[Spice-devel] qxl driver signing

[Tsukasa #01 (Oi)]

(2013/10/06 11:30), Jethro Beekman wrote:
> On Thu, May 16, 2013 at 12:29:33PM -0700, Christophe Fergeau wrote:
>> On Mon, Apr 29, 2013 at 01:11:11PM +0200, Darius Spitznagel wrote:
>>> The digital signature included with the qxl driver in the "spice-guest-tools-0.52" package expired on 28.03.2013.
>> Is it causing issues when trying to use the driver?
> 
> Yes this is (still) causing issues. The driver won't install with the following
> message: "Windows cannot verify the digital signature for the drivers required
> for this device."

I believe this "expiration" is not causing the issue.
The digital signature (in the spice-guest-tools-0.52 package) is
actually expired on 28 Mar 2013 but there is a certified timestamp (15
Oct 2012; before expiration of old Red Hat certificate) and this makes
QXL driver valid (because the timestamp proves qxl.sys is signed before
Red Hat certificate is expired).

But this digital signature is just a standard Authenticode signature and
not KMCS one (required for drivers) as I mentioned:

http://lists.freedesktop.org/archives/spice-devel/2013-October/014747.html