Feature Request: Sign Windows Application

[godofecht]

I think the Windows binaries could use code-signing. I tried to get someone else to download and install Bananas on their system and they freaked out at the Security Prompt.

[gorillamoe]

Is on the roadmap, but it's quite a challenge to get one from Microsoft (which will probably cost around 120 USD per year), so either you have to be patient, or someone chimes in and pays the 350+ USD per year that a EV signing certificate for Windows costs.

[godofecht]

I could sign handle a Windows build with my EV certificate if you'd like.

[gorillamoe]

I could sign handle a Windows build with my EV certificate if you'd like.

I would refrain from signing it manually. It should be part of the CI/CD. The complete flow of creating the releases should be visible to everyone and signing it manually would break the trust and visibility chain.

That said, there is nothing stopping you from signing it and passing it to "someone else", so they don't get the security prompt.

[godofecht]

Sure, makes sense. .

…

On Wed, Dec 4, 2024, 22:30 Marco Kellershoff ***@***.***> wrote: I could sign handle a Windows build with my EV certificate if you'd like. I would refrain from signing it manually. It should be part of the CI/CD. The complete flow of creating the releases should be visible to everyone and signing it manually would break the trust and visibility chain. That said, there is nothing stopping you from signing it and passing it to "someone else", so they don't get the security prompt. — Reply to this email directly, view it on GitHub <#62 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACX3TA2QNSYLOJZYS7TYJC32D57BFAVCNFSM6AAAAABTAZVV4OVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKMJYGY4TCNJZGA> . You are receiving this because you modified the open/close state.Message ID: ***@***.***>

[jssuttles]

I was looking through Reddit and found this: https://signpath.org/
https://www.reddit.com/r/opensource/comments/nl5u79/is_there_fossfriendly_certificate_authority_to/

[gorillamoe]

I was looking through Reddit and found this: https://signpath.org/ https://www.reddit.com/r/opensource/comments/nl5u79/is_there_fossfriendly_certificate_authority_to/

Thanks, did not know about this. Will look into it. It might be a good fit for us!

[gorillamoe]

Filled out the form, and created the PDF from it (which was quite a hassle, because of the form layout) and signed the PDF and sent it to the mentioned e-mail-address. Let's hope for the best.