At present only test drivers are being posted. These are signed with a certificate that has been generated by us and isn’t (and really shouldn’t be) trusted by anyone. You can
install these on windows by turning test-signing on and installing the public test certificate on the VM... of course since the private key is being shipped in our repositories anyone could sign anything with this key... so you don’t want systems you care
about even slightly using this.
Cross signed drivers are signed by a certificate which have a chain of trust back to a trusted certification authority, and where that certificate is cross-signed onto Microsoft’s
chain of trust for drivers. These tools will (I think) install on any current version of windows if you have installed the public certificate on those versions of windows. However, I also believe this may not be the case in the future for windows 10 and 2k16
If you want PV drivers which can be installed on any version of windows without installing certificates, they have to be release signed (what used to be called ‘logo-signed’,
MS seem to keep changing the name of this... it was originally called logo signing because it allowed you to put a windows logo on your product’s box.). Foe this you need to pass a number of tests from the HCK and also sign the test results with an EV certificate.
Running these tests is not a trivial process – it takes a decent chunk of time, effort and experience to get through them.
Generally speaking, the following is true:
Test signed drivers are good enough for day to day development and testing purposes.
Many people (who are in full control of the VMs in their network) will be happy with cross-signed drivers (and installing the certs on a golden image – or somesuch) themselves.
Getting release-signed drivers is a big overhead – and expensive both in terms of time and money. You would only ever expect it to be done for fully tested release quality drivers.
At the moment, Citrix release (very slightly modified) logo-signed drivers with XenServer (including in the open source version) These are currently 8.1 drivers – and so are up to date with the latest release-quality PV Tools.
The biggest bang for buck we could get at the moment would be for someone trustworthy to produced cross-signed drivers from our automated builds – that would allow you to take
a build and begin using it securely.
Ben Chalmers
