Repository navigation
Feature request: We should sign our official releases #711
Description
We should probably sign our official releases for OSX and Windows, to minimise potential weirdness that can arise from OS warnings about unknown software".
This kind of warning popped up on Windows a while back (3.6.0v2 release), and at least one person has mentioned they have problems on OSX due to us not signing our application.
Useful relevant information here for OSX:
https://successfulsoftware.net/2014/10/17/signing-qt-applications-for-mac-os-x-10-9-5-and-10-10/
Activity
glawrence commentedon Aug 6, 2016
You link to issue #284 is broken by the way
justinclift commentedon Aug 6, 2016
Oops, thanks @glawrence. Fixed. 😄
glawrence commentedon Aug 8, 2016
When I looked into this before I did find some free code signing certificates for open source projects, so GlobalSign for example. They have been doing so since June 2013. They also provide one certificate that work across platforms.
The other task is to but the code signing step into the build process and consider if the nightly builds need this.
justinclift commentedon Aug 8, 2016
Cool, that's good info. 😄
justinclift commentedon Aug 20, 2016
Relevant reference info for Windows:
GlobalSign page where MS Authenticode compatible certificates can be bought:
Although places are giving free SSL certificates to Open Source projects, there doesn't seem to be a similar offering in place for MS Authenticate cert's.
The screenshots here show than even signed files gets warning messages on them, it's only "EV" signed ones (~$US500/yr) which don't:
That seems fairly scammy. 😦
From the author of the screenshots above:
justinclift commentedon Aug 20, 2016
It seems like some "code signing certificates" can be used for both Windows & OSX signing.
https://www.sslshopper.com/cheap-code-signing-certificates.html
Choosing one of those might be useful.
justinclift commentedon Aug 20, 2016
Cheapest option for signing on Windows so far seems to be US$84, through kSoftware:
http://codesigning.ksoftware.net
It's a US business, with a link to the US "Better Business Bureau" on their website, with no complaints. So... might be workable.
justinclift commentedon Aug 20, 2016
Certum has an "OpenSource Code Signing" thing:
http://www.certum.eu/certum/cert,offer_code_signing.xml
At first look, it seems cheap at 14 euro's. It doesn't actually seem to do anything useful though, as their certificates aren't something which MS Authenticode can use.
Certum does offer Authenticode certificates... but they're ~200 euro. Eg, it sounds like a scam for getting traffic 😦
justinclift commentedon Aug 20, 2016
Useful info:
5 remaining items
justinclift commentedon Aug 21, 2016
It's taken some doing, but I think signing on OSX is working ok.
If anyone on OSX has a few minutes to try it, please grab this latest build (3.9.x series) and test if OSX throws up a warning when trying to run it:
http://nightlies.sqlitebrowser.org/osx-prerelease/DB%20Browser%20for%20SQLite-3.9.0-beta2.dmg
If it does... looks like I still have more stuff to figure out. 😉
justinclift commentedon Aug 21, 2016
The nightly build script for OSX has been updated with the signing pieces too, so (in theory) all of our OSX nightly builds should now "just work" without any "unsigned application" type of warning.
revolter commentedon Aug 22, 2016
Following these steps:
.dmg.appto theDownloadsfolder.appshows this alert:
This is the alert that should have been gone, right? Could it be because I didn't move it to the
Applicationsfolder (though unlikely)?justinclift commentedon Aug 22, 2016
Nah, that's a different warning. Not sure if that one's even possible to get rid of.
The warning being discussed here is the "Gatekeeper" one, whose settings are controlled through OSX System Preferences → Security.
Most people seem to change it to "Mac App Store and identified developers", which should make the warning go away for signed applications:
When an unsigned application runs, it gets blocked and this warning pops up:
(that's from an older nightly, before they were automatically signed)
justinclift commentedon Aug 22, 2016
Ugh. I just tried out last night's nightly build. There does seem to be something wrong with it anyway. The .app icon is wrong for starters, and the security certificate doesn't seem ok.
It's probably a good thing that the logs for the nightlies are keep. Will investigate soon. 😄
justinclift commentedon Aug 22, 2016
So, StartCom are not that good. The person doing the "verification" step has a script to follow, and that script requires me to submit a utility bill showing my phone number.
Problem is... none of mine do. I don't like phones, and the area I live in has no mobile service. (I generally consider that a positive thing 😁 )
Bit of an impasse. I've asked them to reach out to their CEO, Eddy Nigg, to intervene. He's been active on the Mozilla mailing lists previously, so he may be able to help (there are people in common we both know, who may be able to vouch for me).
Unlikely to have a result before tomorrow though.
justinclift commentedon Aug 22, 2016
Ok, I think the nightly OSX builds are fixed now. It turns out Debug mode builds don't include the icon. Couldn't find a way to adjust that, so the nightlies are back to using Release mode.
The signing problem seems due to a problem with the way I'd constructed the keychain (where certificates are stored). Moved the certificate to the system keychain... which (in theory) should work. We can check tomorrow to verify that theory == reality in this case. 😄
revolter commentedon Aug 23, 2016
It looks like I already had that setting selected instead of
Anywhere. Tested it with3.8.0and it blocked it, and with beta 2 and it opened it correctly.justinclift commentedon Aug 23, 2016
StartCom have ok'd my validation, so going through the code signing/learning experience for Windows now. 😉
justinclift commentedon Aug 24, 2016
With some assistance from the StartCom online chat staff, it's done. 😄
Closing this now as both Windows (Win64+Win32) and OSX releases will be signed from here on.
justinclift commentedon Sep 26, 2016
StartCom is in hot water: https://news.ycombinator.com/item?id=12582534
Our already issued certificate(s) will still work, if/when we need stuff from them in future there could be problems.