Repository navigation
Conversation
Valve signed older steam_api64.dll builds with a VeriSign Class 3 Code Signing 2010 CA certificate that chains to VeriSign Class 3 Public Primary Certification Authority - G5. macOS 27 no longer ships that root, and Wine fills its root store from the host, so WinVerifyTrust on those DLLs fails with CERT_E_UNTRUSTEDROOT. Metal Gear Solid V: The Phantom Pain checks its steam_api64.dll this way and quits before loading steamclient64.dll. Write the root into the prefix's Root store in the settings import when it is missing. Wine only drops roots it imported from the host, so it stays. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner
|
Hi. Why did you close this? |
Author
|
Hi. I think it has been reported on Wine and CrossOver. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Metal Gear Solid V: The Phantom Pain quit a few seconds after start, before it loaded steamclient64.dll. With WINEDEBUG=+wintrust, the game calls WinVerifyTrust on its own steam_api64.dll and gets 0x800b0109 (CERT_E_UNTRUSTEDROOT).
That DLL was signed by Valve in 2015. The chain is Valve -> VeriSign Class 3 Code Signing 2010 CA -> VeriSign Class 3 Public Primary Certification Authority - G5 (SHA-1 4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5, valid to 2036). macOS 27 has no VeriSign roots left in SystemRootCertificates.keychain, and Wine builds the prefix Root store from the host, so the chain stops at an untrusted root. Windows still trusts G5.
This adds the root to the settings .reg that compat_run.sh already imports, only when system.reg doesn't have it yet. Wine's root sync only deletes certificates listed under HostImportedCertificates, so the added root stays across launches.
Tested:
reg importof the generated lines into a fresh CrossOver 26.3 prefix stores a blob identical to the certificate's (1283 bytes), and the next launch writes nothing.Open question: browsers distrusted Symantec-era roots like G5 for TLS, and here it is trusted for every purpose inside the prefix. I can limit it to code signing with an enhanced key usage property if you prefer.
🤖 Generated with Claude Code