537324 - SeaMonkey release signing infrastructure

Status: RESOLVED DUPLICATE of bug 1438083

(mozilla.org :: Community Giving, task)

Description

[Robert Kaiser]

Bug 412031 has discussed code signing for community projects, ending in SeaMonkey needing its own infrastructure and cert to do that.

Now, we need to find out what infrastructure we need and how to get it.

joduinn and gozer have some experience with with that - can you tell me what infrastructure SeaMonkey should get for this?

For actually getting the infrastructure, we need to involve Seth and Community Giving.

Comment 3

[Justin Wood (:Callek)]

(In reply to comment #0)
> Bug 412031 has discussed code signing for community projects, ending in
> SeaMonkey needing its own infrastructure and cert to do that.
> 
> Now, we need to find out what infrastructure we need and how to get it.
> 
> joduinn and gozer have some experience with with that - can you tell me what
> infrastructure SeaMonkey should get for this?
> 

ping

Comment 5

[mancha]

Hi. I arrived here via bug #775762.

Being able to ensure code authenticity to within acceptable levels of uncertainty is important. More so, for programs like browsers which transport private and/or sensitive information such as online banking, etc.

Thank you for your renewed attention to this.

Comment 6

[mancha]

This seems to be the place where all duplicate bugs come to die and be buried. No substantive activity since late 2009!

Is there anyone on the dev side following this thread any longer? If so, maybe you can post a "hello" comment every year or two just to keep the bug report dynamic and overflowing with vigor.

Comment 7

[Justin Wood (:Callek)]

Rest assured this is high on our priority list, we just need to figure out the *legalese* regarding the signing certs themselves first. We are actively working on this.

Comment 8

[Steven Michaud [:smichaud] (Retired)]

I have a question which may be slightly off topic:

Mac builds of both Firefox and Thunderbird are now signed using an Apple account, so that they'll work properly on OS X 10.8 and up -- see bug 752613 and bug 756830.

But aside from bug 866049 (which has mistakenly been duped to this bug), I can't find about signing Mac builds of Seamonkey.

Should I open one?

Is it fair to say that we won't sign Mac Seamonkey builds before this bug is resolved?

Comment 9

[Justin Wood (:Callek)]

(In reply to Steven Michaud from comment #8)
> I have a question which may be slightly off topic:
> 
> Mac builds of both Firefox and Thunderbird are now signed using an Apple
> account, so that they'll work properly on OS X 10.8 and up -- see bug 752613
> and bug 756830.

Well, the SeaMonkey builds still work on 10.8 and up, they just are more difficult to install by default. To be clear :-)

> Should I open one?

I wouldn't yet (since I think there is a bug on it already, but if not I can always file one, I know its needed!)

> Is it fair to say that we won't sign Mac Seamonkey builds before this bug is
> resolved?

The two types of signing are disjoint, so not strictly reliant on each other. However the human to do the work (me) can't do both at the same time, and since we have a larger userbase on windows this bug is likely to happen first.

Comment 10

[Rainer Bielefeld]

Anything new here?

Comment 11

[mancha]

(In reply to Rainer Bielefeld from comment #10)
> Anything new here?

I don't think so.

When I asked 3 years ago, (:Callek) mentioned it was a high priority but they needed to deal with legal issues.

Justin, do you mind providing details on what the issues are? Three years is a very long time...

Thanks.

Comment 12

[Mike]

20180205 Monday

Using SeaMonkey 2.49.1 on Mac OS 10.11.6 El Capitan.

Still no code signature for SeaMonkey.

$ codesign -dv --verbose=4 /Applications/SeaMonkey.app
[RESULT:]
/Applications/SeaMonkey.app: code object is not signed at all

Comment 13

[Edmund Wong (:ewong)]

(In reply to Mike from comment #12)
> 20180205 Monday
> 
> Using SeaMonkey 2.49.1 on Mac OS 10.11.6 El Capitan.
> 
> Still no code signature for SeaMonkey.
> 
> $ codesign -dv --verbose=4 /Applications/SeaMonkey.app
> [RESULT:]
> /Applications/SeaMonkey.app: code object is not signed at all

The reason is we haven't signed our releases yet.  As it's pending resolution of this bug.