[SAC] purchase of cert to sign windows applications

Breaking out an new email thread for this (it is time critical for GeoServer 2.10 release). The GeoServer release is scheduled for Oct 26th, this bug just came up in the test of our release candidate a few days ago…

I would like to request a certificate to be used for signing windows applications (GeoServer, QGIS, OSGeo4Win, etc…). The cost appears to be around $200 USD a year.

Related tickets:

···


Jody Garnett

On 25-10-16 02:55, Jody Garnett wrote:

Breaking out an new email thread for this (it is time critical for
GeoServer 2.10 release). The GeoServer release is scheduled for Oct
26th, this bug just came up in the test of our release candidate a few
days ago...

I would like to request a certificate to be used for signing windows
applications (GeoServer, QGIS, OSGeo4Win, etc...). The cost appears to
be <https://www.digicert.com/code-signing/code-signing.htm&gt; around $200
USD a year.

Related tickets:
- https://trac.osgeo.org/osgeo/ticket/1813
- https://osgeo-org.atlassian.net/browse/GEOS-7812

We (as QGIS) also had Larry asked to use/buy a (mac only?) certificate
to sign our QGIS binaries for Mac. Not sure what the status is for that
though.
@Larry did we/you buy something in the end?

I think for OSGeo it is a wise thing to be the signer of all GeoFOSS.

Regards,

Richard Duivenvoorde

On Tue, Oct 25, 2016 at 9:11 AM, Richard Duivenvoorde <richard@duif.net> wrote:
...

I think for OSGeo it is a wise thing to be the signer of all GeoFOSS.

+1

Markus

I can answer that, the mac certificate is purchased and is used for QGIS releases, and was also used to sign the GeoServer 2.9.2, see the release anouncement for a screen snap showing the difference this makes:

http://blog.geoserver.org/2016/10/12/geoserver-2-9-2-released/

(This change allows OSGeo to be “an identified developer” in macOS 10.12)

···

On 25 October 2016 at 00:11, Richard Duivenvoorde <richard@duif.net> wrote:

On 25-10-16 02:55, Jody Garnett wrote:

Breaking out an new email thread for this (it is time critical for
GeoServer 2.10 release). The GeoServer release is scheduled for Oct
26th, this bug just came up in the test of our release candidate a few
days ago…

I would like to request a certificate to be used for signing windows
applications (GeoServer, QGIS, OSGeo4Win, etc…). The cost appears to
be <https://www.digicert.com/code-signing/code-signing.htm> around $200
USD a year.

Related tickets:

We (as QGIS) also had Larry asked to use/buy a (mac only?) certificate
to sign our QGIS binaries for Mac. Not sure what the status is for that
though.
@Larry did we/you buy something in the end?

I think for OSGeo it is a wise thing to be the signer of all GeoFOSS.

Regards,

Richard Duivenvoorde


Sac mailing list
Sac@lists.osgeo.org
http://lists.osgeo.org/mailman/listinfo/sac


Jody Garnett

On Tue, Oct 25, 2016 at 01:51:31PM -0700, Jody Garnett wrote:

I can answer that, the mac certificate is purchased and is used for QGIS
releases, and was also used to sign the GeoServer 2.9.2, see the release
anouncement for a screen snap showing the difference this makes:

http://blog.geoserver.org/2016/10/12/geoserver-2-9-2-released/

Is the screenshot with a yellow exclamation mark warning sign what
you get with a _signed_ download ?

--strk;

maybe I should label those pictures before and after

···

On 26 October 2016 at 01:58, Sandro Santilli <strk@kbt.io> wrote:

On Tue, Oct 25, 2016 at 01:51:31PM -0700, Jody Garnett wrote:

I can answer that, the mac certificate is purchased and is used for QGIS
releases, and was also used to sign the GeoServer 2.9.2, see the release
anouncement for a screen snap showing the difference this makes:

http://blog.geoserver.org/2016/10/12/geoserver-2-9-2-released/

Is the screenshot with a yellow exclamation mark warning sign what
you get with a signed download ?

–strk;


Sac mailing list
Sac@lists.osgeo.org
http://lists.osgeo.org/mailman/listinfo/sac


Jody Garnett