From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from sa-prd-fep-045.btinternet.com (mailomta10-sa.btinternet.com [213.120.69.16]) by sourceware.org (Postfix) with ESMTPS id 70A903858D32 for ; Sun, 20 Nov 2022 17:17:19 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 70A903858D32 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=dronecode.org.uk Authentication-Results: sourceware.org; spf=none smtp.mailfrom=dronecode.org.uk Received: from sa-prd-rgout-005.btmx-prd.synchronoss.net ([10.2.38.8]) by sa-prd-fep-045.btinternet.com with ESMTP id <20221120171718.WRBM5235.sa-prd-fep-045.btinternet.com@sa-prd-rgout-005.btmx-prd.synchronoss.net>; Sun, 20 Nov 2022 17:17:18 +0000 Authentication-Results: btinternet.com; auth=pass (PLAIN) smtp.auth=jonturney@btinternet.com; bimi=skipped X-SNCR-Rigid: 6139452E444B51A2 X-Originating-IP: [81.153.98.246] X-OWM-Source-IP: 81.153.98.246 (GB) X-OWM-Env-Sender: jonturney@btinternet.com X-VadeSecure-score: verdict=clean score=0/300, class=clean X-RazorGate-Vade: gggruggvucftvghtrhhoucdtuddrgedvgedrheeggdejgecutefuodetggdotefrodftvfcurfhrohhfihhlvgemuceutffkvffkuffjvffgnffgvefqofdpqfgfvfenuceurghilhhouhhtmecufedtudenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhepkfffgggfhffuvfhfjggtgfesthejredttdefjeenucfhrhhomheplfhonhcuvfhurhhnvgihuceojhhonhdrthhurhhnvgihsegurhhonhgvtghouggvrdhorhhgrdhukheqnecuggftrfgrthhtvghrnhepgeetjeeuveegheffudekgeffudfhhfetffehheejvdeffefgkefflefgtdetleegnecukfhppeekuddrudehfedrleekrddvgeeinecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehhvghloheplgduledvrdduieekrddurddutdeingdpihhnvghtpeekuddrudehfedrleekrddvgeeipdhmrghilhhfrhhomhepjhhonhdrthhurhhnvgihsegurhhonhgvtghouggvrdhorhhgrdhukhdpnhgspghrtghpthhtohepvddprhgtphhtthhopegthihgfihinhestgihghifihhnrdgtohhmpdhrtghpthhtohepuggrlhgvshhtrghnsehgmhgrihhlrdgtohhm X-RazorGate-Vade-Verdict: clean 0 X-RazorGate-Vade-Classification: clean Received: from [192.168.1.106] (81.153.98.246) by sa-prd-rgout-005.btmx-prd.synchronoss.net (5.8.716.04) (authenticated as jonturney@btinternet.com) id 6139452E444B51A2; Sun, 20 Nov 2022 17:17:18 +0000 Message-ID: <64eb894e-0bce-2e68-3e8b-a8cd69711514@dronecode.org.uk> Date: Sun, 20 Nov 2022 17:17:18 +0000 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.5.0 From: Jon Turney Subject: Re: Adding an embedded signature on setup-x86_64.exe To: Dale McCoy , The Cygwin Mailing List References: Content-Language: en-GB In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-3570.0 required=5.0 tests=BAYES_00,FORGED_SPF_HELO,KAM_DMARC_STATUS,KAM_LAZY_DOMAIN_SECURITY,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,SPF_HELO_PASS,SPF_NONE,TXREP autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On 18/11/2022 21:15, Dale McCoy wrote: > I use Cygwin in the course of work, and while I can use the external gpg > signature to verify the validity of setup-x86_64.exe, my IT department > can't see that step. They get somewhat concerned when they see that Windows > thinks setup-x86_64.exe is unsigned, and I certainly don't blame them. > Can I convince you to also embed a signature in the installer, so Windows > recognizes the file is signed? This something I'd like to do, but unfortunately, the remaining blocking issues are not technical. In order to sign the code in this way, the key needs to be signed by a CA that participates in Microsoft Trusted Root Program. These CAs charge an annual fee. As the person who makes the setup releases, I'm not going to pay that out of my own pocket, and we currently have no organization to collect donations for that (or any other) purpose.