{"action":"created","issue":{"url":"https://api.github.com/repos/HinTak/Font-Validator/issues/4","repository_url":"https://api.github.com/repos/HinTak/Font-Validator","labels_url":"https://api.github.com/repos/HinTak/Font-Validator/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/HinTak/Font-Validator/issues/4/comments","events_url":"https://api.github.com/repos/HinTak/Font-Validator/issues/4/events","html_url":"https://github.com/HinTak/Font-Validator/issues/4","id":119635669,"number":4,"title":"DSIG remaining issues.","user":{"login":"HinTak","id":14662953,"avatar_url":"https://avatars.githubusercontent.com/u/14662953?v=3","gravatar_id":"","url":"https://api.github.com/users/HinTak","html_url":"https://github.com/HinTak","followers_url":"https://api.github.com/users/HinTak/followers","following_url":"https://api.github.com/users/HinTak/following{/other_user}","gists_url":"https://api.github.com/users/HinTak/gists{/gist_id}","starred_url":"https://api.github.com/users/HinTak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HinTak/subscriptions","organizations_url":"https://api.github.com/users/HinTak/orgs","repos_url":"https://api.github.com/users/HinTak/repos","events_url":"https://api.github.com/users/HinTak/events{/privacy}","received_events_url":"https://api.github.com/users/HinTak/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-12-01T03:41:10Z","updated_at":"2016-03-08T21:09:40Z","closed_at":null,"body":"Besides verifying the data against the signed hash, I can now also:\r\n\r\n- read the signing time stamp\r\n\r\n- joining the trusted chain.\r\n\r\n- establish about 60% of the fonts being signed by a certificate issued by a root authority, or a proxy of one; using just the thumb prints (i.e. digest) of the 19 certificates shipped by win 8.1. In fact I think I only need about 5. This covers most recent fonts from Vista onwards.\r\n\r\nThere is a bit more work to do to check timestamp is within certificates' validity period etc. Just tedious but straightforward. These are considerable more informative than the official MS tool check, and covers older fonts already.\r\n\r\nHowever, the signing timestamp code is windows-only ( mono bug:  https://bugzilla.xamarin.com/show_bug.cgi?id=36295 ), the trusted chain codes uses a lot of Mono-specific certificate manipulation code and is non-windows-only; and to establish trust of the older 40% of signed fonts I need to include more trusted thumb prints, or at worst, maybe even the (older) root certificates themselves.\r\n\r\nSo between windows-only, non-windows-only, and more bundled certificates - all 3 means importing lots of non-mine code or data (the windows-only problem means fix the bug and bundle the fixed Mono code, the non-windows-only problem means bundling the non-windows part of Mono code...).\r\n\r\nTo build the non-windows trusted chain code, do 'make USE_MONO_SECURITY=true' instead of plain make.\r\n"},"comment":{"url":"https://api.github.com/repos/HinTak/Font-Validator/issues/comments/193967387","html_url":"https://github.com/HinTak/Font-Validator/issues/4#issuecomment-193967387","issue_url":"https://api.github.com/repos/HinTak/Font-Validator/issues/4","id":193967387,"user":{"login":"HinTak","id":14662953,"avatar_url":"https://avatars.githubusercontent.com/u/14662953?v=3","gravatar_id":"","url":"https://api.github.com/users/HinTak","html_url":"https://github.com/HinTak","followers_url":"https://api.github.com/users/HinTak/followers","following_url":"https://api.github.com/users/HinTak/following{/other_user}","gists_url":"https://api.github.com/users/HinTak/gists{/gist_id}","starred_url":"https://api.github.com/users/HinTak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HinTak/subscriptions","organizations_url":"https://api.github.com/users/HinTak/orgs","repos_url":"https://api.github.com/users/HinTak/repos","events_url":"https://api.github.com/users/HinTak/events{/privacy}","received_events_url":"https://api.github.com/users/HinTak/received_events","type":"User","site_admin":false},"created_at":"2016-03-08T21:09:40Z","updated_at":"2016-03-08T21:09:40Z","body":"The 4 YuGoth* TTC fonts on windows 10 also gets their hashes mis-calculated. It is the same issue with my mis-calculation of very old TTCs. The issue is well-understood, just haven't got time to work on it. I probably should throw an error, rather than let it continue to mis-calculate meanwhile.\r\n"}}