mirror of
https://github.com/jamesstringer90/appsandbox.git
synced 2026-10-19 01:31:28 -05:00
James Stringer
717c5b5148
Build, EV-sign, Microsoft attestation-sign, and package AppSandbox for Windows on ARM with feature parity to x64 except the vTPM and guest-state isolation (neither is supported by ARM Windows HCS). Target architecture is resolved at compile time (ASB_IS_ARM64 in disk_util.h); the supported pairing is x64 build/host/guest and ARM64 build/host/guest, so one flag drives every architecture decision. x64 behavior is unchanged throughout. Runtime: - hcs_vm.c: omit SecuritySettings (vTPM + GuestStateOnly isolation) on ARM; Secure Boot is retained. - disk_util.c: emit the arch token in every autounattend/unattend processorArchitecture attribute; on ARM, bypass the Win11 Setup hardware checks via the HKLM\SYSTEM\Setup\LabConfig keys across all VM-creation paths; select the arch-correct OpenSSH Server MSI. - d3dlayers.c / agent.c: resolve, download, and stage the arm64 D3D mapping layers for GPU-PV; stage the Vulkan ICD manifest under the arch-neutral name dzn_icd.json. Build and release pipeline: - AppSandbox.sln: add the missing AppSandboxPackage Release|ARM64 Build.0 so the VS GUI actually runs sign+package for the ARM64 config. - AppSandboxPackage.vcxproj: run make-release.ps1 for Release on x64 or ARM64, passing -Platform $(Platform). - make-release.ps1 / sign-drivers.ps1: -Platform ARM64 selects bin\Release-ARM64, the ARM64 attestation profile, and the AppSandbox-<ver>-win-arm64.zip name. Sanitize LIB before Add-Type so the .NET Framework C# compiler does not fail (CS1668) on the non-existent atlmfc\lib\ARM64 path the VS ARM64 build adds to LIB. - Directory.Build.props: disable ApiValidator only when cross-building ARM64 on a non-ARM64 host (the x86 ApiExtractor cannot read ARM64 PEs); Microsoft re-runs full API validation on every attestation submission. - Package.vcxproj: stage the vendored ARM64 devcon.exe into the ARM64 drivers output, mirroring the x64 devcon copy. - vendor/devcon/arm64/devcon.exe: add the vendored ARM64 devcon.exe, un-ignored in .gitignore mirroring the existing vendor/webview2/arm64 precedent.
158 lines
9.7 KiB
XML
158 lines
9.7 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
|
<ItemGroup Label="ProjectConfigurations">
|
|
<ProjectConfiguration Include="Debug|ARM64">
|
|
<Configuration>Debug</Configuration>
|
|
<Platform>ARM64</Platform>
|
|
</ProjectConfiguration>
|
|
<ProjectConfiguration Include="Debug|x64">
|
|
<Configuration>Debug</Configuration>
|
|
<Platform>x64</Platform>
|
|
</ProjectConfiguration>
|
|
<ProjectConfiguration Include="Release|ARM64">
|
|
<Configuration>Release</Configuration>
|
|
<Platform>ARM64</Platform>
|
|
</ProjectConfiguration>
|
|
<ProjectConfiguration Include="Release|x64">
|
|
<Configuration>Release</Configuration>
|
|
<Platform>x64</Platform>
|
|
</ProjectConfiguration>
|
|
</ItemGroup>
|
|
<PropertyGroup Label="Globals">
|
|
<ProjectGuid>{F2E3D4C5-B6A7-8901-CDEF-234567890ABC}</ProjectGuid>
|
|
<TemplateGuid>{26FAD2BA-3F47-466E-8378-9B804AB631C8}</TemplateGuid>
|
|
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
|
|
<Configuration>Debug</Configuration>
|
|
<Platform Condition="'$(Platform)' == ''">x64</Platform>
|
|
<RootNamespace>AppSandboxVDDPackage</RootNamespace>
|
|
<DriverType>Package</DriverType>
|
|
</PropertyGroup>
|
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
|
|
<TargetVersion>Windows10</TargetVersion>
|
|
<UseDebugLibraries>true</UseDebugLibraries>
|
|
<PlatformToolset>WindowsUserModeDriver10.0</PlatformToolset>
|
|
<ConfigurationType>Utility</ConfigurationType>
|
|
<SignMode>TestSign</SignMode>
|
|
</PropertyGroup>
|
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
|
<TargetVersion>Windows10</TargetVersion>
|
|
<UseDebugLibraries>true</UseDebugLibraries>
|
|
<PlatformToolset>WindowsUserModeDriver10.0</PlatformToolset>
|
|
<ConfigurationType>Utility</ConfigurationType>
|
|
<SignMode>TestSign</SignMode>
|
|
</PropertyGroup>
|
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
|
|
<TargetVersion>Windows10</TargetVersion>
|
|
<UseDebugLibraries>false</UseDebugLibraries>
|
|
<PlatformToolset>WindowsUserModeDriver10.0</PlatformToolset>
|
|
<ConfigurationType>Utility</ConfigurationType>
|
|
<SignMode>TestSign</SignMode>
|
|
</PropertyGroup>
|
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
|
<TargetVersion>Windows10</TargetVersion>
|
|
<UseDebugLibraries>false</UseDebugLibraries>
|
|
<PlatformToolset>WindowsUserModeDriver10.0</PlatformToolset>
|
|
<ConfigurationType>Utility</ConfigurationType>
|
|
<SignMode>TestSign</SignMode>
|
|
</PropertyGroup>
|
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
|
<ImportGroup Label="ExtensionSettings">
|
|
</ImportGroup>
|
|
<ImportGroup Label="PropertySheets">
|
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
|
</ImportGroup>
|
|
<PropertyGroup Label="UserMacros" />
|
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
|
|
<DebuggerFlavor>DbgengRemoteDebugger</DebuggerFlavor>
|
|
<Inf2CatUseLocalTime>true</Inf2CatUseLocalTime>
|
|
</PropertyGroup>
|
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
|
<DebuggerFlavor>DbgengRemoteDebugger</DebuggerFlavor>
|
|
<Inf2CatUseLocalTime>true</Inf2CatUseLocalTime>
|
|
</PropertyGroup>
|
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
|
|
<DebuggerFlavor>DbgengRemoteDebugger</DebuggerFlavor>
|
|
<Inf2CatUseLocalTime>true</Inf2CatUseLocalTime>
|
|
</PropertyGroup>
|
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
|
<DebuggerFlavor>DbgengRemoteDebugger</DebuggerFlavor>
|
|
<Inf2CatUseLocalTime>true</Inf2CatUseLocalTime>
|
|
</PropertyGroup>
|
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
|
|
<DriverSign>
|
|
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
|
|
</DriverSign>
|
|
</ItemDefinitionGroup>
|
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
|
<DriverSign>
|
|
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
|
|
</DriverSign>
|
|
</ItemDefinitionGroup>
|
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
|
|
<DriverSign>
|
|
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
|
|
</DriverSign>
|
|
</ItemDefinitionGroup>
|
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
|
<DriverSign>
|
|
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
|
|
</DriverSign>
|
|
</ItemDefinitionGroup>
|
|
<ItemGroup>
|
|
<ProjectReference Include="..\AppSandboxVDD.vcxproj">
|
|
<Project>{E1F2A3B4-C5D6-7890-ABCD-EF1234567890}</Project>
|
|
<LinkLibraryDependencies>false</LinkLibraryDependencies>
|
|
<ReferenceOutputAssembly>false</ReferenceOutputAssembly>
|
|
<Private>false</Private>
|
|
</ProjectReference>
|
|
</ItemGroup>
|
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
|
|
<PostBuildEvent>
|
|
<Command>if not exist "$(SolutionDir)bin\$(Configuration)-ARM64\drivers\" mkdir "$(SolutionDir)bin\$(Configuration)-ARM64\drivers\"
|
|
copy /Y "$(SolutionDir)ARM64\$(Configuration)\AppSandboxVDD\AppSandboxVDD.dll" "$(SolutionDir)bin\$(Configuration)-ARM64\drivers\"
|
|
copy /Y "$(SolutionDir)ARM64\$(Configuration)\AppSandboxVDD\AppSandboxVDD.inf" "$(SolutionDir)bin\$(Configuration)-ARM64\drivers\"
|
|
copy /Y "$(SolutionDir)ARM64\$(Configuration)\AppSandboxVDD\appsandboxvdd.cat" "$(SolutionDir)bin\$(Configuration)-ARM64\drivers\AppSandboxVDD.cat"
|
|
powershell -NoProfile -Command "$sig = Get-AuthenticodeSignature '$(SolutionDir)ARM64\$(Configuration)\AppSandboxVDD\appsandboxvdd.cat'; if ($sig.SignerCertificate) { [IO.File]::WriteAllBytes('$(SolutionDir)bin\$(Configuration)-ARM64\drivers\AppSandboxVDD.cer', $sig.SignerCertificate.RawData) }"
|
|
copy /Y "$(SolutionDir)vendor\devcon\arm64\devcon.exe" "$(SolutionDir)bin\$(Configuration)-ARM64\drivers\"</Command>
|
|
<Message>Copying VDD driver files to bin\$(Configuration)-ARM64\drivers\...</Message>
|
|
</PostBuildEvent>
|
|
</ItemDefinitionGroup>
|
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
|
<PostBuildEvent>
|
|
<Command>if not exist "$(SolutionDir)bin\$(Configuration)\drivers\" mkdir "$(SolutionDir)bin\$(Configuration)\drivers\"
|
|
copy /Y "$(SolutionDir)x64\$(Configuration)\AppSandboxVDD\AppSandboxVDD.dll" "$(SolutionDir)bin\$(Configuration)\drivers\"
|
|
copy /Y "$(SolutionDir)x64\$(Configuration)\AppSandboxVDD\AppSandboxVDD.inf" "$(SolutionDir)bin\$(Configuration)\drivers\"
|
|
copy /Y "$(SolutionDir)x64\$(Configuration)\AppSandboxVDD\appsandboxvdd.cat" "$(SolutionDir)bin\$(Configuration)\drivers\AppSandboxVDD.cat"
|
|
powershell -NoProfile -Command "$sig = Get-AuthenticodeSignature '$(SolutionDir)x64\$(Configuration)\AppSandboxVDD\appsandboxvdd.cat'; if ($sig.SignerCertificate) { [IO.File]::WriteAllBytes('$(SolutionDir)bin\$(Configuration)\drivers\AppSandboxVDD.cer', $sig.SignerCertificate.RawData) }"
|
|
copy /Y "$(SolutionDir)vendor\devcon\devcon.exe" "$(SolutionDir)bin\$(Configuration)\drivers\"</Command>
|
|
<Message>Copying VDD driver files to bin\$(Configuration)\drivers\...</Message>
|
|
</PostBuildEvent>
|
|
</ItemDefinitionGroup>
|
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
|
|
<PostBuildEvent>
|
|
<Command>if not exist "$(SolutionDir)bin\$(Configuration)-ARM64\drivers\" mkdir "$(SolutionDir)bin\$(Configuration)-ARM64\drivers\"
|
|
copy /Y "$(SolutionDir)ARM64\$(Configuration)\AppSandboxVDD\AppSandboxVDD.dll" "$(SolutionDir)bin\$(Configuration)-ARM64\drivers\"
|
|
copy /Y "$(SolutionDir)ARM64\$(Configuration)\AppSandboxVDD\AppSandboxVDD.inf" "$(SolutionDir)bin\$(Configuration)-ARM64\drivers\"
|
|
copy /Y "$(SolutionDir)ARM64\$(Configuration)\AppSandboxVDD\appsandboxvdd.cat" "$(SolutionDir)bin\$(Configuration)-ARM64\drivers\AppSandboxVDD.cat"
|
|
powershell -NoProfile -Command "$sig = Get-AuthenticodeSignature '$(SolutionDir)ARM64\$(Configuration)\AppSandboxVDD\appsandboxvdd.cat'; if ($sig.SignerCertificate) { [IO.File]::WriteAllBytes('$(SolutionDir)bin\$(Configuration)-ARM64\drivers\AppSandboxVDD.cer', $sig.SignerCertificate.RawData) }"
|
|
copy /Y "$(SolutionDir)vendor\devcon\arm64\devcon.exe" "$(SolutionDir)bin\$(Configuration)-ARM64\drivers\"</Command>
|
|
<Message>Copying VDD driver files to bin\$(Configuration)-ARM64\drivers\...</Message>
|
|
</PostBuildEvent>
|
|
</ItemDefinitionGroup>
|
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
|
<PostBuildEvent>
|
|
<Command>if not exist "$(SolutionDir)bin\$(Configuration)\drivers\" mkdir "$(SolutionDir)bin\$(Configuration)\drivers\"
|
|
copy /Y "$(SolutionDir)x64\$(Configuration)\AppSandboxVDD\AppSandboxVDD.dll" "$(SolutionDir)bin\$(Configuration)\drivers\"
|
|
copy /Y "$(SolutionDir)x64\$(Configuration)\AppSandboxVDD\AppSandboxVDD.inf" "$(SolutionDir)bin\$(Configuration)\drivers\"
|
|
copy /Y "$(SolutionDir)x64\$(Configuration)\AppSandboxVDD\appsandboxvdd.cat" "$(SolutionDir)bin\$(Configuration)\drivers\AppSandboxVDD.cat"
|
|
powershell -NoProfile -Command "$sig = Get-AuthenticodeSignature '$(SolutionDir)x64\$(Configuration)\AppSandboxVDD\appsandboxvdd.cat'; if ($sig.SignerCertificate) { [IO.File]::WriteAllBytes('$(SolutionDir)bin\$(Configuration)\drivers\AppSandboxVDD.cer', $sig.SignerCertificate.RawData) }"
|
|
copy /Y "$(SolutionDir)vendor\devcon\devcon.exe" "$(SolutionDir)bin\$(Configuration)\drivers\"</Command>
|
|
<Message>Copying VDD driver files to bin\$(Configuration)\drivers\...</Message>
|
|
</PostBuildEvent>
|
|
</ItemDefinitionGroup>
|
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
|
<ImportGroup Label="ExtensionTargets">
|
|
</ImportGroup>
|
|
</Project>
|