Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proposal: Code Signing #504

Open
wjk opened this issue Dec 11, 2015 · 3 comments
Open

Proposal: Code Signing #504

wjk opened this issue Dec 11, 2015 · 3 comments
Labels
0 - _Triaging Has related issue This issue has a related issue that would need to be addressed before this issue could be closed.

Comments

@wjk
Copy link

wjk commented Dec 11, 2015

I was reading through the conversation on #113 and came to the part about possibly GPG-signing packages for security purposes. As an extension of this idea, would it be possible to set up some sort of Authenticode infrastructure so that the EXEs/DLLs/whatever installed by a package can also be signed, not just the package itself?

While I could theoretically purchase an Authenticode certificate from e.g. DigiCert, the truth is I just don't have the budget to. And, apparently, neither do thousands of other Windows developers. Just about every software installer I have ever run is unsigned — including some software in the community feed itself! (See ChocolateyGUI#295.)

If this proposal is accepted, I would very much appreciate the root certificate for the Authenticode infrastructure being placed into the Trusted Publishers certificate store when Chocolatey is installed, so that Windows considers files signed with certificates derived from it to be signed by a valid authority. In addition, essentially free code-signing through Chocolatey would provide another incentive for developers like me to develop their applications for this service and not use (insert horrible adware-bundling download site here) instead.

Disclaimer: I am not security expert. If anyone spots any potential holes in what I have suggested, please let me know. Also, please note that I would only recommend modifying the Trusted Publishers store if doing so would not open the machine to a Superfish-style SSL vulnerability. Thanks!

@ferventcoder
Copy link
Member

That's pretty interesting.

@RichiCoder1
Copy link
Contributor

If and when you get an answer to this, I'd be curious @ferventcoder. Looking into this myself now, especially since Gui escelates by default (something I'd like to fix eventually)

@TheCakeIsNaOH
Copy link
Member

After previous discussion with @gep13, this issue depends on #508, as code signing has been added to newer nuget versions.

@TheCakeIsNaOH TheCakeIsNaOH added the Has related issue This issue has a related issue that would need to be addressed before this issue could be closed. label Feb 4, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
0 - _Triaging Has related issue This issue has a related issue that would need to be addressed before this issue could be closed.
Projects
None yet
Development

No branches or pull requests

4 participants