Xpra: Ticket #1499: Digitally sign the installer

Can the installation binary be digitally signed going forward? I think this will help the application get past some corporate security policies once the signing key is whitelisted there.

Thu, 13 Apr 2017 07:23:04 GMT - totaamwin32: attachment set

attachment set to xpra-ca.cer

self signed CA cert

Thu, 13 Apr 2017 07:24:13 GMT - Antoine Martin: attachment set

attachment set to install-xpra-ca.png

warning shown when installing the xpra ca file

Thu, 13 Apr 2017 07:24:32 GMT - Antoine Martin: attachment set

attachment set to UAC-warning-verified-publisher.png

UAC warning when installing the signed application

Thu, 13 Apr 2017 07:47:36 GMT - totaamwin32: owner changed

owner changed from Antoine Martin to andrewmunn

I assume that you are talking about MS Windows installers.

That's now done in r15584 based on the instructions found in How do I create a self-signed certificate for code signing on Windows?.

Note: you will need to install the self signed CA file first using:

certutil -user -addstore Root xpra-ca.cer

You will get a warning that looks like this:

But then when installing the application, the UAC dialog will look less threatening:

There are signed windows beta builds you can test: http://xpra.org/beta/windows. @andrewmunn: please close this ticket if that works for you.

Ultimately, we should use a proper CA, but at ~$160 per year. Those don't come cheap. One benefit of those certificates is that they are apparently trusted on Mac OSX too, so we wouldn't have to pay the apple developer fee to get the PKG / DMG signed (the apple developer account key has now expired, that was complete waste of money: see #1340).

Thu, 13 Apr 2017 07:49:45 GMT - Antoine Martin: keywords, milestone set

keywords win32 added
milestone set to 2.1

(edit milestone)

Mon, 17 Apr 2017 10:19:56 GMT - Antoine Martin:

Minor build system update: r15642

Thu, 11 May 2017 04:58:50 GMT - Antoine Martin: status changed; resolution set

status changed from new to closed
resolution set to fixed

Not heard back, closing.

Sat, 23 Jan 2021 05:25:58 GMT - migration script:

this ticket has been moved to: https://github.com/Xpra-org/xpra/issues/1499