bugGNU Octave - Bugs: bug #57649, [MXE Octave] Sign Windows...

 
 

bug #57649: [MXE Octave] Sign Windows installer with trusted certificate

Submitter:  Markus Mützel <mmuetzel>
Submitted:  Tue 21 Jan 2020 03:27:13 PM UTC
   
 
Category:  Configuration and Build System Severity:  1 - Wish
Priority:  3 - Low Item Group:  None
Status:  None Assigned to:  None
Originator Name:  Open/Closed:  * Open
Release:  * dev Operating System:  * Microsoft Windows
Fixed Release:  None Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sat 08 Feb 2020 09:43:40 AM UTC, comment #7: 

The process of creating a certificate and signing the installer is very easy.
However, it doesn't make a difference: I had to pass the installer through an FTP server for the message to actually trigger.
The installer is definitely signed, and it is possible to inspect the signature using the file properties in the right click menu (see attached screenshot).
However, as expected, there is a message telling something along the lines of "The certificate chain could be successfully traversed. However, it ended at a root certificate that isn't trusted."

The warning message that is displayed when trying to use the installer is still the same.

There is still the possibility that even the self signed certificate could gain trust over time. But I haven't found an "official" source confirming that this is the case.


Markus Mützel <mmuetzel>
Group administrator
Wed 05 Feb 2020 05:58:26 PM UTC, comment #6: 

Maybe you could try installing a self-signed application and see if that dialog is any less scary. My guess is it would look similar to what browsers show for self-signed web sites. Something like "This application is signed by an untrusted certificate. Do you want to accept this certificate? View certificate details..." It might be just as scary as an unsigned application.

Mike Miller <mtmiller>
Group Member
Wed 05 Feb 2020 01:59:36 PM UTC, comment #5: 

Fwiw, attached are the dialogues that display when executing the unsigned Windows installer (albeit on a German locale).
The text translates approximately to:

> The computer was protected by Windows
> The Windows Defender SmartScreen prevented the start of an unknown app. The execution of the app might represent a risk to the PC.
> More information
> "Don't execute"


And in the second window:

> App: octave-5.2.0-w64-installer.exe
> Author: Unknown Author
> "Execute anyway"  "Don't execute"


An unwary user would probably not realize that they need to click on the underlined text (More information) in the first window to get the option to execute the installer anyway in the second window.


This resource [1] suggests that even a self-signed executable can gain trust over time. I don't know if this is true.
It also gives step-by-step instructions on how to sign a Windows executable with Linux tools.
Maybe we should give it a try?

[1]: https://reiners.io/signing-windows-applications-from-linux/


Markus Mützel <mmuetzel>
Group administrator
Fri 31 Jan 2020 07:17:58 PM UTC, comment #4: 

So this signing key is basically like an EV certificate purchased from a CA. Yeah, I don't think we are interested in pursuing that.

We do sign all official releases with OpenPGP signatures. It would be nice if Microsoft gave the user the option of installing trusted public keys to verify when installing programs.

Mike Miller <mtmiller>
Group Member
Mon 27 Jan 2020 12:18:23 PM UTC, comment #3: 

It should be possible to use tools from the Mono Project to sign the installer. Most parts of the Mono Project are distributed under the MIT license. [1]
I don't know if this is considered to be a "free" license by GNU.

Having said that: The code signing certificate itself is not free (of charge). I only found offers that start at above €100 for one year. [2]

If we don't have a certificate already, I don't think it is worth following up on this.

[1]: https://www.mono-project.com/docs/faq/licensing/
[2]: https://en.sklep.certum.pl/standard-code-signing.html

Markus Mützel <mmuetzel>
Group administrator
Tue 21 Jan 2020 06:47:35 PM UTC, comment #2: 

I doubt that this can be solved without relying on non-free Microsoft tools. The purpose of the Windows build of Octave is to use entirely free tools to build a free distribution that happens to run on an unfortunate non-free operating system.

Mike Miller <mtmiller>
Group Member
Tue 21 Jan 2020 03:30:00 PM UTC, comment #1: 

Lowering priority.

Markus Mützel <mmuetzel>
Group administrator
Tue 21 Jan 2020 03:27:13 PM UTC, original submission:  

When using the NSIS installers on Windows 10, a prominent message pops up warning the user that they shouldn't trust unsigned files downloaded from the internet.

Maybe these MS resources [1] help to understand how the installer could be signed.
I don't know whether we would have access to a trusted certificate though. Do we? (Maybe via GNU?)

This question and answers on stack overflow [2] might also be useful.

[1]: https://docs.microsoft.com/en-us/windows/win32/msi/digital-signatures-and-windows-installer
[2:]: https://stackoverflow.com/questions/252226/signing-a-windows-exe-file

Markus Mützel <mmuetzel>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by alexais (Updated the item)
  • -email is unavailable- added by mmuetzel (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-02-08 mmuetzel Attached File- Added bug57649_signature_details.png, #48373
    2020-02-05 mmuetzel Attached File- Added installer_not_signed_1.png, #48352
        Attached File- Added installer_not_signed_2.png, #48353
    2020-01-21 mtmiller Attached File#48264 Removed
    2020-01-21 alexais Attached File- Added office@setup.jpg, #48264
    2020-01-21 mmuetzel Severity3 - Normal 1 - Wish
        Priority5 - Normal 3 - Low

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code