5 ms·

That's me! I was incredibly salty about this. I didn't name the CA, because they're actually nice to have reduced price for Open Source projects, but Microsoft

by pornel 8y ago

That's me! I was incredibly salty about this. I didn't name the CA, because they're actually nice to have reduced price for Open Source projects, but Microsoft really needs to drag the whole process into the 21st century. The process and infrastructure reminds me very much of TLS before Let's Encrypt. If this is something that every developer needs to do for every exe, it can't be like getting an EV certificate for a Netscape Server. I thought Apple's often-buggy signing was bad, but at least they've tried to make it a one checkbox paid for in a straightforward transaction. I would have signed with SHA-2, which for inexplicable reason is not the default despite deprecation, but my signtool crashed when I enabled it.

mnkypete 8y ago
Interesting, what command did you use? This works for us without any issues: signtool sign /a /fd SHA256 /tr "http://timestamp.globalsign.com/?signature=sha2" http://timestamp.globalsign.com/?signature=sha2" /td SHA256 <exefile>
- pornel 8y ago
  I've copied that exact command from 3rd party documentation. Microsoft didn't even bother to give a SHA-2 example in theirs. And maybe I'm spoiled, but could it not require four switches of a "don't do useless thing" kind? It's as if `copy` required /ones /zeros switches to be explicit you don't want it to omit these bits.
  - ben509 8y ago
    It's a safety issue though. Only experts should run `copy /ones /zeros`, because if you get too many ones on one side and zeros on the other it can throw off your hard disk's alignment and void your warranty.
IvyMike 8y ago
Which signtool did you use? (You may have more than one on your system. This has cost me more time than I would like to admit. I'd make sure you're using the one from the latest Win 10 SDK.)
- pornel 8y ago
  I did find four! Yes, I've picked one at random. None of them was in my path, even after running vcvars*bat. Given Conway's law, I suspect signtool has a different project manager than the VS team.
eco 8y ago
signtool badly needs to be updated. The interface is very confusing and the documentation, while fairly complete, isn't very helpful. That said, I just upgraded ours and didn't have much trouble switching to sha256. There is one quirk about the order of the arguments due to some limitation with the timestamping servers. The documentation loudly points this out though. If it helps, here's my exact command line: signtool.exe sign /v /n "Company, LLC" /ph /d "Description" /du "https://www.website.com" /tr "http://timestamp.comodoca.com" /td sha256 # /td must come after /tr /fd sha256 executable.exe Not being able to automate these EV hardware tokens because of the password is a pain that I'm already annoyed by though.
- 456hdsaq234g 8y ago
  Can you confirm that the reason the password is forced is the PKCS12 (pfx) import has flagged the key as requiring a password every signature? (and it cannot be disabled). I believe you can use mimikatz to forcibly strip the strong protection flag from the key. Microsoft says this is normally not possible, yet here we are. You might want to try downgrading the strong protection flag on the key material, it may allow for automated signing.
- gargravarr 8y ago
  > # /td must come after /tr Confirmed HTML
  - jwilk 8y ago
    But... it's </td></tr> in HTML. :-P
- spydum 8y ago
  Pretty sure the new way is via PowerShell: Set-AuthenticodeSignature -HashAlgorithm "sha256" -IncludeChain "all" -FilePath "File" -Certificate $Cert -TimestampServer $TSUrl
electroly 8y ago
That CA took you for a ride. My open source Windows projects are signed, too. No smart card, no PIN when signing, no special software. I did have to provide some identity information and a photo, but identity verification is the service that CAs are expected to perform here. You would have had a better time with a different CA.
- deleted 8y ago
  [deleted]
- duxup 8y ago
  Who is a good CA to use?
- caseymarquis 8y ago
  There have been recent changes in Microsoft's policy which now require a physical device to be used for signing. It's a giant pain. They alluded to cloud based services for signing, but other than Symantec's Enterprise offering (no listed price on their site), this doesn't really exist. I think MS needs to step up and provide a simple cloud based signing service. They should have waited to do this before forcing these changes.
  - electroly 8y ago
    Interesting, I just read up on that. Thanks for the info. My code signing certificate was issued before the cutoff, which appears to have been February 1, 2017. I guess I'm in for some fun when I need to renew.
  - khedoros1 8y ago
    My latest signing certs were issued around last August, and there didn't seem to be any extra rigmarole to get them (although I work for a large corporation; maybe that makes a difference?). We've basically got a giant keystore server that handles the secret keys for all of the company's signing, then signing provider plugins installed on the build machines to communicate with the keystore, while allowing us to use standard tools like signtool.
  - 8y ago
plasma 8y ago
I've ran into similar frustration getting an exe certificate. In one example, the provider needed to check I was a legitimate business, by seeing if I was in the phone book -- so I just registered online, called them back, they saw it and granted me the certificate, then I unregistered. Waste of time.
nodja 8y ago
Sorry to go off topic, but I'm wondering what's the goal of the tool as there are already ways of doing this. I've created a bat file that uses youtube-dl to download a video and convert it to gif using several tools and parameters (ffmpeg, imagemagick). I use it to make inline posts on hangouts since it's 2018 and I need a mobile device to post inline videos there for some reason. Anyway, your tool seem to get good image size on videos with lots of colors, but horrible size on simpler images. Using the --fast switch as it took 6 minutes to convert 387 frames to save 10% on filesize. I'm comparing it to ffmpeg with a pallete as it seems to get similar image quality with a smaller size in most cases. Gist of my bat file. https://gist.github.com/Nodja/8ece6c3d866867877442e34bf67ece9c https://gist.github.com/Nodja/8ece6c3d866867877442e34bf67ece... edit: After reading this after posting it, it looks as I'm super critical/aggressive. I'm just genuinely curious at what drove you to write the tool as there are already ways to achieve what you wanted. Didn't mean to antagonize you.
microcolonel 8y ago
If you want headless automated builds, I recommend trying Sikuli on top of a VM. It doesn't require any toolkit/OS support to automate your applications. It is disgustingly easy to set it up, it is software none of us deserve. http://www.sikuli.org/ http://www.sikuli.org/
- deoxxa 8y ago
  Oh man, Sikuli (and SikuliX http://sikulix.com/ http://sikulix.com/) is amazing. It's the kind of thing where I hate that it has to exist, but I'm so happy that it does exist.
xroche 8y ago
Open source developer here. Also used to get Certum certificates with reduced price for open source developers, but their smartcard junk convinced me to use another provider. And they also raised their pricing policy. I ended up with Comodo, which was "cheap". I then discovered that this was cheap for a reason: they did not provide the identity validation (something which was not clearly stated anywhere), and I had to pay for a notary certification (which was about twice as much as the certificate price), because apparently in the US an ID card is considered as reliable as your sport club membership card. The whole Microsoft code certification is a shit show. It provides no security whatsoever, feeds an incredible number of incompetent parasites, and at the end is a real burden for open source developers like me, who want to get rid of the nasty Windows security messages, but also want to avoid being targeted by download sites bundling your binaries with some adware crap. A "let's encrypt for code" ? Please sign-me up!

by pornel 8y ago

mnkypete 8y ago

Interesting, what command did you use? This works for us without any issues: signtool sign /a /fd SHA256 /tr "http://timestamp.globalsign.com/?signature=sha2" http://timestamp.globalsign.com/?signature=sha2" /td SHA256 <exefile>

pornel 8y ago
I've copied that exact command from 3rd party documentation. Microsoft didn't even bother to give a SHA-2 example in theirs. And maybe I'm spoiled, but could it not require four switches of a "don't do useless thing" kind? It's as if `copy` required /ones /zeros switches to be explicit you don't want it to omit these bits.
- ben509 8y ago
  It's a safety issue though. Only experts should run `copy /ones /zeros`, because if you get too many ones on one side and zeros on the other it can throw off your hard disk's alignment and void your warranty.

IvyMike 8y ago

Which signtool did you use? (You may have more than one on your system. This has cost me more time than I would like to admit. I'd make sure you're using the one from the latest Win 10 SDK.)

pornel 8y ago
I did find four! Yes, I've picked one at random. None of them was in my path, even after running vcvars*bat. Given Conway's law, I suspect signtool has a different project manager than the VS team.

eco 8y ago

signtool badly needs to be updated. The interface is very confusing and the documentation, while fairly complete, isn't very helpful. That said, I just upgraded ours and didn't have much trouble switching to sha256. There is one quirk about the order of the arguments due to some limitation with the timestamping servers. The documentation loudly points this out though. If it helps, here's my exact command line: signtool.exe sign /v /n "Company, LLC" /ph /d "Description" /du "https://www.website.com" /tr "http://timestamp.comodoca.com" /td sha256 # /td must come after /tr /fd sha256 executable.exe Not being able to automate these EV hardware tokens because of the password is a pain that I'm already annoyed by though.

456hdsaq234g 8y ago
Can you confirm that the reason the password is forced is the PKCS12 (pfx) import has flagged the key as requiring a password every signature? (and it cannot be disabled). I believe you can use mimikatz to forcibly strip the strong protection flag from the key. Microsoft says this is normally not possible, yet here we are. You might want to try downgrading the strong protection flag on the key material, it may allow for automated signing.
gargravarr 8y ago
> # /td must come after /tr Confirmed HTML
- jwilk 8y ago
  But... it's </td></tr> in HTML. :-P
spydum 8y ago
Pretty sure the new way is via PowerShell: Set-AuthenticodeSignature -HashAlgorithm "sha256" -IncludeChain "all" -FilePath "File" -Certificate $Cert -TimestampServer $TSUrl

electroly 8y ago

That CA took you for a ride. My open source Windows projects are signed, too. No smart card, no PIN when signing, no special software. I did have to provide some identity information and a photo, but identity verification is the service that CAs are expected to perform here. You would have had a better time with a different CA.

deleted 8y ago
[deleted]
duxup 8y ago
Who is a good CA to use?
caseymarquis 8y ago
There have been recent changes in Microsoft's policy which now require a physical device to be used for signing. It's a giant pain. They alluded to cloud based services for signing, but other than Symantec's Enterprise offering (no listed price on their site), this doesn't really exist. I think MS needs to step up and provide a simple cloud based signing service. They should have waited to do this before forcing these changes.
- electroly 8y ago
  Interesting, I just read up on that. Thanks for the info. My code signing certificate was issued before the cutoff, which appears to have been February 1, 2017. I guess I'm in for some fun when I need to renew.
- khedoros1 8y ago
  My latest signing certs were issued around last August, and there didn't seem to be any extra rigmarole to get them (although I work for a large corporation; maybe that makes a difference?). We've basically got a giant keystore server that handles the secret keys for all of the company's signing, then signing provider plugins installed on the build machines to communicate with the keystore, while allowing us to use standard tools like signtool.
- 8y ago

plasma 8y ago

I've ran into similar frustration getting an exe certificate. In one example, the provider needed to check I was a legitimate business, by seeing if I was in the phone book -- so I just registered online, called them back, they saw it and granted me the certificate, then I unregistered. Waste of time.

nodja 8y ago

Sorry to go off topic, but I'm wondering what's the goal of the tool as there are already ways of doing this. I've created a bat file that uses youtube-dl to download a video and convert it to gif using several tools and parameters (ffmpeg, imagemagick). I use it to make inline posts on hangouts since it's 2018 and I need a mobile device to post inline videos there for some reason. Anyway, your tool seem to get good image size on videos with lots of colors, but horrible size on simpler images. Using the --fast switch as it took 6 minutes to convert 387 frames to save 10% on filesize. I'm comparing it to ffmpeg with a pallete as it seems to get similar image quality with a smaller size in most cases. Gist of my bat file. https://gist.github.com/Nodja/8ece6c3d866867877442e34bf67ece9c https://gist.github.com/Nodja/8ece6c3d866867877442e34bf67ece... edit: After reading this after posting it, it looks as I'm super critical/aggressive. I'm just genuinely curious at what drove you to write the tool as there are already ways to achieve what you wanted. Didn't mean to antagonize you.

microcolonel 8y ago

If you want headless automated builds, I recommend trying Sikuli on top of a VM. It doesn't require any toolkit/OS support to automate your applications. It is disgustingly easy to set it up, it is software none of us deserve. http://www.sikuli.org/ http://www.sikuli.org/

deoxxa 8y ago
Oh man, Sikuli (and SikuliX http://sikulix.com/ http://sikulix.com/) is amazing. It's the kind of thing where I hate that it has to exist, but I'm so happy that it does exist.

xroche 8y ago

Open source developer here. Also used to get Certum certificates with reduced price for open source developers, but their smartcard junk convinced me to use another provider. And they also raised their pricing policy. I ended up with Comodo, which was "cheap". I then discovered that this was cheap for a reason: they did not provide the identity validation (something which was not clearly stated anywhere), and I had to pay for a notary certification (which was about twice as much as the certificate price), because apparently in the US an ID card is considered as reliable as your sport club membership card. The whole Microsoft code certification is a shit show. It provides no security whatsoever, feeds an incredible number of incompetent parasites, and at the end is a real burden for open source developers like me, who want to get rid of the nasty Windows security messages, but also want to avoid being targeted by download sites bundling your binaries with some adware crap. A "let's encrypt for code" ? Please sign-me up!