Lunie: Signed setup files

Created on 13 Feb 2018 · 7Comments · Source: luniehq/lunie

Version

0.4.1

Description

Greg stated again, that he would like to see setup files to distribute. He says, that signed setup files are state of the art and should have enough security to distribute.

Pulling in @greg-szabo

blocked ✋

Source

faboweb

All 7 comments

How Tor did it:
https://blog.torproject.org/deterministic-builds-part-two-technical-details

nylira on 3 Jul 2018

Windows

Two Types
- Standard
- EV (Extended Validation) takes longer, costs more, required for hardware products
Distributed on USB (globalsign.com link)
Location Required (globalsign.com link)
Timestamp from here required (globalsign.com link)
Can be bought from anyone listed here (microsoft.com link)

Mac

Need Apple Developer Certificate
Electron Signing (electron-userland/electron-osx-sign link)

Electron

Electron Docs (electron.build link)
Windows Installer (electron/windows-installer link)
- Mac Electron Installer (mongodb-js/electron-installer-dmg link)
- Tutorial (christianengvall.se link)
- Unable to sign (issue link)
Uses squirrel for auto-updates and signing certs (github.com/Squirre mac, github.com/Squirre windows)
- Windows needs to be run from a windows machine or VM
Auto-deploy tutorials
- pracucci.com link
- medium.com/heresy-dev link
Packing Tutorial (medium.com/how-to-electron link)
- Electron Builder (electron-userland/electron-builder link
- Electron Packer (electron-userland/electron-packager link)

Other Links

Deterministic build that Tor uses (devrandom/gitian-builder link)

okwme on 5 Jul 2018

🎉1

Nice writeup. Thank you.

faboweb on 5 Jul 2018

👍1

Hurdles:

We need to sign the mac app on an OSX machine.
We need to sign the windows app on wine or a windows machine.
Mac would have the developer account that needs to be made by a cosmos/tendermint admin and then the private key would need to be managed somehow.
Basically the same would need to happen for windows, but they would be managing the private key on a USB stick.

okwme on 9 Jul 2018

👍1

It looks like there are two separate problems to solve here:

making a deterministic installer
signing the installer

There's a lot of information in this issue about signing so I've created https://github.com/cosmos/voyager/issues/969 for the deterministic installer.