[
https://issues.apache.org/jira/browse/DAFFODIL-3090?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Olabusayo Kilo reassigned DAFFODIL-3090:
----------------------------------------
Assignee: Olabusayo Kilo
> Sign Windows exe installer
> --------------------------
>
> Key: DAFFODIL-3090
> URL: https://issues.apache.org/jira/browse/DAFFODIL-3090
> Project: Daffodil
> Issue Type: Improvement
> Components: Infrastructure
> Reporter: Steve Lawrence
> Assignee: Olabusayo Kilo
> Priority: Minor
> Fix For: 4.3.0
>
>
> Daffodil currently signs all release artifacts using detached signatures, as
> required by ASF.
> Additionally, for RPM we embed signatures in th e RPM file, which improves
> integration and signature validation with things like DNF.
> But we do not embed signatures in our EXE windows installer. This results in
> an "Unknown Publisher" warning when installing the executable. Users are
> allowed to accept this risk and continue to install anyways, but it would be
> nice it we could avoid this and it would instead show up as a trusted Apache
> Software Foundation publisher.
> Apache INFRA allows use of ssl.com for embedding signatures in exe files:
> https://infra.apache.org/code-signing-use.html.
> We should see about enabling this process. I believe the tasks to complete
> this are:
> 1. Open a ticket with INFRA to add ssl.com credentials to our repositories as
> secrets (note that this is different than what the above link recommends
> about each release manager creating an account, but because Daffodil has been
> approved to use [automated release
> signing|https://infra.apache.org/release-signing.html#automated-release-signing]
> hopefully infra can do the same thing with ssl.com credentials).
> 2. Update our release candidate action to use those secrets to sign our exe
> files using jsign (we may need to download and install jsign as part of the
> action)
> 3. Update the daffodil release-candidate workflow to provide the secrets to
> the action
> 4. Update the check-release script to strip the exe signatures during
> reproducibility checks (similar to what we already do for RPM)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
