Julia: Sign windows binaries correctly and enable for Windows Desktop Application Analytics

[davidanthoff]

https://blogs.windows.com/buildingapps/2018/01/23/introducing-windows-desktop-program-desktop-application-analytics/

I believe essentially it should be enough that the julia.exe is code signed with the Julia Computing certificate (for the prebuilt binaries from the web that is not the case right now, only the installer seems code signed), and then someone from Julia Computing needs to sign up for that program.

I believe at that point you would automatically get usage statistics and crash reports that Windows collects for julia. There would be really two benefits: a) probably much more reliable usage data than download numbers (at least for Windows) and b) you learn about those bugs that no one bothers to report manually.

We recently enabled crash reporting for the julia VS Code extension, and it is quite eye opening what kind of bugs you learn about when you do that :)

[ViralBShah]

This is a great idea. We should do it.

cc @mdpradeep @aviks

[davidanthoff]

Bump, any chance this might be done for 1.2? I think it should be relatively easy, but the payoff seems really, really significant.

[KristofferC]

Won't happen for 1.2 at least which has been in bugfix mode for a long time.

[davidanthoff]

Maybe it would be possible to add code signing of the produced exe to the nightly build and see how that goes?

[ViralBShah]

Fixed in https://github.com/JuliaCI/julia-buildbot/pull/129

[ViralBShah]

@davidanthoff Should we need to do anything further?

[ViralBShah]

@mdpradeep Can you sign us up for the relevant program at Microsoft so we can get access to the various stats?

[davidanthoff]

My understanding is that this should be enough :)

[mdpradeep]

This was set up about 2 weeks ago but it does not seem to be pulling any data although it recognizes the certificates (as it is able to recognize the certs).

[davidanthoff]

Might it make sense to try to resolve this via MS support, even if it costs something? It seems to me that this info would be really valuable (because you would get that data even for users that haven't opted-in for any Julia telemetry, it would be enough that they opted into the Windows telemetry at some point).

[ViralBShah]

@mdpradeep Do we have to enable the analytics or something? Can we file a microsoft support issue? Perhaps it is gathering data on newer Julia releases with the internal julia.exe also being signed?

[davidanthoff]

I took another look at the Julia binaries, and as far as I can tell they are not signed correctly. If that is so, then it is not surprising that this is not working properly.

Here is why I think that is so: when I look at the properties (in explorer) of say code.exe (the VS Code binary), I see a tab "Digital Signatures" in there, and then a signature from MS.

When I look at the properties of julia.exe, I don't even see a tab for Digital Signatures, which seems to suggest that minimally there is some difference in how these exes are signed (if the Julia binary is signed at all).

CC @staticfloat

[ViralBShah]

I think we only sign the installer.

[davidanthoff]

I thought https://github.com/JuliaCI/julia-buildbot/pull/129 was meant to sign the julia.exe? For this issue here to work, the julia.exe needs to be signed.

[staticfloat]

So I looked into this, and the mono signcode is returning success and modifying the .exe, but Windows explorer and the SignTool from the windows 10 SDK doesn't show any signatures. So there's probably a bug in the mono signcode implementation.

[davidanthoff]

Sorry, I should have followed up on this: I came to the same conclusion, but via a different path :)

I’ve been playing around a lot with the MSIX stuff. And the MSIX toolchain seems to think that the official Julia.exe that is ships as part of the Julia setup has an invalid format (and so I can’t actually put it into an MSIX installer). I can also not sign the exe that is in the official installer with the SDK signtool, it also complains about a badexe format.

So what I’ve been doing instead is building from source, and then signing the Julia.exe (and all dlls) with the SDK signtool myself. Works like a charm, and those signed files are accepted by the MSIX toolchain.

So my guess is that the mono signtool actually adds a corrupt signature, that is ignored by Windows, but not the MSIX toolchain.

Why not try to use the SDK signtool again? That must literally be used to sign thousands of files every day, and at least in my experiments over the last weeks it worked without a flaw..

[staticfloat]

Why not try to use the SDK signtool again? That must literally be used to sign thousands of files every day, and at least in my experiments over the last weeks it worked without a flaw..

It would work for weeks, then mysteriously stop working. It would fail with internal error codes that would not go away unless I wiped the windows buildbots and reinstalled windows from scratch, then would stop working after a few weeks again. I was never able to figure out what was wrong.

[davidanthoff]

Hm, that sounds really strange for a tool that must be used so widely? Isn’t like almost every single piece of Windows software signed with it? Is there maybe something strange going on with the build bot machines? Also, I think it probably gets updated with every SDK release, maybe worth trying with the latest version?

Can you point me to the code where the actual signtool is invoked? I could try to cross check it with how I have run it, maybe it is a config problem?

[ViralBShah]

Is it possible to use whatever the standard Windows SDK thing is instead of Mono's tool to sign? I am assuming the Mono one is different from Microsoft official, reading this discussion.

[ViralBShah]

Could this also be the reason why we have ongoing issues with antivirus programs?

[davidanthoff]

Who knows what antivirus programs do, but if one can appease them by having a properly signed exe and dlls (which seems fairly plausible), then yes, I could imagine that signing correctly might help :)

[davidanthoff]

https://www.microsoft.com/security/blog/2018/08/16/partnering-with-the-industry-to-minimize-false-positives/ suggest that it might help a lot with the antivirus issues.

[ViralBShah]

Could it be that we need some new type of certificate?

[davidanthoff]

The installer exe seems to get properly signed, which seems to suggest that the certificate is ok?