Repository navigation
macOS packages and Windows MSIs are not signed #27694
Description
This possibly applies to other platforms as well.
Currently, the Rust installer comes up with this nice warning, making the user navigate to a settings pane and acknowledge to really start the installer. Administrators can also decide to completely deactivate this.
I think at least the official installers of Rust should be signed using an Apple Developer Certificate.
Reacted by Adam Ernst, mitchmindtree, Corey Farwell, Jason Priest, Jasper Weiss, Jonas Schievink, Kornel, Asesh and Ryan Avella
Activity
nagisa commentedon Aug 12, 2015
All our releases and their checksums, including OS X ones, are signed with PGP signature already.
I’m not disagreeing they could also be signed using whatever method Apple for their OSes, but I'm not convinced $100/$300 is a fair price for getting rid of this dialog. OTOH we probably could piggy back on the same account used to generate signatures for Firefox.
skade commentedon Aug 12, 2015
@nagisa If that is your issue, point me to a form where I can chip in 100$ yearly. Either we want to supply installers for their platform and then do it proper or we should just ship tarballs.
skade commentedon Aug 18, 2015
I think the same is true for the windows installer.
(Code signing certs for windows cost > $300 upwards, FWIW)
brson commentedon Aug 27, 2015
cc @edunham
Seems totally fixable in the infinite expanse of time.
skade commentedon Aug 27, 2015
I would be willing to invest time on building the signing tooling, but obviously can't help with certificate handling.
briansmith commentedon Oct 24, 2015
Note that on Windows 8 and later (or, at least, Windows 8.1), Windows Safescreen makes it look like it is impossible to run the installer, and so the installation experience is terrible all around. Especially with the new MSVC port reaching Stable, it would be great to have a Good OOBE on Windows, at least for the Stable releases.
rtoal commentedon Oct 26, 2015
I have the same problem on Chrome...
skade commentedon Oct 26, 2015
@rtoal Just in case: you can, in the meantime, go to "Systems Settings" -> "Security and Privacy" and click the appropriate button to still start the installation process.
skade commentedon Oct 26, 2015
@brson this ticket needs
A-windowsas well, or should windows be split into a separate issue?rtoal commentedon Oct 26, 2015
@skade Thanks but I just used homebrew which also has 1.3.0. :)
skade commentedon Jul 1, 2016
I'd like to bump this again, also, Servo has the same issue and cannot be easily run on OS X, as it is unsigned.
Manishearth commentedon Jul 1, 2016
I doubt this would be accepted by the Firefox people. You want your private keys locked down, having two projects with independent infrastructure share a key sounds like a bad idea. I think both Rust and Servo can get their own. Not sure if it should be the same one.
skade commentedon Jul 1, 2016
For reference, here's the issue for windows. #25457
11 remaining items
skade commentedon Nov 23, 2019
See rust-lang/rustup#1568 for updates, concerning rustup.
jendakol commentedon Apr 17, 2020
Hello, Avast guy speaking here 😃
It's shown up that we as an antivirus company have also kinda problem with not-detecting Rust compilers.
The problem is that we need to have files that are signed by known-certificate and the signature is included in the file itself. Using the method required by macOS and Windows would also be good for us. Without that, we have a problem with non-detecting Rust compilers again and again when a new version is published - it'd have to be uploaded to us "manually" after every release. That's a valid solution, however, unpreferred.
To cite one of our malware analysts: The only signature that Avast (and Windows) is able to understand is pkcs7 signature.
Thanks for the great work and for solving this issue!
emilyalbini commentedon Nov 4, 2020
We discussed this inside the infra team meeting, and we're going to start the technical work needed to ensure Rust packages are signed for Windows and macOS! Me and @Mark-Simulacrum are going to have a chat to think about an implementation plan soon.
Note that while we'll start the development work, actually turning it on in production will require the foundation to be up and running (to actually buy the certificates).
jrmoulton commentedon Mar 11, 2021
aidanhs commentedon Jun 8, 2021
@jrmoulton this issue is where progress will be tracked - if you haven't seen anything, it's because there (sadly) hasn't been any progress.
asesh commentedon Apr 12, 2024
raphaelokon commentedon Sep 11, 2024
paulsavoie commentedon Sep 11, 2024
Hi, just wanted to drop that here, as the price of the code signing certificate was mentioned. At the SignPath Foundation (disclaimer: I work for SignPath.io), we provide free code signing for OSS projects. The certificate is issued to our foundation but can only be used to sign builds from the open source repository (we verify that technically). It would just require you to add a signing build step in your GitHub Actions workflows.
asesh commentedon Sep 17, 2024
Manishearth commentedon Sep 17, 2024
Please refrain from bumping this issue with "I want this too" or "why hasn't this happened yet" or "any updated?" style comments.
This is the issue where this work is tracked. Any updates will be posted here. Whether or not this happens depends on the volunteers in the Rust project, especially the infra team, having time to prioritize and work on this.
Comments asking for things to speed up are not helpful and do not do anything to move the needle.