DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 543IMSGV3783472
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 4ABB93858D21
MIME-Version: 1.0
Date: Sat, 3 May 2025 20:21:19 +0200
Message-ID: <CAKAoaQn=-jVLnrO1hmM_4JAPodO-YnUuw+fcnDScHa=d2G48=A@mail.gmail.com>
Subject: Signing cygwin.com binaries with signtool by default ?
To: cygwin@cygwin.com
From: Roland Mainz via Cygwin <cygwin@cygwin.com>
Reply-To: Roland Mainz <roland.mainz@nrubsig.org>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie.com@cygwin.com>

Hi!

----

Is it somehow possible that the CI+Release binaries (*.exe, *.dll) can
be signed with signtool
(https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool) ?
It seems that Microsoft Defender has become overly aggressive to some
Cygwin binaries (mostly /usr/bin/hostname, /usr/bin/find, /usr/bin/tar
etc.) in the last couple of weeks and just blocks them.

Our IT supports that they can "whitelist" binaries based on their
cryptographic signature... but neither the binaries from the CI nor
the Release binaries have any signatures...

----

Bye,
Roland
-- 
  __ .  . __
 (o.\ \/ /.o) roland.mainz@nrubsig.org
  \__\/\/__/  MPEG specialist, C&&JAVA&&Sun&&Unix programmer
  /O /==\ O\  TEL +49 641 3992797
 (;O/ \/ \O;)

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple