bugGNU Octave - Bugs: bug #57649, [MXE Octave] Sign Windows...

 
 

bug #57649: [MXE Octave] Sign Windows installer with trusted certificate

Submitted by:  Markus Mützel <mmuetzel>
Submitted on:  Tue 21 Jan 2020 03:27:13 PM UTC  
 
Category:  Configuration and Build System Severity:  1 - Wish
Priority:  3 - Low Item Group:  None
Status:  None Assigned to:  None
Originator Name:  Open/Closed:  Open
Release:  dev Operating System:  Microsoft Windows

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

( Jump to the original submission)

Sat 08 Feb 2020 09:43:40 AM UTC, comment #7: 

The process of creating a certificate and signing the installer is very easy.
However, it doesn't make a difference: I had to pass the installer through an FTP server for the message to actually trigger.
The installer is definitely signed, and it is possible to inspect the signature using the file properties in the right click menu (see attached screenshot).
However, as expected, there is a message telling something along the lines of "The certificate chain could be successfully traversed. However, it ended at a root certificate that isn't trusted."

The warning message that is displayed when trying to use the installer is still the same.

There is still the possibility that even the self signed certificate could gain trust over time. But I haven't found an "official" source confirming that this is the case.


Markus Mützel <mmuetzel>
Project Member
Wed 05 Feb 2020 05:58:26 PM UTC, comment #6: 

Maybe you could try installing a self-signed application and see if that dialog is any less scary. My guess is it would look similar to what browsers show for self-signed web sites. Something like "This application is signed by an untrusted certificate. Do you want to accept this certificate? View certificate details..." It might be just as scary as an unsigned application.

Mike Miller <mtmiller>
Project Administrator
Wed 05 Feb 2020 01:59:36 PM UTC, comment #5: 

Fwiw, attached are the dialogues that display when executing the unsigned Windows installer (albeit on a German locale).
The text translates approximately to:

> The computer was protected by Windows
> The Windows Defender SmartScreen prevented the start of an unknown app. The execution of the app might represent a risk to the PC.
> More information
> "Don't execute"


And in the second window:

> App: octave-5.2.0-w64-installer.exe
> Author: Unknown Author
> "Execute anyway"  "Don't execute"


An unwary user would probably not realize that they need to click on the underlined text (More information) in the first window to get the option to execute the installer anyway in the second window.

This resource [1] suggests that even a self-signed executable can gain trust over time. I don't know if this is true.
It also gives step-by-step instructions on how to sign a Windows executable with Linux tools.
Maybe we should give it a try?

[1]: https://reiners.io/signing-windows-applications-from-linux/


Markus Mützel <mmuetzel>
Project Member
Fri 31 Jan 2020 07:17:58 PM UTC, comment #4: 

So this signing key is basically like an EV certificate purchased from a CA. Yeah, I don't think we are interested in pursuing that.

We do sign all official releases with OpenPGP signatures. It would be nice if Microsoft gave the user the option of installing trusted public keys to verify when installing programs.

Mike Miller <mtmiller>
Project Administrator
Mon 27 Jan 2020 12:18:23 PM UTC, comment #3: 

It should be possible to use tools from the Mono Project to sign the installer. Most parts of the Mono Project are distributed under the MIT license. [1]
I don't know if this is considered to be a "free" license by GNU.

Having said that: The code signing certificate itself is not free (of charge). I only found offers that start at above €100 for one year. [2]

If we don't have a certificate already, I don't think it is worth following up on this.

[1]: https://www.mono-project.com/docs/faq/licensing/
[2]: https://en.sklep.certum.pl/standard-code-signing.html

Markus Mützel <mmuetzel>
Project Member
Tue 21 Jan 2020 06:47:35 PM UTC, comment #2: 

I doubt that this can be solved without relying on non-free Microsoft tools. The purpose of the Windows build of Octave is to use entirely free tools to build a free distribution that happens to run on an unfortunate non-free operating system.

Mike Miller <mtmiller>
Project Administrator
Tue 21 Jan 2020 03:30:00 PM UTC, comment #1: 

Lowering priority.

Markus Mützel <mmuetzel>
Project Member
Tue 21 Jan 2020 03:27:13 PM UTC, original submission:  

When using the NSIS installers on Windows 10, a prominent message pops up warning the user that they shouldn't trust unsigned files downloaded from the internet.

Maybe these MS resources [1] help to understand how the installer could be signed.
I don't know whether we would have access to a trusted certificate though. Do we? (Maybe via GNU?)

This question and answers on stack overflow [2] might also be useful.

[1]: https://docs.microsoft.com/en-us/windows/win32/msi/digital-signatures-and-windows-installer
[2:]: https://stackoverflow.com/questions/252226/signing-a-windows-exe-file

Markus Mützel <mmuetzel>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by alexais (Updated the item)
  • -email is unavailable- added by mmuetzel (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only project members can vote.

     

     

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-02-08 mmuetzel Attached File- => Added bug57649_signature_details.png, #48373
    2020-02-05 mmuetzel Attached File- => Added installer_not_signed_1.png, #48352
        Attached File- => Added installer_not_signed_2.png, #48353
    2020-01-21 mtmiller Attached File#48264 => Removed
    2020-01-21 alexais Attached File- => Added office@setup.jpg, #48264
    2020-01-21 mmuetzel Severity3 - Normal => 1 - Wish
        Priority5 - Normal => 3 - Low

    Back to the top


    Powered by Savane 3.5