| 1 | //go:build windows |
| 2 | |
| 3 | package main |
| 4 | |
| 5 | import ( |
| 6 | "errors" |
| 7 | "unsafe" |
| 8 | |
| 9 | "golang.org/x/sys/windows" |
| 10 | ) |
| 11 | |
| 12 | // Tray identity is a shell preference, not an update trust decision. Use only |
| 13 | // cached trust data and never display signing UI or fetch certificates at startup. |
| 14 | func verifyTraySignature(path string) error { |
| 15 | name, err := windows.UTF16PtrFromString(path) |
| 16 | if err != nil { |
| 17 | return err |
| 18 | } |
| 19 | handle, err := windows.CreateFile(name, windows.GENERIC_READ, windows.FILE_SHARE_READ, nil, windows.OPEN_EXISTING, windows.FILE_ATTRIBUTE_NORMAL, 0) |
| 20 | if err != nil { |
| 21 | return err |
| 22 | } |
| 23 | defer windows.CloseHandle(handle) |
| 24 | file := windows.WinTrustFileInfo{Size: uint32(unsafe.Sizeof(windows.WinTrustFileInfo{})), FilePath: name, File: handle} |
| 25 | data := windows.WinTrustData{ |
| 26 | Size: uint32(unsafe.Sizeof(windows.WinTrustData{})), |
| 27 | UIChoice: windows.WTD_UI_NONE, |
| 28 | RevocationChecks: windows.WTD_REVOKE_NONE, |
| 29 | UnionChoice: windows.WTD_CHOICE_FILE, |
| 30 | FileOrCatalogOrBlobOrSgnrOrCert: unsafe.Pointer(&file), |
| 31 | StateAction: windows.WTD_STATEACTION_VERIFY, |
| 32 | ProvFlags: windows.WTD_CACHE_ONLY_URL_RETRIEVAL | windows.WTD_REVOCATION_CHECK_NONE, |
| 33 | } |
| 34 | err = windows.WinVerifyTrustEx(windows.InvalidHWND, &windows.WINTRUST_ACTION_GENERIC_VERIFY_V2, &data) |
| 35 | data.StateAction = windows.WTD_STATEACTION_CLOSE |
| 36 | return errors.Join(err, windows.WinVerifyTrustEx(windows.InvalidHWND, &windows.WINTRUST_ACTION_GENERIC_VERIFY_V2, &data)) |
| 37 | } |
| 38 |