1228428 - Sign MozillaBuild installer executables

Status: VERIFIED FIXED

(Firefox Build System :: MozillaBuild, task)

Description

[Wan-Teh Chang]

When I run the MozillaBuild 2.1.0 installer, Windows says the publisher
is unknown. The installer executables should be signed.

Until then, I suggest that in the announcements of new releases, we
provide HTTPS download URLs. For example,

https://ftp.mozilla.org/pub/mozilla.org/mozilla/libraries/win32/MozillaBuildSetup-Latest.exe

instead of

http://ftp.mozilla.org/pub/mozilla.org/mozilla/libraries/win32/MozillaBuildSetup-Latest.exe

Comment 1

[Ryan VanderMeulen [:RyanVM]]

I have no idea what it would take to properly sign the installer. Do you have suggestions on where to start, catlee?

Comment 2

[Chris AtLee [:catlee]]

It would have to be a manual process by releng at this point, assuming we want to use the same certs that we're using for Firefox. Would you just want the installer signed, or contents as well?

Comment 3

[Wan-Teh Chang]

Chris: I am not sure what it means to sign just the installer vs.
the contents as well. I want the installer signed, but I am not
requesting that we sign the individual .exe files in the package.
Did I understand your question correctly?

Comment 4

[Ryan VanderMeulen [:RyanVM]]

I think signing just the installer itself would suffice. I'd be hesitant to sign others' binaries anyway.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Rail, do you know what the process would be for doing this? I'm intending to ship the next MozillaBuild release soon and it would be great if we could do this as part of that.

Comment 6

[Rail Aliiev [:rail]]

The process would be something like:

1) provide the file URL and the checksums
2) ping someone who can access to the signing servers:
    catlee
    bhearsum
    nthomas
    rail
    coop
    hwine

Comment 7

[Ryan VanderMeulen [:RyanVM]]

This was done for the 2.2 release with help from Rail. For now, I guess it'll need to be a manual process (albeit not horribly burdensome since it only takes a few minutes and MozillaBuild releases aren't terribly frequent).

To document this for future reference, a copy of the unsigned installer and its sha-512 hash were provided so Rail could run it through a Taskcluster-based signing job. We initially ran into problems with Windows SmartScreen because the old sha1 certificate was used for signing instead of the newer sha256 one, so we'll want to verify that in the future for later releases.

Comment 8

[Wan-Teh Chang]

When I installed the 2.2 release, Windows showed a verified
publisher of Mozilla Corporation. Thank you!

Nit: in the release notes, it would be good to use HTTPS in
the download URL (and also the changelog URL):

https://ftp.mozilla.org/pub/mozilla.org/mozilla/libraries/win32/MozillaBuildSetup-Latest.exe

Comment 9

[Ryan VanderMeulen [:RyanVM]]

(In reply to Wan-Teh Chang from comment #8)
> Nit: in the release notes, it would be good to use HTTPS in
> the download URL (and also the changelog URL):

Yeah, that came up in the dev-platform thread already. It was an oversight on my part and won't happen next release.