5 ms·
Open source projects sign their Apps like anyone else. Works fine. They do the same on Windows of course and on Linux package managers.
by oneplane 6y ago
Open source projects sign their Apps like anyone else. Works fine.
They do the same on Windows of course and on Linux package managers.
- oauea 6y agoWho pays the apple tax?
- gowld 6y agoAnyone who volunteers. Same answer as "who writes the software" or "who buys the development hardware".
- nextaccountic 6y agoIs there any Linux distribution charging an yearly fee for package signing?
- recursive 6y agoIn my experience, open source installers for windows are mostly not signed. But windows has a button to let you run them though.
- jussij 6y agoWindows 10 also does it's best to try and stop users from running unsigned code, by making the UI complicated. When Windows 10 finds an unsigned installer it shows a dialog with a Don't Run button and as the name suggest clicking that button does not run the installer. To run the installer the user needs to first click on the More Info link which will then present the user with an option to Run the installer. Here's an example: https://www.zeusedit.com/images/zeus_install.png https://www.zeusedit.com/images/zeus_install.png
- nathansoz 6y agoWindows signing isn't centrally managed through Microsoft, which is an important distinction I think.
- floatboth 6y agoIIRC, the CAs Windows trusts charge absolutely ridiculous amounts of money, unless something has changed recently.
- spideymans 6y agoWhich CAs are available for Windows, and how much do they cost, out of curiosity? Not a Windows developer.
- readams 6y agoMost CAs can do this. It's not restricted.
- tialaramex 6y agoCertificate Authorities trusted by Microsoft for the purpose of Code Signing would need to issue you a certificate with the appropriate EKU (Extended Key Usage, saying this is for Code Signing). Technically a user could add some CA you span up for this purpose to their Windows install, but if you're going to all this bother you could just get them to click past the warning of course... The CCADB can tell you which CA roots are trusted by Microsoft for this purpose: https://ccadb-public.secure.force.com/microsoft/IncludedCACertificateReportForMSFT https://ccadb-public.secure.force.com/microsoft/IncludedCACe... You're looking for a CA which has Microsoft Trust Bits including Code Signing, and Microsoft Status of "Included" Price: A couple of hundred bucks per year. Vendors with very well known brands like DigiCert's "Symantec" brand (famous despite the fact Symantec actually ran their CA so terribly they ended up selling the brand to DigiCert... the CA they'd operated was distrusted) maybe $500 and year and higher. But your users don't care about the brand, so pick a cheaper product like Sectigo's they work just the same. It's a little more expensive if you want "Extended Validation" aka "EV Code Signing". If you write Windows kernel drivers you need this, otherwise it might only make the UI shown to inquisitive users nicer so don't bother unless you hate money. NB. Yes ISRG (the people behind Let's Encrypt) are trusted by Microsoft but no they aren't trusted to provide Code Signing certificates, even if they wanted to, which they do not.