From: Carl Hetherington Date: Sat, 12 Feb 2022 19:15:05 +0000 (+0100) Subject: Prompt to recreate > ~10 year old certificates on startup. X-Git-Tag: v2.14.58 X-Git-Url: https://git.carlh.net/gitweb/?a=commitdiff_plain;h=9060f465fc05f44882e96a8b73551767e5a9d876;hp=d6bf14897e544761e1a58b6d41f261d446afa5c9;p=dcpomatic.git Prompt to recreate > ~10 year old certificates on startup. --- diff --git a/cscript b/cscript index 5c17de099..31bb8a19b 100644 --- a/cscript +++ b/cscript @@ -391,8 +391,8 @@ def dependencies(target): # Use distro-provided FFmpeg on Arch deps = [] - deps.append(('libdcp', 'v1.6.19')) - deps.append(('libsub', 'v1.4.26')) + deps.append(('libdcp', 'v1.6.20')) + deps.append(('libsub', 'v1.4.27')) deps.append(('rtaudio-cdist', 'bf0fc23')) return deps diff --git a/src/lib/config.cc b/src/lib/config.cc index 9b0cc5f97..9754e1695 100644 --- a/src/lib/config.cc +++ b/src/lib/config.cc @@ -69,7 +69,7 @@ Config* Config::_instance = 0; int const Config::_current_version = 3; boost::signals2::signal Config::FailedToLoad; boost::signals2::signal Config::Warning; -boost::signals2::signal Config::BadSignerChain; +boost::signals2::signal Config::BadSignerChain; /** Construct default configuration */ Config::Config () @@ -452,15 +452,23 @@ try } } - bool bad_signer_chain = false; + BadSignerChainReason reason = BAD_SIGNER_CHAIN_NONE; BOOST_FOREACH (dcp::Certificate const & i, _signer_chain->unordered()) { if (i.has_utf8_strings()) { - bad_signer_chain = true; + reason = static_cast(reason | BAD_SIGNER_CHAIN_HAS_UTF8_STRINGS); + } + struct tm not_before = i.not_before(); + struct tm not_after = i.not_after(); + if ((not_after.tm_year - not_before.tm_year) > 15) { + /* We don't know why (or precise details) but it seems like certificate validity of >10 + * years causes problems with some projection systems (#2174 and others). + */ + reason = static_cast(reason | BAD_SIGNER_CHAIN_VALIDITY_TOO_LONG); } } - if (bad_signer_chain) { - optional const remake = BadSignerChain(); + if (reason) { + optional const remake = BadSignerChain(reason); if (remake && *remake) { _signer_chain = create_certificate_chain (); } diff --git a/src/lib/config.h b/src/lib/config.h index 8cc25d737..f9d669371 100644 --- a/src/lib/config.h +++ b/src/lib/config.h @@ -372,10 +372,11 @@ public: NAG_DKDM_CONFIG, NAG_ENCRYPTED_METADATA, NAG_ALTER_DECRYPTION_CHAIN, - NAG_BAD_SIGNER_CHAIN, + NAG_BAD_SIGNER_CHAIN_UTF8_STRINGS, /* Not really a nag but it's the same idea */ NAG_INITIAL_SETUP, NAG_IMPORT_DECRYPTION_CHAIN, + NAG_BAD_SIGNER_CHAIN_VALIDITY_TOO_LONG, NAG_COUNT }; @@ -1074,7 +1075,12 @@ public: /** Emitted if there is a bad certificate in the signer chain. Handler can call * true to ask Config to re-create the chain. */ - static boost::signals2::signal BadSignerChain; + enum BadSignerChainReason { + BAD_SIGNER_CHAIN_NONE = 0x0, + BAD_SIGNER_CHAIN_HAS_UTF8_STRINGS = 0x1, + BAD_SIGNER_CHAIN_VALIDITY_TOO_LONG = 0x2, + }; + static boost::signals2::signal BadSignerChain; void write () const; void write_config () const; diff --git a/src/tools/dcpomatic.cc b/src/tools/dcpomatic.cc index d0d832008..816686eea 100644 --- a/src/tools/dcpomatic.cc +++ b/src/tools/dcpomatic.cc @@ -1524,7 +1524,7 @@ private: */ Config::drop (); - Config::BadSignerChain.connect (boost::bind (&App::config_bad_signer_chain, this)); + Config::BadSignerChain.connect (boost::bind (&App::config_bad_signer_chain, this, _1)); _frame = new DOMFrame (_("DCP-o-matic")); SetTopWindow (_frame); @@ -1693,9 +1693,12 @@ private: message_dialog (_frame, std_to_wx (m)); } - bool config_bad_signer_chain () + bool config_bad_signer_chain (Config::BadSignerChainReason reason) { - if (Config::instance()->nagged(Config::NAG_BAD_SIGNER_CHAIN)) { + bool const need_nag_utf8_strings = (reason & Config::BAD_SIGNER_CHAIN_HAS_UTF8_STRINGS) && !Config::instance()->nagged(Config::NAG_BAD_SIGNER_CHAIN_UTF8_STRINGS); + bool const need_nag_validity_too_long = (reason & Config::BAD_SIGNER_CHAIN_VALIDITY_TOO_LONG) && !Config::instance()->nagged(Config::NAG_BAD_SIGNER_CHAIN_VALIDITY_TOO_LONG); + + if (!need_nag_utf8_strings && !need_nag_validity_too_long) { return false; } @@ -1704,7 +1707,7 @@ private: _splash = 0; } - RecreateChainDialog* d = new RecreateChainDialog (_frame); + RecreateChainDialog* d = new RecreateChainDialog (_frame, reason); int const r = d->ShowModal (); d->Destroy (); return r == wxID_OK; diff --git a/src/wx/recreate_chain_dialog.cc b/src/wx/recreate_chain_dialog.cc index 935016939..d4dc74315 100644 --- a/src/wx/recreate_chain_dialog.cc +++ b/src/wx/recreate_chain_dialog.cc @@ -32,12 +32,20 @@ using std::string; using namespace boost::placeholders; #endif -RecreateChainDialog::RecreateChainDialog (wxWindow* parent) +RecreateChainDialog::RecreateChainDialog (wxWindow* parent, Config::BadSignerChainReason reason) : QuestionDialog (parent, _("Certificate chain"), _("Recreate signing certificates"), _("Do nothing")) + , _reason (reason) { - wxString const message = _("The certificate chain that DCP-o-matic uses for signing DCPs and KDMs contains a small error\n" - "which will prevent DCPs from being validated correctly on some systems. Do you want to re-create\n" - "the certificate chain for signing DCPs and KDMs?"); + wxString message; + if (_reason & Config::BadSignerChainReason::BAD_SIGNER_CHAIN_VALIDITY_TOO_LONG) { + message = _("The certificate chain that DCP-o-matic uses for signing DCPs and KDMs has a validity period\n" + "that is too long. This will cause problems playing back DCPs on some systems.\n" + "Do you want to re-create the certificate chain for signing DCPs and KDMs?"); + } else { + message = _("The certificate chain that DCP-o-matic uses for signing DCPs and KDMs contains a small error\n" + "which will prevent DCPs from being validated correctly on some systems. Do you want to re-create\n" + "the certificate chain for signing DCPs and KDMs?"); + } _sizer->Add (new StaticText (this, message), 1, wxEXPAND | wxALL, DCPOMATIC_DIALOG_BORDER); @@ -52,5 +60,10 @@ RecreateChainDialog::RecreateChainDialog (wxWindow* parent) void RecreateChainDialog::shut_up (wxCommandEvent& ev) { - Config::instance()->set_nagged (Config::NAG_BAD_SIGNER_CHAIN, ev.IsChecked()); + if (_reason & Config::BadSignerChainReason::BAD_SIGNER_CHAIN_VALIDITY_TOO_LONG) { + Config::instance()->set_nagged (Config::NAG_BAD_SIGNER_CHAIN_VALIDITY_TOO_LONG, ev.IsChecked()); + } else { + Config::instance()->set_nagged (Config::NAG_BAD_SIGNER_CHAIN_UTF8_STRINGS, ev.IsChecked()); + } } + diff --git a/src/wx/recreate_chain_dialog.h b/src/wx/recreate_chain_dialog.h index 287e65767..5973bb49b 100644 --- a/src/wx/recreate_chain_dialog.h +++ b/src/wx/recreate_chain_dialog.h @@ -19,14 +19,17 @@ */ #include "question_dialog.h" +#include "lib/config.h" #include #include class RecreateChainDialog : public QuestionDialog { public: - RecreateChainDialog (wxWindow* parent); + RecreateChainDialog (wxWindow* parent, Config::BadSignerChainReason reason); private: void shut_up (wxCommandEvent& ev); + + Config::BadSignerChainReason _reason; };