ske087
5d9aa02c07
- windows/win_card_reader.py: Windows-native card reader via the Raw Input API with a low-level keyboard-hook fallback. - windows/sign_exe.ps1: sign the built executable with a .pfx certificate. - windows/create_self_signed_cert.ps1: generate a self-signed cert for local testing (not trusted by Smart App Control). - windows/verify_sendinput_fix.py: verification helper for the SendInput foreground-unlock fix in run_win.py. - documentation/CODE_SIGNING_SMART_APP_CONTROL.md: signing guidance. - working_files/execute_playlist_retrieve.py, working_files/raw_server_playlist.json: playlist retrieval diagnostics. Note: windows/archive_list.txt and windows/build_last.txt are build output and were committed by request rather than by convention.
111 lines
4.8 KiB
PowerShell
111 lines
4.8 KiB
PowerShell
<#
|
|
================================================================================
|
|
Kiwy Signage Player - Self-Signed Certificate Creator
|
|
================================================================================
|
|
Creates a self-signed code-signing certificate for DEV/TEST machines.
|
|
|
|
IMPORTANT (please read before running):
|
|
A self-signed certificate, even when trusted locally, does NOT satisfy
|
|
Smart App Control (SAC). SAC only trusts reputable public CAs. This script
|
|
is therefore ONLY for development / test PCs where you have admin rights
|
|
and where SAC is either OFF or the app is run with SAC disabled.
|
|
|
|
For production PCs (SAC ON, no admin), you MUST buy a code-signing cert
|
|
from a public CA (Sectigo/SSL.com/DigiCert/GlobalSign) and use
|
|
sign_exe.ps1 with that .pfx.
|
|
|
|
What this does:
|
|
1. Creates a self-signed code-signing cert in the Current User store
|
|
(never expires, exportable so you can move it to the build machine).
|
|
2. Exports it to a .pfx (password-protected) so build_win.bat can sign.
|
|
3. Asks if you want to trust it on THIS machine (installs to Root + Trusted
|
|
Publisher + Trusted People) so the player runs without SmartScreen/
|
|
Defender prompts on this dev PC.
|
|
|
|
Usage (run as Administrator):
|
|
.\create_self_signed_cert.ps1
|
|
.\create_self_signed_cert.ps1 -CertName "Kiwy Signage Dev" -PfxPassword "ChangeMe!1" -ExportPath "C:\certs\kiwy_dev.pfx"
|
|
================================================================================
|
|
#>
|
|
[CmdletBinding()]
|
|
param(
|
|
[string]$CertName = 'Kiwy Signage Player (Dev)',
|
|
[string]$Subject = 'CN=Kiwy Signage Player (Dev)',
|
|
[string]$PfxPassword = 'KiwySignage2026!',
|
|
[string]$ExportPath = (Join-Path $PSScriptRoot 'kiwy_dev_signing.pfx'),
|
|
[switch]$SkipTrust
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
Set-Location $PSScriptRoot
|
|
|
|
# ── 1. Create the self-signed code-signing certificate ──────────────
|
|
Write-Host "[STEP] Creating self-signed code-signing certificate..." -ForegroundColor Cyan
|
|
|
|
$cert = New-SelfSignedCertificate `
|
|
-Subject $Subject `
|
|
-FriendlyName $CertName `
|
|
-Type CodeSigningCert `
|
|
-CertStoreLocation 'Cert:\CurrentUser\My' `
|
|
-KeyExportPolicy Exportable `
|
|
-KeyAlgorithm RSA `
|
|
-KeyLength 2048 `
|
|
-NotAfter (Get-Date).AddYears(10)
|
|
|
|
if (-not $cert) {
|
|
Write-Host "[ERROR] Failed to create certificate." -ForegroundColor Red
|
|
exit 1
|
|
}
|
|
Write-Host "[OK ] Created cert: $($cert.Subject) thumbprint=$($cert.Thumbprint)" -ForegroundColor Green
|
|
|
|
# ── 2. Export to PFX ─────────────────────────────────────────────────
|
|
Write-Host "[STEP] Exporting to PFX: $ExportPath" -ForegroundColor Cyan
|
|
$securePwd = ConvertTo-SecureString -String $PfxPassword -Force -AsPlainText
|
|
try {
|
|
Export-PfxCertificate -Cert $cert -FilePath $ExportPath -Password $securePwd -Force | Out-Null
|
|
Write-Host "[OK ] PFX written: $ExportPath" -ForegroundColor Green
|
|
} catch {
|
|
Write-Host "[WARN ] Could not export PFX (still usable from cert store): $($_.Exception.Message)" -ForegroundColor Yellow
|
|
}
|
|
|
|
# ── 3. Trust it on THIS machine (Root + Trusted Publisher) ───────────
|
|
if (-not $SkipTrust) {
|
|
Write-Host "[STEP] Installing to Trusted Root + Trusted Publisher (requires admin)..." -ForegroundColor Cyan
|
|
try {
|
|
$rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store(
|
|
'Root', 'CurrentUser')
|
|
$rootStore.Open('ReadWrite')
|
|
$rootStore.Add($cert)
|
|
$rootStore.Close()
|
|
|
|
$pubStore = New-Object System.Security.Cryptography.X509Certificates.X509Store(
|
|
'TrustedPublisher', 'CurrentUser')
|
|
$pubStore.Open('ReadWrite')
|
|
$pubStore.Add($cert)
|
|
$pubStore.Close()
|
|
|
|
$peopleStore = New-Object System.Security.Cryptography.X509Certificates.X509Store(
|
|
'TrustedPeople', 'CurrentUser')
|
|
$peopleStore.Open('ReadWrite')
|
|
$peopleStore.Add($cert)
|
|
$peopleStore.Close()
|
|
|
|
Write-Host "[OK ] Certificate trusted on this machine." -ForegroundColor Green
|
|
} catch {
|
|
Write-Host "[WARN ] Trust install failed (run as Administrator): $($_.Exception.Message)" -ForegroundColor Yellow
|
|
}
|
|
}
|
|
|
|
Write-Host ""
|
|
Write-Host "================ RESULT ================" -ForegroundColor Green
|
|
Write-Host "Cert : $($cert.Subject)"
|
|
Write-Host "Thumb : $($cert.Thumbprint)"
|
|
Write-Host "PFX : $ExportPath (password: $PfxPassword)"
|
|
Write-Host ""
|
|
Write-Host "To sign the exe with this cert:"
|
|
Write-Host " .\sign_exe.ps1 -CertPath `"$ExportPath`" -CertPassword `"$PfxPassword`""
|
|
Write-Host ""
|
|
Write-Host "REMINDER: This self-signed cert is for DEV ONLY. Production PCs"
|
|
Write-Host "with Smart App Control ON need a cert from a public CA."
|
|
Write-Host "========================================" -ForegroundColor Green
|