HLK, what the &*$% is going on?

https://mitra.computa.asia/article/msdn-driver-distribution-change-windows-10-version-1607

So now there is a choice of 1511 or 1607 HLK, and it seems, if I can read this obscure verbage blog, https://mitra.computa.asia/article/msdn-driver-distribution-change-windows-10-version-1607, that you need to run both HLK servers and test off both in order to be able to install on windows 10 1607 and windows 10 1511

Is this true, and does that mean for every new version of windows 10 in the future you need to installa new WLK and run new tests, and then collate the test results to get the driver signed for all platforms?

That would mean one would have to run three H*Ks get a full set of certs
for win7->w16. Somehow I doubt that one needs to run both WLK’s, but I
could be wrong, it has happened. It is annoying enough to have to run both
HCK and HLK.

Mark Roddy

On Mon, Feb 27, 2017 at 7:30 AM, wrote:

> https://mitra.computa.asia/article/msdn-driver-
> distribution-change-windows-10-version-1607
>
> So now there is a choice of 1511 or 1607 HLK, and it seems, if I can read
> this obscure verbage blog, https://mitra.computa.asia/article/msdn-driver-
> distribution-change-windows-10-version-1607, that you need to run both
> HLK servers and test off both in order to be able to install on windows 10
> 1607 and windows 10 1511
>
> Is this true, and does that mean for every new version of windows 10 in
> the future you need to installa new WLK and run new tests, and then
> collate the test results to get the driver signed for all platforms?
>
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: http:> showlists.cfm?list=ntdev>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:></http:>

It seems that after the 90 day limit, you need to run TWO HLK servers, and test in TWO win 10 builds, to support all win 10 builds.

This is what I glean from that blog, though I could be, hope I am, wrong.

The idiocy of “Win10 is the last release of windows” continues.
Now there are two Win10s both named Win10.

“This is my brother Darryl and this is my other brother Darryl”.
Real Life is a parody of vintage sitcoms.

Mark Roddy

On Mon, Feb 27, 2017 at 12:56 PM, wrote:

> It seems that after the 90 day limit, you need to run TWO HLK servers, and
> test in TWO win 10 builds, to support all win 10 builds.
>
> This is what I glean from that blog, though I could be, hope I am, wrong.
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: http:> showlists.cfm?list=ntdev>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:></http:>

> The idiocy of “Win10 is the last release of windows” continues. Now there are two

Win10s both named Win10. “This is my brother Darryl and this is my other brother Darryl”.

Well, I would rather think of the whole thing just in terms of two pieces of turd (I don’t want to offend anyone but this is,objectively,what Windoze is), and, at this point, it starts making sense - although they are “two different instances of the same class” each of them can be described as “a piece of turd”. In fact, I think one can extend this logic to the whole family of Windows NT…

Anton Bassov

@Mark Ha! Exactly, the last windows ever my arse.

Its just windows 10.1607, the major number went minor. What a crock of marketing BS.

Like Windows 10 IoT embedded enterprise. Its got such a big footprint the only thing you can ‘embed’ it in is a plain old desktop!

Tight, so I need to use the 1607 HLK to test a 1607 driver. OK, now for the next confusion.

According to: https://msdn.microsoft.com/en-us/windows/hardware/drivers/dashboard/attestation-s igning-a-kernel-driver-for-public-release

“An attestation signed driver will only work for Windows 10 Desktop. It will not work for other versions of Windows, such as Windows Server 2016,Windows 8.1, or Windows 7.”

I asked xxxxx@microsoft.com and they replied: “Prior to Windows 10, yes you can self sign and install it. In Windows 10, WHQL signing is required.”

I am assuming ‘self sign’ is the same as ‘attestation signed’, and if so the two statements arte contradictory.

Can anyone clarify this?

Regarding “An attestation signed driver will only work for Windows 10 Desktop. It will not work for other versions of Windows, such as Windows Server 2016,Windows 8.1, or Windows 7.”

I have a WFP callout driver which is attestation signed and works fine on Windows 8.0 and 8.1

OK, that agrees with sysdev, as well as what Bill Wandel said in his post on Nano server.

Seems MSFT need to update their link.

xxxxx@hotmail.com wrote:

Tight, so I need to use the 1607 HLK to test a 1607 driver. OK, now for the next confusion.

According to: https://msdn.microsoft.com/en-us/windows/hardware/drivers/dashboard/attestation-s igning-a-kernel-driver-for-public-release

“An attestation signed driver will only work for Windows 10 Desktop. It will not work for other versions of Windows, such as Windows Server 2016,Windows 8.1, or Windows 7.”

I asked xxxxx@microsoft.com and they replied: “Prior to Windows 10, yes you can self sign and install it. In Windows 10, WHQL signing is required.”

I am assuming ‘self sign’ is the same as ‘attestation signed’, and if so the two statements arte contradictory.

Can anyone clarify this?

No. Self signing means you sign it with a certificate that YOU bought,
with YOUR name. Attestation signing means you submit a package to
Microsoft’s dashboard, and they sign the package and the binaries with
THEIR certificate with THEIR name. Very different.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

xxxxx@live.co.uk wrote:

Regarding “An attestation signed driver will only work for Windows 10 Desktop. It will not work for other versions of Windows, such as Windows Server 2016,Windows 8.1, or Windows 7.”

I have a WFP callout driver which is attestation signed and works fine on Windows 8.0 and 8.1

That must mean you are not actually using the driver package to install
it. The attestation signing creates a new CAT file that is valid only
for Windows 10. If you simply use the signing service with a fake INF
to get your driver binaries signed and then install them without using
PnP, it will work, but if it’s a PnP driver, it will not work prior to
Windows 10.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

> That must mean you are not actually using the driver package to install it.
We install using the difx extension in the WiX installer framework. I don’t know how that works under the hood. Also, it is not a pnp driver

J

@Tim, OK, thanks for clarifying that, xxxxx@microsoft.com used the terms interchangably when I emailed them, hence my assumption.

I have asked them to confirm wether attestaion signing is acceptable on windows 10.

And, to be clear, contrary to public ally announced policy, attestation signing DOES work on Server 2016.

Peter
OSR
@OSRDrivers

until it doesn’t of course.

Mark Roddy

On Thu, Mar 2, 2017 at 7:48 AM, wrote:

> And, to be clear, contrary to public ally announced policy, attestation
> signing DOES work on Server 2016.
>
> Peter
> OSR
> @OSRDrivers
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: http:> showlists.cfm?list=ntdev>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:></http:>