Is code signing necessary?

[wiktor-k]

Hi,

We've just released a new version of OpenPGP Card SSH Agent with support for Windows and we're wondering about distributing the service via winget but it's not clear if we need to acquire code signing certificates for the installer (we're planning to use cargo-wix to build the installer) or not.

Sorry if this is a basic question but I couldn't find it in Discussions and Issues.

Thanks for your time! 👋

[denelon]

WinGet doesn't require code signing, but some users are likely to be concerned about unsigned installers.

[wiktor-k]

Is there any indication that the code is unsigned that the user will see? (Eg a prompt with a warning).

Given recent developments with xz I'd rather use signed installers but if there's no practical difference for the end user making the build process more complex wouldn't be worth it.

Thanks for your time! 🙇‍♂️

[denelon]

Currently, not from WinGet. We're gradually beefing up the UX to include more things related to security, but for now, those checks happen during validation, and aren't blocking.

[wiktor-k]

Thanks for the answer. So I'll build the unsigned version and push the manifest to winget and in parallel setup signing to be ready when you flip the improved security flag.

[tonymet]

are there any recommendations for open source developers to add codesigning? The options I've discovered are

1. purchase a proper codesign cert e.g. from Comodo for $250-400 / yr -- outside open source maintainer budget
2. a couple free/ open source CAs but they aren't root CAs so the CA would require manual install e.g. sigpath, signstore.
3. self-sign the .exe to improve MS Defender Smart Screen signal , but this still does not pass signtool verification .

Could someone @ MS help provide some guidance on best practices for installing a signed CLI .exe via winget

[wiktor-k]

I wonder if you've seen https://about.signpath.io/product/open-source which should be free for open-source projects and having CA in OS-trusted store.

I didn't use it but noticed a couple of open-source projects do.

[tonymet]

I wonder if you've seen https://about.signpath.io/product/open-source which should be free for open-source projects and having CA in OS-trusted store.

thanks for the recommendation I looked at that as an option. I reviewed 5 similar open source projects (including act and crush) on winget and noticed that they do not sign their exe . They are distributed with .zip + unsigned exe to prevent malware blocking.

Our goal is to distribute with winget without any MS Defender antivirus or MS Defender Smart-Screen warnings

[denelon]

Azure Trusted Signing could be another alternative.