Root certs are not used on Windows

command_verify.go

@@ -8,11 +8,11 @@ import (
 	"io"
 	"os"
 
-	"github.com/certifi/gocertifi"
 	"github.com/github/ietf-cms"
 	"github.com/pkg/errors"
 )
 
+
 func commandVerify() error {
 	sNewSig.emit()
 
@@ -165,25 +165,20 @@ func verifyDetached() error {
 }
 
 func verifyOpts() x509.VerifyOptions {
-	roots, err := x509.SystemCertPool()
-	if err != nil {
-		// SystemCertPool isn't implemented for Windows. fall back to mozilla trust
-		// store.
-		roots, err = gocertifi.CACerts()
-		if err != nil {
-			// Fall back to an empty store. Verification will likely fail.
-			roots = x509.NewCertPool()
-		}
-	}
+	var (
+		roots *x509.CertPool
+	)
 
-	for _, ident := range idents {
-		if cert, err := ident.Certificate(); err == nil {
-			roots.AddCert(cert)
-		}
+	// Depending on the operating system, enumerate the trusted root certificate store
+	err := parseRoots(roots)
+	if err != nil{
+		// Fall back to an empty store. Verifications will likely fail.
+		roots = x509.NewCertPool()
 	}
 
 	return x509.VerifyOptions{
 		Roots:     roots,
 		KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
 	}
 }
+

parse_roots.go

@@ -0,0 +1,22 @@
+// +build !windows
+
+package main
+
+import (
+	"crypto/x509"
+	"github.com/pkg/errors"
+)
+
+func parseRoots(roots *x509.CertPool ) error{
+	roots, err := x509.SystemCertPool()
+	if err != nil {
+		return errors.Wrap(err, "Failed to parse root store")
+	}
+
+	for _, ident := range idents {
+		if cert, err := ident.Certificate(); err == nil {
+			roots.AddCert(cert)
+		}
+	}
+	return nil
+}

parse_roots_windows.go

@@ -0,0 +1,65 @@
+// +build windows
+
+package main
+
+import (
+	"crypto/x509"
+	"github.com/certifi/gocertifi"
+	"github.com/pkg/errors"
+	"syscall"
+	"unsafe"
+)
+
+const (
+	CryptENotFound = 0x80092004
+)
+
+func parseRoots(roots *x509.CertPool) error{
+
+	// The windows trust store is dynamically populated, to prevent issues with generally trusted
+	// roots not being enumerated, use the mozilla trust store as a baseline
+	roots, err := gocertifi.CACerts()
+	if err != nil {
+		roots = x509.NewCertPool()
+	}
+
+	// Enumerate the local machine trust store and add any missing certificates.
+	storeName, err:= syscall.UTF16PtrFromString("Root")
+	if err != nil {
+		return errors.Wrap(err, "Failed to get root store name")
+	}
+	storeHandle, err := syscall.CertOpenSystemStore(0, storeName)
+	if err != nil {
+		return errors.New(syscall.GetLastError().Error())
+	}
+	defer syscall.CertCloseStore(storeHandle, 0)
+
+	var cert *syscall.CertContext
+	for {
+		cert, err = syscall.CertEnumCertificatesInStore(storeHandle, cert)
+		if err != nil {
+			if errno, ok := err.(syscall.Errno); ok {
+				if errno == CryptENotFound {
+					break
+				}
+			}
+			return errors.New(syscall.GetLastError().Error())
+		}
+		if cert == nil {
+			break
+		}
+		// Copy the buf, since ParseCertificate does not create its own copy.
+		buf := (*[1 << 20]byte)(unsafe.Pointer(cert.EncodedCert))[:]
+		buf2 := make([]byte, cert.Length)
+		copy(buf2, buf)
+		if c, err := x509.ParseCertificate(buf2); err == nil {
+			// AddCert contains logic to prevent adding a duplicate certificate to the pool
+			roots.AddCert(c)
+		}
+	}
+
+
+
+
+	return nil
+}