✨ Check signature status of runtimes, include in report

Seeing some more impersonation runtimes, should at least include them in the report

Author: fredemmott

src/APILayerDetails.cpp

@@ -121,7 +121,7 @@ APILayerDetails::APILayerDetails(const std::filesystem::path& jsonPath) {
   } catch (const std::filesystem::filesystem_error&) {
   }
 
-  mSignature = platform.GetAPILayerSignature(mLibraryPath);
+  mSignature = platform.GetSharedLibrarySignature(mLibraryPath);
 
   mState = State::Loaded;
 }

src/Platform.cpp

@@ -18,9 +18,9 @@ std::optional<Runtime> GetRuntimeFromPath(const std::filesystem::path& path) {
   return Runtime(path);
 }
 
-std::expected<std::string, Runtime::ManifestError> GetRuntimeName(
-  const std::filesystem::path& path) {
-  using enum Runtime::ManifestError;
+std::expected<Runtime::ManifestData, Runtime::ManifestData::Error>
+GetRuntimeManifestData(const std::filesystem::path& path) {
+  using enum Runtime::ManifestData::Error;
   try {
     if (!std::filesystem::exists(path)) {
       return std::unexpected {FileNotFound};
@@ -32,11 +32,31 @@ std::expected<std::string, Runtime::ManifestError> GetRuntimeName(
     }
 
     const auto json = nlohmann::json::parse(f);
-    if (json.contains("runtime") && json.at("runtime").contains("name")) {
-      return json.at("runtime").at("name");
+    if (!json.contains("runtime")) {
+      return std::unexpected {InvalidJson};
     }
+    const auto& data = json.at("runtime");
 
-    return std::unexpected {FieldNotPresent};
+    Runtime::ManifestData ret {};
+    if (data.contains("name")) {
+      ret.mName = data.at("name");
+    }
+    if (data.contains("library_path")) {
+      const std::filesystem::path libraryPath {
+        data.at("library_path").get<std::string>()};
+      if (libraryPath.is_absolute()) {
+        ret.mLibraryPath = libraryPath;
+      } else {
+        ret.mLibraryPath = weakly_canonical(path.parent_path() / libraryPath);
+      }
+    }
+
+    if ((!ret.mLibraryPath.empty()) && exists(ret.mLibraryPath)) {
+      ret.mLibrarySignature
+        = Platform::Get().GetSharedLibrarySignature(ret.mLibraryPath);
+    }
+
+    return ret;
   } catch (const std::filesystem::filesystem_error&) {
     return std::unexpected {FileNotReadable};
   } catch (const nlohmann::json::exception&) {
@@ -48,7 +68,7 @@ std::expected<std::string, Runtime::ManifestError> GetRuntimeName(
 
 Runtime::Runtime(const std::filesystem::path& path)
   : mPath(path),
-    mName(GetRuntimeName(path)) {}
+    mManifestData(GetRuntimeManifestData(path)) {}
 
 AvailableRuntime::AvailableRuntime(
   const std::filesystem::path& path,

src/Platform.hpp

@@ -25,18 +25,25 @@ struct DPIChangeInfo {
 };
 
 struct Runtime {
-  enum class ManifestError {
-    FileNotFound,
-    FileNotReadable,
-    InvalidJson,
-    FieldNotPresent,
+  struct ManifestData {
+    enum class Error {
+      FileNotFound,
+      FileNotReadable,
+      InvalidJson,
+    };
+    // Defaults to mLibrarypath if not set
+    std::string mName;
+    std::filesystem::path mLibraryPath;
+    std::expected<APILayerSignature, APILayerSignature::Error>
+      mLibrarySignature;
   };
 
   Runtime() = delete;
   explicit Runtime(const std::filesystem::path& path);
 
   std::filesystem::path mPath;
-  std::expected<std::string, ManifestError> mName;
+
+  std::expected<ManifestData, ManifestData::Error> mManifestData;
 };
 
 struct AvailableRuntime : Runtime {
@@ -67,7 +74,7 @@ class Platform {
     const std::filesystem::path& path) = 0;
 
   virtual std::expected<APILayerSignature, APILayerSignature::Error>
-  GetAPILayerSignature(const std::filesystem::path&) = 0;
+  GetSharedLibrarySignature(const std::filesystem::path&) = 0;
   virtual std::expected<LoaderData, LoaderData::Error> GetLoaderData(
     Architecture) = 0;
   virtual std::expected<LoaderData, LoaderData::Error> WaitForLoaderData(

src/SaveReport.cpp

@@ -154,23 +154,32 @@ static std::string GenerateActiveRuntimeText(
   if (!runtime) {
     return std::format("❌ Active {} runtime: NONE\n", archName);
   }
-
-  if (!runtime->mName) {
-    if (runtime->mName.error() != Runtime::ManifestError::FieldNotPresent) {
-      return std::format(
-        "🚨 Active {} runtime: CORRUPTED - {}\n",
-        archName,
-        runtime->mPath.string());
-    }
+  const auto manifest = runtime->mManifestData;
+  if (!manifest) {
     return std::format(
-      "✅ Active {} runtime: {}\n", archName, runtime->mPath.string());
+      "❌ Invalid {} manifest at `{}`: {}\n",
+      archName,
+      runtime->mPath.string(),
+      magic_enum::enum_name(manifest.error()));
+  }
+
+  std::string out = runtime->mPath.string();
+  if (manifest->mName != runtime->mPath) {
+    out += std::format(" ()", manifest->mName);
+  }
+
+  bool ok = true;
+  if (manifest->mLibrarySignature) {
+    out += fmt::format(
+      " (signed by '{}')", manifest->mLibrarySignature->mSignedBy);
+  } else {
+    ok = false;
+    out += fmt::format(
+      " - 🚨 bad signature: {}",
+      magic_enum::enum_name(manifest->mLibrarySignature.error()));
   }
 
-  return std::format(
-    "✅ Active {} runtime: \"{}\" - {}\n",
-    archName,
-    runtime->mName.value(),
-    runtime->mPath.string());
+  return std::format("{} {}\n", ok ? "✅" : "🚨", out);
 }
 
 static std::string GenerateAvailableRuntimesText(
@@ -183,26 +192,17 @@ static std::string GenerateAvailableRuntimesText(
   }
 
   for (auto&& runtime: runtimes) {
-    if (runtime.mName) {
+    if (!runtime.mManifestData) {
       ret += fmt::format(
-        "  - \"{}\" - {}", runtime.mName.value(), runtime.mPath.string());
-    } else {
-      using enum Runtime::ManifestError;
-      switch (runtime.mName.error()) {
-        case FieldNotPresent:
-          ret += fmt::format("  - {}", runtime.mPath.string());
-          break;
-        case FileNotFound:
-          ret += fmt::format("  - ❌ FILE MISSING: {}", runtime.mPath.string());
-          break;
-        case FileNotReadable:
-        case InvalidJson:
-          ret += fmt::format(
-            "  - ❌ FILE NOT READABLE: {}", runtime.mPath.string());
-          break;
-      }
+        "  - ❌ {}: 🚨 {}\n",
+        runtime.mPath.string(),
+        magic_enum::enum_name(runtime.mManifestData.error()));
+      continue;
     }
 
+    ret += fmt::format(
+      "  - \"{}\" - {}", runtime.mManifestData->mName, runtime.mPath.string());
+
     switch (runtime.mDiscoverability) {
       case AvailableRuntime::Discoverability::Discoverable:
         ret += " (discoverable)\n";

src/linters/SkippedByLoaderLinter.cpp

@@ -33,8 +33,13 @@ class SkippedByLoaderLinter final : public Linter {
     }
 
     const auto runtime = Platform::Get().GetActiveRuntime();
-    const auto runtimeString
-      = runtime ? runtime->mName.value_or(runtime->mPath.string()) : "NONE";
+    if (!runtime) {
+      return;
+    }
+    const auto runtimeManifest = runtime->mManifestData;
+    if (!runtimeManifest) {
+      return;
+    }
 
     for (const auto& [layer, details]: layers) {
       if (details.mState != APILayerDetails::State::Loaded) {
@@ -75,7 +80,7 @@ class SkippedByLoaderLinter final : public Linter {
             fmt::format(
               "Layer `{}` is blocked by your current OpenXR runtime ('{}')",
               layer.mManifestPath.string(),
-              runtimeString),
+              runtimeManifest->mName),
             LayerKeySet {layer});
           continue;
         }
@@ -86,7 +91,7 @@ class SkippedByLoaderLinter final : public Linter {
           "Layer `{}` appears enabled, but is not loaded by OpenXR; it may "
           "be blocked by your OpenXR runtime ('{}')",
           layer.mManifestPath.string(),
-          runtimeString),
+          runtimeManifest->mName),
         LayerKeySet {layer});
     }
   }

src/linters/windows/ViveLayersLinter.cpp

@@ -23,15 +23,18 @@ class ViveLayersLinter final : public Linter {
     if (!runtime) {
       return {};
     }
-    if (runtime->mName == "SteamVR") {
+    const auto runtimeManifest = runtime->mManifestData;
+    if (!runtimeManifest) {
       return {};
     }
-    if (runtime->mName == "VIVE_OpenXR") {
+    if (runtimeManifest->mName == "SteamVR") {
+      return {};
+    }
+    if (runtimeManifest->mName == "VIVE_OpenXR") {
       // Included with ViveConsole from Steam, but not registered by default.
       // Just used for the Vive Focus and Cosmos
       return {};
     }
-    const auto runtimeName = runtime->mName.value_or(runtime->mPath.string());
 
     static const std::unordered_set<std::string_view> LayerNames {
       "XR_APILAYER_VIVE_MR",
@@ -56,7 +59,7 @@ class ViveLayersLinter final : public Linter {
             "currently using '{}'; this can cause game crashes or other "
             "issues.",
             details.mName,
-            runtimeName),
+            runtimeManifest->mName),
           layer));
     }
     return ret;

src/windows/CheckForUpdates.cpp

@@ -84,7 +84,7 @@ AutoUpdateProcess CheckForUpdates() {
     return {};
   }
 
-  if (!Platform::Get().GetAPILayerSignature(updater)) {
+  if (!Platform::Get().GetSharedLibrarySignature(updater)) {
     MessageBoxW(
       nullptr,
       L"The auto-updater has been tampered with; you should check your system "

src/windows/WindowsPlatform.cpp

@@ -381,7 +381,8 @@ std::filesystem::file_time_type WindowsPlatform::GetFileChangeTime(
 }
 
 std::expected<APILayerSignature, APILayerSignature::Error>
-WindowsPlatform::GetAPILayerSignature(const std::filesystem::path& dllPath) {
+WindowsPlatform::GetSharedLibrarySignature(
+  const std::filesystem::path& dllPath) {
   using enum APILayerSignature::Error;
   if (!std::filesystem::exists(dllPath)) {
     return std::unexpected {FilesystemError};
@@ -898,7 +899,8 @@ WindowsPlatform::SpawnLoaderData(
     return std::unexpected {
       LoaderData::CanNotFindHelperExecutableError {helper}};
   }
-  if (const auto signature = Get().GetAPILayerSignature(helper); !signature) {
+  if (const auto signature = Get().GetSharedLibrarySignature(helper);
+      !signature) {
     constexpr auto AllowUnsigned =
 #ifdef ALLOW_UNSIGNED_LOADER_DATA_HELPERS
       true;

src/windows/WindowsPlatform.hpp

@@ -40,7 +40,7 @@ class WindowsPlatform final : public Platform {
     const std::filesystem::path& path) override;
 
   std::expected<APILayerSignature, APILayerSignature::Error>
-  GetAPILayerSignature(const std::filesystem::path&) override;
+  GetSharedLibrarySignature(const std::filesystem::path&) override;
 
   std::vector<std::string> GetEnabledExplicitAPILayers() override;
   std::optional<std::vector<std::filesystem::path>> GetOverridePaths()