[jira] [Created] (DAFFODIL-3090) Sign Windows exe installer

["Steve Lawrence (Jira)" <ji...@apache.org>]

Steve Lawrence created DAFFODIL-3090:
----------------------------------------

             Summary: Sign Windows exe installer
                 Key: DAFFODIL-3090
                 URL: https://issues.apache.org/jira/browse/DAFFODIL-3090
             Project: Daffodil
          Issue Type: Improvement
          Components: Infrastructure
            Reporter: Steve Lawrence
             Fix For: 4.3.0


Daffodil currently signs all release artifacts using detached signatures, as required by ASF.

Additionally, for RPM we embed signatures in th e RPM file, which  improves integration and signature validation with things like DNF.

But we do not embed signatures in our EXE windows installer. This results in an "Unknown Publisher" warning when installing the executable. Users are allowed to accept this risk and continue to install anyways, but it would be nice it we could avoid this and it would instead show up as a trusted Apache Software Foundation publisher.

Apache INFRA allows use of ssl.com for embedding signatures in exe files: https://infra.apache.org/code-signing-use.html.

We should see about enabling this process. I believe the tasks to complete this are:

1. Open a ticket with INFRA to add ssl.com credentials to our repositories as secrets (note that this is different than what the above link recommends about each release manager creating an account, but because Daffodil has been approved to use [automated release signing|https://infra.apache.org/release-signing.html#automated-release-signing] hopefully infra can do the same thing with ssl.com credentials). 
2. Update our release candidate action to use those secrets to sign our exe files using jsign (we may need to download and install jsign as part of the action)
3. Update the daffodil release-candidate workflow to provide the secrets to the action
4. Update the check-release script to strip the exe signatures during reproducibility checks (similar to what we already do for RPM) 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)