You are viewing a plain text version of this content. The canonical link for it is here.
Posted to marketing@couchdb.apache.org by Joan Touzet <jo...@lrtw.org> on 2014/10/07 01:00:20 UTC
Code-signing binary releases?
Presented with no bias on my part, but it showed up in my inbox:
https://blogs.apache.org/infra/entry/code_signing_service_now_available
Do we care to use something like this for our Windows binary builds?
Or are we happy enough to just publish a Windows binary with a checksum?
I can see the advantage in signing Windows binaries here.
If we add Java or Android components in the future, this could extend to
signing those binaries as well. I am sufficiently naive about those
environments to not know whether there exist better, freer, more open
alternatives that would suffice.
What is the process for signing things that end up in the OSX App Store?
Would we want to try and get CouchDB in there, or just stick with brew?
-Joan
Re: Code-signing binary releases?
Posted by Jan Lehnardt <ja...@apache.org>.
On 07 Oct 2014, at 01:00 , Joan Touzet <jo...@lrtw.org> wrote:
> Presented with no bias on my part, but it showed up in my inbox:
>
> https://blogs.apache.org/infra/entry/code_signing_service_now_available
>
> Do we care to use something like this for our Windows binary builds?
> Or are we happy enough to just publish a Windows binary with a checksum?
> I can see the advantage in signing Windows binaries here.
I have no experience with what that would mean for us and for the end user,
but I assume it is streamlining a user experience and give a bit of a sense
of security?
> If we add Java or Android components in the future, this could extend to
> signing those binaries as well. I am sufficiently naive about those
> environments to not know whether there exist better, freer, more open
> alternatives that would suffice.
>
> What is the process for signing things that end up in the OSX App Store?
Getting CouchDB into the Mac OS X App Store would require us to statically
link all of Erlang and Spidermonkey into the Mac OS X bundle, as the
guidelines do not allow fork(). It is certainly possible, but at this
point probably not something we want to spend too much time on right away.
> Would we want to try and get CouchDB in there, or just stick with brew?
One thing I’ve been meaning to do is sign the release on our website anyway,
as it will make installing CouchDB easier, even when not pushed through the
App Store. Currently people have to go through a bit of a security dance
before they can “double click and run”. We can make this smooth, but I haven’t
had the time to set this up. I also have done no research as to how it would
work for the ASF to have this set up, as the private key would have to be
shared with anyone who makes builds. For the time being my plan was to use
my own Apple Developer Account and identity to do the signing. If someone
is inclined to figure out how to do this ASF-wide, I’d welcome that, though :)
Best
Jan
--
>
> -Joan
Re: Code-signing binary releases?
Posted by Jan Lehnardt <ja...@apache.org>.
On 07 Oct 2014, at 01:00 , Joan Touzet <jo...@lrtw.org> wrote:
> Presented with no bias on my part, but it showed up in my inbox:
>
> https://blogs.apache.org/infra/entry/code_signing_service_now_available
>
> Do we care to use something like this for our Windows binary builds?
> Or are we happy enough to just publish a Windows binary with a checksum?
> I can see the advantage in signing Windows binaries here.
I have no experience with what that would mean for us and for the end user,
but I assume it is streamlining a user experience and give a bit of a sense
of security?
> If we add Java or Android components in the future, this could extend to
> signing those binaries as well. I am sufficiently naive about those
> environments to not know whether there exist better, freer, more open
> alternatives that would suffice.
>
> What is the process for signing things that end up in the OSX App Store?
Getting CouchDB into the Mac OS X App Store would require us to statically
link all of Erlang and Spidermonkey into the Mac OS X bundle, as the
guidelines do not allow fork(). It is certainly possible, but at this
point probably not something we want to spend too much time on right away.
> Would we want to try and get CouchDB in there, or just stick with brew?
One thing I’ve been meaning to do is sign the release on our website anyway,
as it will make installing CouchDB easier, even when not pushed through the
App Store. Currently people have to go through a bit of a security dance
before they can “double click and run”. We can make this smooth, but I haven’t
had the time to set this up. I also have done no research as to how it would
work for the ASF to have this set up, as the private key would have to be
shared with anyone who makes builds. For the time being my plan was to use
my own Apple Developer Account and identity to do the signing. If someone
is inclined to figure out how to do this ASF-wide, I’d welcome that, though :)
Best
Jan
--
>
> -Joan
Re: Code-signing binary releases?
Posted by Nick North <no...@gmail.com>.
+1
If the service is there it seems a good idea to use it, and we are
providing code that runs as a service so signing seems a good idea.
However, CouchDb has never provoked the warnings that Windows gives about
unsigned code for me, even though I have UAC enabled on all my systems.
This may because I'm an admin user on all of them though.
I had a very quick poke around and found this discussion on the Tomcat
mailing list of the effect of signing in Windows and why they need it:
Digitally
sign the Windows binaries.
<https://issues.apache.org/bugzilla/show_bug.cgi?id=56079>
Nick
On 7 October 2014 00:25, Alexander Shorin <kx...@gmail.com> wrote:
> This is good idea. +1
> --
> ,,,^..^,,,
>
>
> On Tue, Oct 7, 2014 at 3:00 AM, Joan Touzet <jo...@lrtw.org> wrote:
> > Presented with no bias on my part, but it showed up in my inbox:
> >
> > https://blogs.apache.org/infra/entry/code_signing_service_now_available
> >
> > Do we care to use something like this for our Windows binary builds?
> > Or are we happy enough to just publish a Windows binary with a checksum?
> > I can see the advantage in signing Windows binaries here.
> >
> > If we add Java or Android components in the future, this could extend to
> > signing those binaries as well. I am sufficiently naive about those
> > environments to not know whether there exist better, freer, more open
> > alternatives that would suffice.
> >
> > What is the process for signing things that end up in the OSX App Store?
> > Would we want to try and get CouchDB in there, or just stick with brew?
> >
> > -Joan
>
Re: Code-signing binary releases?
Posted by Alexander Shorin <kx...@gmail.com>.
This is good idea. +1
--
,,,^..^,,,
On Tue, Oct 7, 2014 at 3:00 AM, Joan Touzet <jo...@lrtw.org> wrote:
> Presented with no bias on my part, but it showed up in my inbox:
>
> https://blogs.apache.org/infra/entry/code_signing_service_now_available
>
> Do we care to use something like this for our Windows binary builds?
> Or are we happy enough to just publish a Windows binary with a checksum?
> I can see the advantage in signing Windows binaries here.
>
> If we add Java or Android components in the future, this could extend to
> signing those binaries as well. I am sufficiently naive about those
> environments to not know whether there exist better, freer, more open
> alternatives that would suffice.
>
> What is the process for signing things that end up in the OSX App Store?
> Would we want to try and get CouchDB in there, or just stick with brew?
>
> -Joan