Sign Windows and Mac executables

[jayschwa]

Currently, the Windows 8 "Smart"Screen filter tries to protect me by preventing the Julia executables and batch files from being executed. I have not read up on this filter, but I suspect it would be less hostile if executables were signed.

Before reaching v1.0, you ought to get signing integrated into your release process.

[ViralBShah: Updated title]

[StefanKarpinski]

Thanks Jay!

[ViralBShah]

This is an issue for OS X 10.8 as well, where Gatekeeper makes it difficult to install unsigned apps. On mac, this requires signing for the Mac developer program, getting the keys provided by Apple, and then using codesign during the build.

If we get all this figured for mac and windows soon, we will put it on the 0.1 branch. Otherwise, it will be a 0.2 thing.

[ViralBShah]

I should note that our debian packages are already signed by @sebastien-villemot.

[jayschwa]

Here is a Microsoft blog post about code signing:
http://blogs.msdn.com/b/ie/archive/2012/08/15/10339518.aspx

[JeffBezanson]

"Windows 8 has detected that you are trying to install open-source software. Please shave and get a job."

[ViralBShah]

Shaving is not good for julia's success:
http://blogs.microsoft.co.il/blogs/tamir/archive/2008/04/28/computer-languages-and-facial-hair-take-two.aspx

Julia does not fare well in the facial hair category, as evidenced by this picture when we visited Prof. Kahan in Berkeley:
http://julialang.org/images/kahan.jpg

[StefanKarpinski]

I'm holding up my end of the facial hair.

[iljau]

cmderdev/cmder#100
cmderdev/cmder#142

[ViralBShah]

@staticfloat Would it be possible to at least start signing the mac executables? Do you have an Apple Developer ID?

[staticfloat]

We would need to sign Platypus, not Julia, interestingly enough, since it's
the Platypus application that's getting "opened" by the OS and then opening
Julia. The author of Platypus is not
interestedhttps://github.com/sveinbjornt/Platypus/issues/10in
signing his own builds, so we'll just do it ourselves I suppose.

I have a developer ID, but I don't have the "license" or whatever the paid
version is called.
-E

On Tue, Mar 4, 2014 at 11:43 PM, Viral B. Shah [email protected]:

@staticfloat https://github.com/staticfloat Would it be possible to at
least start signing the mac executables? Do you have an Apple Developer ID?

Reply to this email directly or view it on GitHubhttps://github.com//issues/2381#issuecomment-36717471
.

[vtjnash]

For windows 8 signing, mozilla has a guide on how to sign an installer from linux:
https://developer.mozilla.org/en-US/docs/Signing_an_executable_with_Authenticode

[ViralBShah]

@staticfloat For Mac is all that we require a paid license? If so, could you get one and we will get you reimbursed. Would be nice to ship signed binaries for 0.3 wherever we can.

[ihnorton]

Here is an SO answer covering what we need logistically for Windows: namely, to purchase a certificate.

Some notes (to myself, mostly):

• https://developer.mozilla.org/en-US/docs/Signing_an_executable_with_Authenticode
• http://nsis.sourceforge.net/Signing_an_Uninstaller
• we need to put a manifest in the 7zSFX to get rid of PCA. see here, here, and here

[staticfloat]

I will sign rc2. I've already built rc1 and am uploading it now.

[ViralBShah]

That's amazing! I am marking this as 0.3, as it seems that we will be able to pull this off.

[ViralBShah]

Status update: @StefanKarpinski has started the process to procure keys for the mac.

This should not block the 0.3 release, and binaries can be signed whenever the keys are available. For now, we should document how to turn off the authentication of packages on a mac on the downloads page, until we get this fixed.

[ViralBShah]

I believe mac executables are being signed now.

Did we get very far with the Windows certificates from MIT? If not, I am happy to purchase one from wherever we need to.

[StefanKarpinski]

Hopefully the Microsoft process is no worse than the Apple one.

[ihnorton]

@Keno were you able to get in touch with anyone at MIT about a code-signing cert from InCommon?

[Keno]

I'm not really sure who to talk to. I'll ask around.

[ihnorton]

Maybe helpdesk@mit can route the question.

[Keno]

I'm on it, thanks.

[Keno]

In order to sign code, we need to apparently have an email server set up on julia.mit, so Ali is going to do that over the next week and then get us the code sign certs.

[ViralBShah]

Can't we just buy something from a vendor? I don't mind paying. Just an option if we need it.

[JeffBezanson]

Yeah, it doesn't seem like this should depend on our ability to maintain a mail server on a particular machine.

[ViralBShah]

Ok. Just waiting for confirmation of the key details above and will buy it then. Ping @ihnorton

[ihnorton]

@ViralBShah
SHA2: yes, everything that is relevant supports it, and MS will be deprecating SHA1 in 2016
2048: yes, estimated to be ok until 2030. We'll have to renew before then.

Other options:
Exportable: very important to select yes, so that we can extract a key that will work with the Mono tools.

User-protected: require password prompt to use the cert. We probably don't want this, if we want to sign the nightlies automatically.

[ViralBShah]

I have paid - but waiting for the verification process that may take a couple of days.

[prcastro]

Any news about the verification?

[ihnorton]

We got the certificate today.

[ihnorton]

I still get a smartscreen warning, and my understanding is that we need to build up some amount of reputation on the certificate for that to go away.

[quinnj]

At least now you see the JULIA COMPUTING LLC instead of unknown publisher. Looks great @ihnorton!

[ihnorton]

Thanks due to @ViralBShah. I'm going to go ahead and make the signed installers the default and we'll see how it goes.

[ViralBShah]

Eagerly waiting for the signed binaries. Also, with verification done, it will be easier for us to get other things like SSL certificates and such easily too.

[ihnorton]

Already done, the 0.3-release downloads are now signed for win32 and win64.

[nalimilan]

What should be done in order to increase your reputation? Should many people (like us) sign your certificate?

[ViralBShah]

I do not know much about this. I know that this was the case with the debian keyring - but does it matter for Windows code signing certificates?

[ihnorton]

As far as I can tell the only thing we can do is wait for more people to download and install it. The microsoft docs appear to imply that smartscreen phones home with some info (certificates? file ids? urls?) that it uses to build the reputation score.

[nalimilan]

OK, great.

[tkelman]

Looks like this certificate lasts for a year, so will need to be renewed in the next 3 weeks?

[StefanKarpinski]

Yeah, I'm on it.

[tkelman]

Awesome. Let @staticfloat know when it's renewed, I think he has to move the certificate over to the buildbots somehow.

[tkelman]

Bump. Certificate's expired, needs to be renewed.

[ViralBShah]

This would have been better opened as a new issue. I believe the mac certificate requires renewing right now, is that right?

[tkelman]

If not for the reminder here from 3 weeks ago, I would have gone with a new issue or a direct email to whoever is able to make the renewal.

I don't know how long the OSX keys last for. The OSX buildbot has not been having any issues so I assume that one's still okay.

[ViralBShah]

Basically, IIRC, @StefanKarpinski did the mac certificate, and I did the windows certificate. So, just ping me if I need to do something.

[tkelman]

I see. Sorry I should've been more specific, it's the Windows certificate that is expired and needs to be renewed. It's been failing for a couple days - http://buildbot.e.ip.saba.us:8010/builders/package_win8.1-x64

Once it's ready we need to ping Elliot about getting it migrated over to the windows buildbots. The step is here https://github.com/staticfloat/julia-buildbot/blob/70571c66606fc744cf75597e1d207b5641161224/master/package_win.py#L81-L84 but I'm having a hard time finding where sign.sh comes from.

[ViralBShah]

I have initiated the process for a new Windows code signing certificate. Hopefully we will have one in a couple of days.

[ViralBShah]

I have the new windows code signing certificate (I think). @tkelman Would you know what to do with it? I believe @ihnorton set it up the last time.

[tkelman]

We need to get it up onto the buildbots somehow. @staticfloat knows how, I hope? Would be good if he could enlighten a few more of us what to do with it, if it's anything more complicated than just copying it over manually.

[staticfloat]

Yep, send it to me and I'll load it onto the buildbots. Here's how the signing process works:

• On OSX, the signing private key (a .p12 file) and the public certificate (a .cer file) must be imported into the machine's keychain. This can be done through the GUI, or using the security command-line tool. Before attempting to sign (which is done in this step of the .app creation process) the keychain must be unlocked, which is done via the ~/unlock_keychain.sh script. Once the keychain is successfully unlocked, and the codesign tool has run, the .app is signed and can be bundled up into a .dmg. The only thing that needs to happen once we get a new key here, is to login to the buildbot, import the .p12 file into the keychain, and potentially change the key fingerprint being passed to codesign inside contrib/mac/app/Makefile.
• On Windows, there is no keychain, you just store the private key file (a .pfx file) on the buildbot somewhere, then pass it to signtool.exe. This is done by the ~/sign.sh file, and I believe the only thing that needs to happen here is to replace the .pfx and .cer files. The ~/sign.sh file is invoked from the buildbot here.

SSH access to the buildbots is somewhat difficult, partly because it's SSH-key based only, (I have a julia_buildbot RSA key that I load onto all of the buildbots, it's backed up onto the juliasecure AWS bucket so if anyone wants that key to be able to login to the buildbots, you can either grab it from there, or email me and I'll email it to you) and partly because the IPs change whenever I reboot the buildbots, so I always have to log into https://horizon.csail.mit.edu/ in order to see what address I should be connecting to. Hopefully one of these days I'll hook the buildbots into my dynamic DNS infrastructure properly. :)

[ViralBShah]

@staticfloat confirmed the new Windows code signing certificate works.