Skip to content

DRIVER_SIGNING.md

Latest commit

 

History

History
61 lines (46 loc) · 2.8 KB

DRIVER_SIGNING.md

File metadata and controls

61 lines (46 loc) · 2.8 KB
Raw

Driver signing and distribution

Current distribution model

ZakoVirtualGamepad currently follows the ZakoVirtualMouse development model:

  • ordinary CI produces an unsigned build artifact;
  • an explicit manual workflow can produce a self-signed x64 test package;
  • the public certificate is included so a tester can deliberately trust it;
  • every GitHub test release is marked as a prerelease and contains development-test in its archive name;
  • tag pushes alone never publish a driver.

This is not production signing. Test packages must not be described as WHQL, attestation signed, Microsoft signed, or suitable for unattended deployment.

Tester trust and UX

The test package contains ZakoVirtualGamepad-Test.cer and DEVELOPMENT-TEST-PACKAGE.txt. The elevated install script requires the explicit -TrustDevelopmentCertificate switch before it imports that exact certificate into LocalMachine\Root and LocalMachine\TrustedPublisher.

The scripts never enable the Windows testsigning boot option and never modify Secure Boot. Removing the driver does not remove trust by default; pass the explicit certificate-removal option during uninstall when the machine no longer needs that test publisher.

Each package uses a newly generated signing identity and deletes its private key after packaging. This avoids retaining a broadly reusable development key, at the cost of requiring testers to trust the certificate supplied by each test release independently.

Future production model

After AlkaidLab has an eligible legal entity and purchases a commercial code-signing certificate, add a separate production workflow. It must:

  1. keep the private key in a hardware-backed or managed signing service;
  2. sign the final catalog after the INF and DLL are immutable;
  3. include no development certificate or development marker;
  4. verify the CAT signature and CAT membership for the INF and DLL;
  5. validate installation on clean Windows 10 and Windows 11 x64 machines with Secure Boot enabled and without importing any certificate;
  6. publish production and test packages under visibly different channels.

WHQL remains a separate future path for Windows Update distribution and any platform where ordinary Authenticode signing is insufficient.

Validation gates

Before publishing even a development test release:

  1. Run InfVerif, Inf2Cat, unit tests, and static analysis.
  2. Test install, upgrade, uninstall, reboot, sleep/resume, and process-crash cleanup on a disposable machine.
  3. Exercise Steam Input, SDL, Chromium Gamepad API, and representative native DualSense consumers, including rumble, LEDs, motion, touch, and triggers.
  4. Confirm ViGEm Xbox/DS4 coexistence and Sunshine fallback behavior.
  5. Archive the exact source revision, WDK version, package SHA-256 manifest, signer thumbprint, and validation results.