X-Recipient: archive-cygwin@delorie.com X-Original-To: cygwin@cygwin.com Delivered-To: cygwin@cygwin.com DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 2049C395447D Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=towo.net Authentication-Results: sourceware.org; spf=none smtp.mailfrom=towo.net Message-ID: Date: Sun, 20 Nov 2022 09:46:28 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.5.0 Subject: Re: Adding an embedded signature on setup-x86_64.exe To: cygwin@cygwin.com References: <5b5164e3-8003-d336-3778-836a1216f863@SystematicSw.ab.ca> From: Thomas Wolff In-Reply-To: <5b5164e3-8003-d336-3778-836a1216f863@SystematicSw.ab.ca> X-Provags-ID: V03:K1:KWeXZq+tDcipVWY42EuQb1Sz0wRvgm4+mAQUtOhna2WbExEHq5x OhwgkT+Z04wKBgXEXopEB6XZbvbDmgvpouASfoxlMXw7n4ARP5j4SVCU0r5qvYCDGNsm1Ih jIpYqh1/I3IeJQjCalqVVDXaZZ6q2MxbjPzcPoaeQuOnGmhy3bBMTX/gjiyfTDdqoti+oI6 MyEu3O6yWR563734MjVAg== X-UI-Out-Filterresults: notjunk:1;V03:K0:D1+/bhPx4wo=:izxMpEWIMtscjx8XShQgXd CMwu/bffLOOafqDlLQYk/I5mlPP0GWpxEQ9AOl1r9KxrNI7Nv/ptsMydMDs6n6KXD6JQrfMtF 1pUC/sEC/kc9yaf7XUqVKge5M7uISFzgo8d5fdtRP/xp+O0dlS3bi00JFAE20+2fKHnJtDF0S wFQ69DIO/7yqDnJMDama9qpK3hFC/7Yb0VH+iD7lqOQ1//8IaTbZr/G3NxtCS8b4nPfks8dvw 3HjBiYbhiQ7DwDp2l+Ir6eIQawgwMqvEw2gal6NNHkgRFDJAtCXBoZsCWq+nv3w7St2pGH5QS tJMNBDGdaIwm0XqJTWC3aB3pUrgH6xXvyy93S7lz0l+Ev3FY5ck8jJ30++QU49IYbpTQNOqE1 GpOE+WqrEWyYUms3ai16z1yX27K4M4QlnxZTXwbthalFZQNMtVurjE65WB2ji3TKBnV6B2H2n OgFci0rMEn7SW3m4ryKD+t75x/S8bNnExPaN3RXS0Jn3eIIe77Bj/iHa0fkLoOHDQli8IIpGF Nlup7XUoHnxpMY/L1oKfsrFMjqQGzO3fUaqscx9dsmnoTLX7Te8kNOuiRiB8kUsuFRvyC3MP6 PvXGmRsl1b5Ui75y3S5Blxfn/wpwjCPFR5mMOio00k3nhrbNcXrsdvCj6ayG/1fUpveEwsNkE pvcZ7HJnQPUQrjDM3w2IwJQQlEeheQschAoLahjBmYPRMAI07wY77oa7QwTEfUmXBZKetuaZP rUH11dTAK+hWlR6F5kHf7Qvi7tnPA522k7YV/VuZJAAc0GlIfFQLUa5YvPRGiE2e2ZgxN1slK 2Hmy+/+ X-Spam-Status: No, score=-0.4 required=5.0 tests=BAYES_00, BODY_8BITS, KAM_DMARC_STATUS, KAM_LAZY_DOMAIN_SECURITY, NICE_REPLY_A, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: cygwin@cygwin.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: General Cygwin discussions and problem reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8"; Format="flowed" Errors-To: cygwin-bounces+archive-cygwin=delorie.com@cygwin.com Sender: "Cygwin" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by delorie.com id 2AK8lbqm009474 Am 20.11.2022 um 08:26 schrieb Brian Inglis: > On Fri Nov 18 21:15:04 GMT 2022, Dale McCoy wrote: >> I use Cygwin in the course of work, and while I can use the external gpg >> signature to verify the validity of setup-x86_64.exe, my IT department >> can't see that step. They get somewhat concerned when they see that >> Windows >> thinks setup-x86_64.exe is unsigned, and I certainly don't blame them. >> Can I convince you to also embed a signature in the installer, so >> Windows >> recognizes the file is signed? >> I couldn't find a previous request on the mailing list for this, but >> I may >> have missed it in my attempts to grep the monthly digests. > > See thread "Should cygwin's setup*.exe be signed using Sign Tool?": > >     https://cygwin.com/pipermail/cygwin/2015-April/220978.html > https://inbox.sourceware.org/cygwin/E1Ydjc5-0000kv-WD@rmm6prod02.runbox.com/ > > > In case we ever need it, one of our setup maintainers packaged > osslsigncode: > >     https://cygwin.com/packages/summary/osslsigncode-src.html > Packaging error: the binary is placed in /usr -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation: https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple