Changes between Version 37 and Version 38 of BuildingTapWindows6

Timestamp:

04/05/19 12:41:32 (5 years ago)

Author:

Samuli Seppänen

Comment:

Add more practical instructions for Windows 10 attestation signing

BuildingTapWindows6

@@ -105 +105 @@
 }}}
 
-The next steps are
-* Generate a cabinet file as described [https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/attestation-signing-a-kernel-driver-for-public-release here].
-  * ''You have to'' put the driver files into one or more directories in the cabinet file as shown in the example diagram [https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/attestation-signing-a-kernel-driver-for-public-release here]. If you don't, cabinet file verification will fail.
-* Sign the cabinet file with the EV dongle using signtool.exe
-* Submit the cabinet file to Windows Dev Center to obtain an attestation signature
+Add a DDF file which is used to create the cabinet file. For example:
+
+{{{
+; tap-windows6.ddf
+;
+.OPTION EXPLICIT     ; Generate errors
+.Set CabinetFileCountThreshold=0
+.Set FolderFileCountThreshold=0
+.Set FolderSizeThreshold=0
+.Set MaxCabinetSize=0
+.Set MaxDiskFileCount=0
+.Set MaxDiskSize=0
+.Set CompressionType=MSZIP
+.Set Cabinet=on
+.Set Compress=on
+;Specify file name for new cab file
+.Set CabinetNameTemplate=tap-windows6.cab
+;Specify files to be included in cab file
+.Set DestinationDir=i386
+C:\users\sign\opt\sign-tap6\tap6\i386\tap0901.sys
+C:\users\sign\opt\sign-tap6\tap6\i386\OemVista.inf
+.Set DestinationDir=amd64
+C:\users\sign\opt\sign-tap6\tap6\amd64\tap0901.sys
+C:\users\sign\opt\sign-tap6\tap6\amd64\OemVista.inf
+.Set DestinationDir=arm64
+C:\users\sign\opt\sign-tap6\tap6\arm64\tap0901.sys
+C:\users\sign\opt\sign-tap6\tap6\arm64\OemVista.inf
+}}}
+
+Generate the cabinet file:
+
+{{{
+makecab.exe /f "C:\Users\sign\opt\sign-tap6\tap-windows6.ddf"
+}}}
+
+This puts the cabinet file to a subdirectory called "disk1". Then sign the cabinet file, adapting the parameters as needed:
+
+{{{
+SignTool sign /ac "C:\Users\sign\opt\sign-tap6\digicert-high-assurance-ev.crt" /s MY /n "OpenVPN" /fd sha256 /tr http://timestamp.digicert.com /td sha256 /v "C:\Users\sign\opt\sign-tap6\disk1\tap-windows6.cab"
+}}}
+
+Now you have a signed cabined file.
+
+Finally submit the signed cabined file to Windows Dev Center for attestation signing.
+
+For more generic instructions and more details please refer to the [https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/attestation-signing-a-kernel-driver-for-public-release official MS documentation] on attestation signing.
 
 = Useful commands =