Setup Windows signing infrasctucture

RESOLVED FIXED in Thunderbird 3.0b4


10 years ago
10 years ago


(Reporter: gozer, Assigned: gozer)


Thunderbird 3.0b4
Dependency tree / graph
Bug Flags:
blocking-thunderbird3 +

Firefox Tracking Flags

(Not tracked)


(Whiteboard: [no l10n impact][waiting for real cert])

We need a code signing certificate, make sure it's on one of these : <>, and verify we can use the existing signing automation.
Depends on: 499711
Looks like there is a place beside verisign/thwate where one can buy authenticode certificates:

Progress update. I now have a Windows Signing VM that is able to successfully Authenticode Sign against signing certificates stored in the smartcard.

Need to get the signing automation working now.
Depends on: 507442
david, it's time to go ahead and purchase an actual code signing certificate.

Comodo: 180/year
Thwate: 299/year
Verisign: $499/year

I've heard various negative comments about comodo, and verisign is somewhat of big beast (and expensive), so I'd rather suggest we try Thwate for 1 year and see how that goes. Changing/replacing the certificate is simple, so not a big commitment.
Assignee: nobody → gozer
Flags: blocking-thunderbird3+
Target Milestone: --- → Thunderbird 3.0b4
Whiteboard: [no l10n impact]
Code signing certificate ordered, David, expect somebody from Thawte to contact you to verify company info.
Whiteboard: [no l10n impact] → [no l10n impact][waiting for real cert]
Cert recieved! Tested signing automation with it, and all looks good.
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.