Open Bug 1366570 Opened 4 years ago Updated 1 month ago

mozregression installers and executables for windows and mac are not signed

Categories

(Testing :: mozregression, defect)

defect
Not set
normal

Tracking

(Not tracked)

People

(Reporter: 61.1p57, Unassigned)

References

(Blocks 1 open bug)

Details

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0
Build ID: 20170518105722

Steps to reproduce:

1. Download mozregression-gui.exe from GitHub
2. Run as admin (per Bug 1192488)


Actual results:

UAC shows "Verified publisher: Mozilla"


Expected results:

UAC warns about unknown publisher
(In reply to 61.1p57 from comment #0)

> Actual results:
> 
> UAC shows "Verified publisher: Mozilla"
> 
> 
> Expected results:
> 
> UAC warns about unknown publisher

Ah, "actual results" and "expected results" are reversed... apologies
Thanks for the report. Our current infrastructure doesn't really make it easy to sign the windows builds (at least as far as I know), so I'm not sure when this will be fixed. No reason not to leave this open though, in case a solution presents itself...
(In reply to 61.1p57 from comment #0)
> User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0)
> Gecko/20100101 Firefox/54.0
> Build ID: 20170518105722
> 
> Steps to reproduce:
> 
> 1. Download mozregression-gui.exe from GitHub
> 2. Run as admin (per Bug 1192488)
> 
> 
> Actual results:
> 
> UAC shows "Verified publisher: Mozilla"
> 
> 
> Expected results:
> 
> UAC warns about unknown publisher

In my case even a window of Windows Defender SmartScreen pops up. If I remember it correctly, I haven't ever changed the settings of it.
Status: UNCONFIRMED → NEW
Ever confirmed: true
QA Contact: connect

This now applies to the Mac as well.

Summary: mozregression installer for windows is not signed → mozregression installers for windows and mac are not signed

Hi Chris, please don't consider this an urgent request, but I'm wondering how possible it would be to produce signed versions of mozregression? It seems like mozregression is getting detected as a virus on Windows and is rather difficult to install on Mac due to this issue.

Currently mozregression is being built with travis/appveyor but moving it over to the taskcluster community instance should be possible.

Flags: needinfo?(catlee)

(In reply to William Lachance (:wlach) (use needinfo!) from comment #5)

Hi Chris, please don't consider this an urgent request, but I'm wondering how possible it would be to produce signed versions of mozregression? It seems like mozregression is getting detected as a virus on Windows and is rather difficult to install on Mac due to this issue.

Currently mozregression is being built with travis/appveyor but moving it over to the taskcluster community instance should be possible.

Gotten a bunch more reports on this issue.

I did some more research, and it does appear signing is technically possible- for example we do this for taskcluster builds of firefox reality on the community instance: https://github.com/mozilla/community-tc-config/blob/master/config/projects/firefoxreality.yml

So realistically this means something like:

  1. Set up a mozregression group on taskcluster's community instance (not very difficult: #taskcluster on Matrix can probably help)
  2. Port mozregression's ci to taskcluster (a day or two's worth of work? not sure how difficult tbh)
  3. Figure out how to sign pyinstaller-produced binaries on (at least) Mac and Windows (pretty easy, most likely)
  4. Figure out who at Mozilla can provide them, then add certificates and whatever artifacts necessary to do signing to taskcluster
  5. Actually sign builds produced from mozilla/mozregression (making sure that pull requests coming from forks are not signed)

So probably not a huge amount of work, but not trivial either-- 4 in particular might require some help/favours from other parts of Mozilla.

Flags: needinfo?(catlee)

This is a little different, but similar enough that it's worth connecting some things: geckodriver does something like this over in https://bugzilla.mozilla.org/show_bug.cgi?id=1427849 and related tickets.

If you are making infrequent releases, you can ask RelEng to manually sign the releases.

eg. bug 1588707 where I did that for the MozillaBuild NSIS installer.

(In reply to :glob 🎈 from comment #8)

If you are making infrequent releases, you can ask RelEng to manually sign the releases.

eg. bug 1588707 where I did that for the MozillaBuild NSIS installer.

Thanks :glob, that sounds like a good interim solution. Filed bug 1661025 about that, let's see where it goes.

(In reply to William Lachance (:wlach) (use needinfo!) from comment #9)

(In reply to :glob 🎈 from comment #8)

If you are making infrequent releases, you can ask RelEng to manually sign the releases.

eg. bug 1588707 where I did that for the MozillaBuild NSIS installer.

Thanks :glob, that sounds like a good interim solution. Filed bug 1661025 about that, let's see where it goes.

Ok so that worked, at least for Windows. However I realized (too late) that the problem isn't in the installer, it's the actual mozregression executable that gets installed. :aki and I talked about this a bit, and I think the most viable way forward is to move this in-tree and (eventually) reuse Firefox's signing mechanisms. Not sure when we'll have time to do that, but I'll file a bug soon.

Summary: mozregression installers for windows and mac are not signed → mozregression installers and executables for windows and mac are not signed

As per discussion in https://bugzilla.mozilla.org/show_bug.cgi?id=1661025#c4 -- it seems like the "right way" to solve this issue is to move mozregression in-tree, where we can reuse the existing signing/trust infrastructure for Firefox.

It occurs to me that we could possibly just make the in-tree version a mirror if we want to continue development on GitHub.

You need to log in before you can comment on or make changes to this bug.