Add Windows card reader, code-signing helpers and playlist diagnostics

- windows/win_card_reader.py: Windows-native card reader via the Raw Input API with a low-level keyboard-hook fallback. - windows/sign_exe.ps1: sign the built executable with a .pfx certificate. - windows/create_self_signed_cert.ps1: generate a self-signed cert for local testing (not trusted by Smart App Control). - windows/verify_sendinput_fix.py: verification helper for the SendInput foreground-unlock fix in run_win.py. - documentation/CODE_SIGNING_SMART_APP_CONTROL.md: signing guidance. - working_files/execute_playlist_retrieve.py, working_files/raw_server_playlist.json: playlist retrieval diagnostics. Note: windows/archive_list.txt and windows/build_last.txt are build output and were committed by request rather than by convention.
2026-09-10 16:44:12 +03:00
parent a0704efa3c
commit 5d9aa02c07
7 changed files with 1371 additions and 0 deletions
@@ -0,0 +1,110 @@
+<#
+================================================================================
+ Kiwy Signage Player - Self-Signed Certificate Creator
+================================================================================
+ Creates a self-signed code-signing certificate for DEV/TEST machines.
+
+ IMPORTANT (please read before running):
+   A self-signed certificate, even when trusted locally, does NOT satisfy
+   Smart App Control (SAC). SAC only trusts reputable public CAs. This script
+   is therefore ONLY for development / test PCs where you have admin rights
+   and where SAC is either OFF or the app is run with SAC disabled.
+
+   For production PCs (SAC ON, no admin), you MUST buy a code-signing cert
+   from a public CA (Sectigo/SSL.com/DigiCert/GlobalSign) and use
+   sign_exe.ps1 with that .pfx.
+
+ What this does:
+   1. Creates a self-signed code-signing cert in the Current User store
+      (never expires, exportable so you can move it to the build machine).
+   2. Exports it to a .pfx (password-protected) so build_win.bat can sign.
+   3. Asks if you want to trust it on THIS machine (installs to Root + Trusted
+      Publisher + Trusted People) so the player runs without SmartScreen/
+      Defender prompts on this dev PC.
+
+ Usage (run as Administrator):
+   .\create_self_signed_cert.ps1
+   .\create_self_signed_cert.ps1 -CertName "Kiwy Signage Dev" -PfxPassword "ChangeMe!1" -ExportPath "C:\certs\kiwy_dev.pfx"
+================================================================================
+#>
+[CmdletBinding()]
+param(
+    [string]$CertName = 'Kiwy Signage Player (Dev)',
+    [string]$Subject = 'CN=Kiwy Signage Player (Dev)',
+    [string]$PfxPassword = 'KiwySignage2026!',
+    [string]$ExportPath = (Join-Path $PSScriptRoot 'kiwy_dev_signing.pfx'),
+    [switch]$SkipTrust
+)
+
+$ErrorActionPreference = 'Stop'
+Set-Location $PSScriptRoot
+
+# ── 1. Create the self-signed code-signing certificate ──────────────
+Write-Host "[STEP] Creating self-signed code-signing certificate..." -ForegroundColor Cyan
+
+$cert = New-SelfSignedCertificate `
+    -Subject $Subject `
+    -FriendlyName $CertName `
+    -Type CodeSigningCert `
+    -CertStoreLocation 'Cert:\CurrentUser\My' `
+    -KeyExportPolicy Exportable `
+    -KeyAlgorithm RSA `
+    -KeyLength 2048 `
+    -NotAfter (Get-Date).AddYears(10)
+
+if (-not $cert) {
+    Write-Host "[ERROR] Failed to create certificate." -ForegroundColor Red
+    exit 1
+}
+Write-Host "[OK   ] Created cert: $($cert.Subject) thumbprint=$($cert.Thumbprint)" -ForegroundColor Green
+
+# ── 2. Export to PFX ─────────────────────────────────────────────────
+Write-Host "[STEP] Exporting to PFX: $ExportPath" -ForegroundColor Cyan
+$securePwd = ConvertTo-SecureString -String $PfxPassword -Force -AsPlainText
+try {
+    Export-PfxCertificate -Cert $cert -FilePath $ExportPath -Password $securePwd -Force | Out-Null
+    Write-Host "[OK   ] PFX written: $ExportPath" -ForegroundColor Green
+} catch {
+    Write-Host "[WARN ] Could not export PFX (still usable from cert store): $($_.Exception.Message)" -ForegroundColor Yellow
+}
+
+# ── 3. Trust it on THIS machine (Root + Trusted Publisher) ───────────
+if (-not $SkipTrust) {
+    Write-Host "[STEP] Installing to Trusted Root + Trusted Publisher (requires admin)..." -ForegroundColor Cyan
+    try {
+        $rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store(
+            'Root', 'CurrentUser')
+        $rootStore.Open('ReadWrite')
+        $rootStore.Add($cert)
+        $rootStore.Close()
+
+        $pubStore = New-Object System.Security.Cryptography.X509Certificates.X509Store(
+            'TrustedPublisher', 'CurrentUser')
+        $pubStore.Open('ReadWrite')
+        $pubStore.Add($cert)
+        $pubStore.Close()
+
+        $peopleStore = New-Object System.Security.Cryptography.X509Certificates.X509Store(
+            'TrustedPeople', 'CurrentUser')
+        $peopleStore.Open('ReadWrite')
+        $peopleStore.Add($cert)
+        $peopleStore.Close()
+
+        Write-Host "[OK   ] Certificate trusted on this machine." -ForegroundColor Green
+    } catch {
+        Write-Host "[WARN ] Trust install failed (run as Administrator): $($_.Exception.Message)" -ForegroundColor Yellow
+    }
+}
+
+Write-Host ""
+Write-Host "================ RESULT ================" -ForegroundColor Green
+Write-Host "Cert  : $($cert.Subject)"
+Write-Host "Thumb : $($cert.Thumbprint)"
+Write-Host "PFX   : $ExportPath  (password: $PfxPassword)"
+Write-Host ""
+Write-Host "To sign the exe with this cert:"
+Write-Host "   .\sign_exe.ps1 -CertPath `"$ExportPath`" -CertPassword `"$PfxPassword`""
+Write-Host ""
+Write-Host "REMINDER: This self-signed cert is for DEV ONLY. Production PCs"
+Write-Host "with Smart App Control ON need a cert from a public CA."
+Write-Host "========================================" -ForegroundColor Green