub secrets are added by going to the repository's settings and clicking on "Actions" under "Secrets and variables". Note that for each platform you want to support signing or notarization for, all secrets for that platform must be provided (for example, `FREEDV_MACOS_CODE_SIGNING_CERTIFICATE`, `FREEDV_MACOS_CODE_SIGNING_USERNAME` and `FREEDV_MACOS_CODE_SIGNING_PASSWORD` must all be provided to notarize generatred macOS binaries). The exception is for items that have an asterisk (namely the secondary certificate for Windows).
Currently automated code signing is not done on the main GitHub repository but on a fork of it owned by one of the PLT members. Builds off of `master` in that fork are then added to GitHub releases in the main repo. In the future, automated code signing may be done on the main repo instead.
## Sources
* [Yubico GitHub issue referring to osslsigncode](https://github.com/Yubico/yubico-piv-tool/issues/21)
* [StackOverflow post on configuring CMake for code signing](https://stackoverflow.com/questions/72504366/how-to-sign-windows-binaries-and-nsis-installers-when-building-with-cmake-cpac)
* [linuxdeploy-plugin-appiamge repo containing AppImage code signing info](https://github.com/linuxdeploy/linuxdeploy-plugin-appimage)
* [Notarizing macOS software before distribution](https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution)
* [Customizing the notarization workflow](https://developer.apple.com/documentation/security/customizing-the-notarization-workflow?language=objc)

1
README.md
View File

@ -7,6 +7,7 @@ This document describes how to build the FreeDV GUI program for various operatin
* http://freedv.org - introduction, documentation, downloads
* [FreeDV GUI User Manual](USER_MANUAL.md)
* Information on third party code included in FreeDV [here](./src/3rdparty/README.md)
* [Code signing information for FreeDV](./CODE_SIGNING.md)
## Installing prerequisites on Ubuntu Linux

3
USER_MANUAL.md
View File

@ -911,7 +911,7 @@ LDPC | Low Density Parity Check Codes - a family of powerful FEC codes
# Release Notes
## V2.3.0 TBD 2026
## V2.3.0 May 2026
1. Bugfixes:
* Linux: fix semaphore wakeup timing to reduce audio dropouts. (PR #1220)
@ -959,6 +959,7 @@ LDPC | Low Density Parity Check Codes - a family of powerful FEC codes
* Update wxWidgets to 3.3.2. (PR #1244)
* Flex: Update Docker container version to match AppImage version. (PR #1256)
* Reenable Windows on ARM builds previously disabled in 2.0.0. (PR #1297, #1300)
* Add automated code signing support for Windows builds. (PR #1312)
4. Documentation:
* Update README instructions to reflect current Windows build steps. (PR #1232)
* Add OmniRig troubleshooting to the user manual. (PR #1264)

27
cmake/GetDependencies.cmake.in
View File

@ -10,12 +10,6 @@ set(CMAKE_FIND_LIBRARY_SUFFIXES @CMAKE_FIND_LIBRARY_SUFFIXES@)
set(CMAKE_FIND_LIBRARY_PREFIXES @CMAKE_FIND_LIBRARY_PREFIXES@)
set(CMAKE_SYSTEM_LIBRARY_PATH @CMAKE_SYSTEM_LIBRARY_PATH@)
set(CMAKE_FIND_ROOT_PATH @CMAKE_FIND_ROOT_PATH@)
if(USE_INTERNAL_CODEC2)
set(CODEC2_BUILD_DIR ${CMAKE_BINARY_DIR}/codec2_build)
else()
set(CODEC2_BUILD_DIR @CODEC2_BUILD_DIR@)
endif()
set(FREEDV_USING_LLVM_MINGW @FREEDV_USING_LLVM_MINGW@)
set(FREEDV_PACKAGE_SEARCH_PATHS @FREEDV_PACKAGE_SEARCH_PATHS@)
@ -44,11 +38,20 @@ endmacro()
# Code signing function
set(SIGN_WINDOWS_BINARIES @SIGN_WINDOWS_BINARIES@)
set(PKCS11_SECONDARY_CERTIFICATE @PKCS11_SECONDARY_CERTIFICATE@)
function(freedv_sign_dependency FILENAME OUT)
if(SIGN_WINDOWS_BINARIES)
execute_process(
COMMAND @OSSLSIGNCODE_BIN@ sign -pkcs11engine @PKCS11_ENGINE@ -pkcs11module @PKCS11_MODULE@ -pkcs11cert "@PKCS11_CERTIFICATE@" -key "@PKCS11_KEY@" -h @SIGN_HASH@ -comm -ts @TIMESTAMP_SERVER@ -ac @INTERMEDIATE_CERT_FILE@ -n "FreeDV - @PROJECT_DESCRIPTION@" -i "https://freedv.org/" -in "${FILENAME}" -out "${OUT}"
)
if(PKCS11_SECONDARY_CERTIFICATE)
execute_process(
COMMAND mv "${OUT}" "${FILENAME}"
)
execute_process(
COMMAND @OSSLSIGNCODE_BIN@ sign -nest -pkcs11engine @PKCS11_ENGINE@ -pkcs11module @PKCS11_MODULE@ -pkcs11cert "@PKCS11_SECONDARY_CERTIFICATE@" -key "@PKCS11_SECONDARY_KEY@" -h @SIGN_HASH@ -comm -ts @TIMESTAMP_SERVER@ -ac @INTERMEDIATE_CERT_FILE@ -n "FreeDV - @PROJECT_DESCRIPTION@" -i "https://freedv.org/" -in "${FILENAME}" -out "${OUT}"
)
endif(PKCS11_SECONDARY_CERTIFICATE)
else(SIGN_WINDOWS_BINARIES)
execute_process(
COMMAND cp "${FILENAME}" "${OUT}"
@ -122,18 +125,6 @@ execute_process(
)
# Handle internal libraries separately.
if(CODEC2_BUILD_DIR)
list(REMOVE_ITEM _deps libcodec2.dll)
find_library(CODEC2 codec2 NO_DEFAULT_PATH PATHS ${CODEC2_BUILD_DIR}/src REQUIRED)
string(REPLACE ".a" "" CODEC2_FINAL ${CODEC2})
message("Found: libcodec2.dll")
#file(INSTALL DESTINATION "${CMAKE_INSTALL_PREFIX}/bin"
# TYPE EXECUTABLE FILES ${CODEC2_FINAL})
freedv_sign_dependency(${CODEC2_FINAL} ${CMAKE_INSTALL_PREFIX}/bin/libcodec2.dll)
endif()
if(FREEDV_USING_LLVM_MINGW)
# Use the bin/ folder for the platform as an additional
# search path for find_library.

26
src/CMakeLists.txt
View File

@ -188,11 +188,23 @@ endif(APPLE)
# Custom commands for signing Windows binaries
if(SIGN_WINDOWS_BINARIES)
# Add custom command to sign freedv.exe.
add_custom_command(
TARGET freedv
POST_BUILD
COMMAND mv $<TARGET_FILE:freedv> $<TARGET_FILE:freedv>.tmp
COMMAND ${OSSLSIGNCODE_BIN} ARGS sign -pkcs11engine ${PKCS11_ENGINE} -pkcs11module ${PKCS11_MODULE} -pkcs11cert "${PKCS11_CERTIFICATE}" -key "${PKCS11_KEY}" -h ${SIGN_HASH} -ts ${TIMESTAMP_SERVER} -comm -ac ${INTERMEDIATE_CERT_FILE} -n "FreeDV - ${PROJECT_DESCRIPTION}" -i "https://freedv.org/" -in $<TARGET_FILE:freedv>.tmp -out $<TARGET_FILE:freedv>
COMMAND rm $<TARGET_FILE:freedv>.tmp
VERBATIM)
if (PKCS11_SECONDARY_CERTIFICATE)
add_custom_command(
TARGET freedv
POST_BUILD
COMMAND mv $<TARGET_FILE:freedv> $<TARGET_FILE:freedv>.tmp
COMMAND ${OSSLSIGNCODE_BIN} ARGS sign -pkcs11engine ${PKCS11_ENGINE} -pkcs11module ${PKCS11_MODULE} -pkcs11cert "${PKCS11_CERTIFICATE}" -key "${PKCS11_KEY}" -h ${SIGN_HASH} -ts ${TIMESTAMP_SERVER} -comm -ac ${INTERMEDIATE_CERT_FILE} -n "FreeDV - ${PROJECT_DESCRIPTION}" -i "https://freedv.org/" -in $<TARGET_FILE:freedv>.tmp -out $<TARGET_FILE:freedv>
COMMAND mv $<TARGET_FILE:freedv> $<TARGET_FILE:freedv>.tmp
COMMAND ${OSSLSIGNCODE_BIN} ARGS sign -nest -pkcs11engine ${PKCS11_ENGINE} -pkcs11module ${PKCS11_MODULE} -pkcs11cert "${PKCS11_SECONDARY_CERTIFICATE}" -key "${PKCS11_SECONDARY_KEY}" -h ${SIGN_HASH} -ts ${TIMESTAMP_SERVER} -comm -ac ${INTERMEDIATE_CERT_FILE} -n "FreeDV - ${PROJECT_DESCRIPTION}" -i "https://freedv.org/" -in $<TARGET_FILE:freedv>.tmp -out $<TARGET_FILE:freedv>
COMMAND rm $<TARGET_FILE:freedv>.tmp
VERBATIM)
else()
add_custom_command(
TARGET freedv
POST_BUILD
COMMAND mv $<TARGET_FILE:freedv> $<TARGET_FILE:freedv>.tmp
COMMAND ${OSSLSIGNCODE_BIN} ARGS sign -pkcs11engine ${PKCS11_ENGINE} -pkcs11module ${PKCS11_MODULE} -pkcs11cert "${PKCS11_CERTIFICATE}" -key "${PKCS11_KEY}" -h ${SIGN_HASH} -ts ${TIMESTAMP_SERVER} -comm -ac ${INTERMEDIATE_CERT_FILE} -n "FreeDV - ${PROJECT_DESCRIPTION}" -i "https://freedv.org/" -in $<TARGET_FILE:freedv>.tmp -out $<TARGET_FILE:freedv>
COMMAND rm $<TARGET_FILE:freedv>.tmp
VERBATIM)
endif (PKCS11_SECONDARY_CERTIFICATE)
endif(SIGN_WINDOWS_BINARIES)