From: Jon TURNEY <jon.turney@dronecode.org.uk>
To: cygwin@cygwin.com
Cc: dwheeler@dwheeler.com
Subject: Re: Should cygwin's setup*.exe be signed using Sign Tool?
Date: Thu, 09 Apr 2015 13:05:00 -0000 [thread overview]
Message-ID: <55267923.7070601@dronecode.org.uk> (raw)
In-Reply-To: <E1Ydjc5-0000kv-WD@rmm6prod02.runbox.com>
On 02/04/2015 19:13, David A. Wheeler wrote:
> Running setup*.exe produces "Publisher: Unknown publisher", and it's doubtful that many people check the signature of the .exe file before running. Even if they did, there's the problem that the signature comes from the same place.
>
> Has Cygwin considered signing the installer using Sign Tool? More info:
> https://msdn.microsoft.com/en-us/library/windows/desktop/aa387764%28v=vs.85%29.aspx
> http://blog.didierstevens.com/2008/12/31/howto-add-a-digital-signature-to-executables/
>
> I believe signing it this way would eliminate the "unknown publisher"; it would also protect the many people who don't follow the current signature-checking process. This would create a strong barrier against code subversion after release.
>
> The signed executable could also be signed using the current process, so you don't need to *eliminate* any capability. I can't provide a patch to do this, obviously :-).
I don't think this is obvious at all. You can't provide the
certificate, but you can provide a patch.
However, saying "install Windows SDK, use signtool" is not a solution,
for reasons already discussed.
The actual work that needs to be done here is to identify an alternative
open source signing tool and how to use it.
It would be nice to have such a tool packaged for cygwin, as that would
allow people to sign any MinGW-w64 executables they make...
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
next prev parent reply other threads:[~2015-04-09 13:05 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-04-02 18:13 David A. Wheeler
2015-04-02 22:35 ` Andrey Repin
2015-04-03 3:17 ` David A. Wheeler
2015-04-03 1:23 ` Bryan Berns
2015-04-03 3:27 ` David A. Wheeler
2015-04-03 11:37 ` Corinna Vinschen
2015-04-09 13:05 ` Jon TURNEY [this message]
2015-04-09 13:44 ` René Berber
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55267923.7070601@dronecode.org.uk \
--to=jon.turney@dronecode.org.uk \
--cc=cygwin@cygwin.com \
--cc=dwheeler@dwheeler.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).