X-Recipient: archive-cygwin AT delorie DOT com
X-Original-To: cygwin AT cygwin DOT com
Delivered-To: cygwin AT cygwin DOT com
DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 70A903858D32
Authentication-Results: sourceware.org; dmarc=none (p=none dis=none)
 header.from=dronecode.org.uk
Authentication-Results: sourceware.org; spf=none smtp.mailfrom=dronecode.org.uk
Authentication-Results: btinternet.com;
 auth=pass (PLAIN) smtp.auth=jonturney AT btinternet DOT com;
 bimi=skipped
X-SNCR-Rigid: 6139452E444B51A2
X-Originating-IP: [81.153.98.246]
X-OWM-Source-IP: 81.153.98.246 (GB)
X-OWM-Env-Sender: jonturney AT btinternet DOT com
X-VadeSecure-score: verdict=clean score=0/300, class=clean
X-RazorGate-Vade: gggruggvucftvghtrhhoucdtuddrgedvgedrheeggdejgecutefuodetggdotefrodftvfcurfhrohhfihhlvgemuceutffkvffkuffjvffgnffgvefqofdpqfgfvfenuceurghilhhouhhtmecufedtudenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhepkfffgggfhffuvfhfjggtgfesthejredttdefjeenucfhrhhomheplfhonhcuvfhurhhnvgihuceojhhonhdrthhurhhnvgihsegurhhonhgvtghouggvrdhorhhgrdhukheqnecuggftrfgrthhtvghrnhepgeetjeeuveegheffudekgeffudfhhfetffehheejvdeffefgkefflefgtdetleegnecukfhppeekuddrudehfedrleekrddvgeeinecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehhvghloheplgduledvrdduieekrddurddutdeingdpihhnvghtpeekuddrudehfedrleekrddvgeeipdhmrghilhhfrhhomhepjhhonhdrthhurhhnvgihsegurhhonhgvtghouggvrdhorhhgrdhukhdpnhgspghrtghpthhtohepvddprhgtphhtthhopegthihgfihinhestgihghifihhnrdgtohhmpdhrtghpthhtohepuggrlhgvshhtrghnsehgmhgrihhlrdgtohhm
X-RazorGate-Vade-Verdict: clean 0
X-RazorGate-Vade-Classification: clean
Message-ID: <64eb894e-0bce-2e68-3e8b-a8cd69711514@dronecode.org.uk>
Date: Sun, 20 Nov 2022 17:17:18 +0000
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.5.0
From: Jon Turney <jon DOT turney AT dronecode DOT org DOT uk>
Subject: Re: Adding an embedded signature on setup-x86_64.exe
To: Dale McCoy <dalestan AT gmail DOT com>,
        The Cygwin Mailing List <cygwin AT cygwin DOT com>
References: <CAMU-TAuPF3DZPYe3xJ0F_GyrChZPRXjXbYAfD6tt9mY+a7j8kQ AT mail DOT gmail DOT com>
Content-Language: en-GB
In-Reply-To: <CAMU-TAuPF3DZPYe3xJ0F_GyrChZPRXjXbYAfD6tt9mY+a7j8kQ@mail.gmail.com>
X-Spam-Status: No, score=-3570.0 required=5.0 tests=BAYES_00, FORGED_SPF_HELO,
 KAM_DMARC_STATUS, KAM_LAZY_DOMAIN_SECURITY, NICE_REPLY_A, RCVD_IN_DNSWL_NONE,
 SPF_HELO_PASS, SPF_NONE, TXREP autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
 server2.sourceware.org
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe: <https://cygwin.com/mailman/options/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>

On 18/11/2022 21:15, Dale McCoy wrote:
> I use Cygwin in the course of work, and while I can use the external gpg
> signature to verify the validity of setup-x86_64.exe, my IT department
> can't see that step. They get somewhat concerned when they see that Windows
> thinks setup-x86_64.exe is unsigned, and I certainly don't blame them.
> Can I convince you to also embed a signature in the installer, so Windows
> recognizes the file is signed?

This something I'd like to do, but unfortunately, the remaining blocking 
issues are not technical.

In order to sign the code in this way, the key needs to be signed by a 
CA that participates in Microsoft Trusted Root Program.  These CAs 
charge an annual fee. As the person who makes the setup releases, I'm 
not going to pay that out of my own pocket, and we currently have no 
organization to collect donations for that (or any other) purpose.

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple