#1499 closed enhancement (fixed)
Digitally sign the installer
Reported by: | andrewmunn | Owned by: | andrewmunn |
---|---|---|---|
Priority: | minor | Milestone: | 2.1 |
Component: | client | Version: | trunk |
Keywords: | win32 | Cc: |
Description
Can the installation binary be digitally signed going forward? I think this will help the application get past some corporate security policies once the signing key is whitelisted there.
Attachments (3)
Change History (8)
Changed 4 years ago by
Attachment: | xpra-ca.cer added |
---|
Changed 4 years ago by
Attachment: | install-xpra-ca.png added |
---|
warning shown when installing the xpra ca file
Changed 4 years ago by
Attachment: | UAC-warning-verified-publisher.png added |
---|
UAC warning when installing the signed application
comment:1 Changed 4 years ago by
Owner: | changed from Antoine Martin to andrewmunn |
---|
I assume that you are talking about MS Windows installers.
That's now done in r15584 based on the instructions found in How do I create a self-signed certificate for code signing on Windows?.
Note: you will need to install the self signed CA file first using:
certutil -user -addstore Root xpra-ca.cer
You will get a warning that looks like this:
But then when installing the application, the UAC dialog will look less threatening:
There are signed windows beta builds you can test: http://xpra.org/beta/windows.
@andrewmunn: please close this ticket if that works for you.
Ultimately, we should use a proper CA, but at ~$160 per year. Those don't come cheap.
One benefit of those certificates is that they are apparently trusted on Mac OSX too, so we wouldn't have to pay the apple developer fee to get the PKG / DMG signed (the apple developer account key has now expired, that was complete waste of money: see #1340).
comment:5 Changed 3 months ago by
this ticket has been moved to: https://github.com/Xpra-org/xpra/issues/1499
self signed CA cert