← Older revision

Revision as of 21:30, 22 April 2026

(One intermediate revision by the same user not shown)

Line 24:

** click on path, click edit, click new, paste value and add "\bin".

** click on path, click edit, click new, paste value and add "\bin".

⚫

Follow the instructions in src/windows/README to perform a build.  NODEBUG can be set in the environment ("set NODEBUG=1") to avoid having to specify it on the nmake command line each time.  For MIT-specific builds, also "set MIT_INTERNAL=1" or specify it on the nmake command line when building the installer.

+

* Choose a released version of OpenSSL (called X.Y.Z below) and build it:

−

Code signing:

+

  cd %homepath%

+

  git clone https://github.com/openssl/openssl

+

  cd openssl

+

  git checkout openssl-X.Y.Z

+

  perl Configure

+

  nmake

+

  nmake install

+

  set OPENSSL_DIR=C:\Program Files\OpenSSL

+

  set OPENSSL_VERSION=X

⚫

    signtool sign /v /d "MIT Kerberos for Windows installer" /a /fd sha256 /tr http://timestamp.comodoca.com /td sha256 foo.msi

⚫

* Follow the instructions in src/windows/README to perform a build.  NODEBUG can be set in the environment ("set NODEBUG=1") to avoid having to specify it on the nmake command line each time.  For MIT-specific builds, also "set MIT_INTERNAL=1" or specify it on the nmake command line when building the installer.

−

See also https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/68/7/

+

* To sign an MSI file:

+

** Connect a cryptographic token with FIPS support containing a code-signing certificate.  If using VMWare Workstation, use VM > Removable Devices to pass through the token, disconnecting it from the host.

+

** If it is a Yubikey token containing an ECC code-signing certificate, it may be necessary to install the YubiKey Smart Card Minidriver from https://www.yubico.com/support/download/smart-card-drivers-tools/ .  Reconnect the Yubikey token after installing.

+

** Verify that the certificate is visible to Windows using "certutil -store -user my".

+

** Use the command:

+

⚫

  signtool sign /v /d "MIT Kerberos for Windows installer" /a /fd sha256 /tr http://timestamp.comodoca.com /td sha256 kfw.msi

+

* To obtain a code-signing certificate (these steps are for a Debian-based Linux system):

+

** Obtain a cryptographic token with FIPS support.  These notes assume a YubiKey 5 NFC FIPS token.

+

** Install the yubikey-manager package.

+

** Generate a certificate request and attestation file as follows:

+

  ykman piv keys generate -a ECCP384 9a publickey

+

    (return to use default key)

+

  ykman piv keys attest 9a attest.crt

+

  ykman piv certificates request -s "MIT Code Signing" 9a publickey csr

+

    (enter default PIN 123456)

+

  ykman piv certificates export f9 intermediate.crt

+

  cat attest.crt intermediate.crt | base64 > attest.b64

+

** Send mail to mitcert@mit.edu .  They will generate an invitation link to cert-manager.com.  When filling out the form, leave the SAN email field blank.  Paste the csr file and the attest.b64 file into the form.

+

** After issuance, choose the "Certificate (w/ issuer after), PEM" link from the resulting email message.

+

** Import the certificate with "ykman piv certificates import 9a cert.pem" (where "cert.pem" is the downloaded file).

+

See also https://www.sectigo.com/knowledge-base/detail/Key-Generation-and-Attestation-with-YubiKey .

More general KfW release engineering information at [[Kerberos for Windows Release Engineering]].

More general KfW release engineering information at [[Kerberos for Windows Release Engineering]].

K5Wiki - Recent changes [en]

Kerberos for Windows (KfW) Build Environment