Mailing-List: contact ooo-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: ooo-dev@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of dave2wave@comcast.net
 designates 76.96.27.243 as permitted sender)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1084)
Subject: Re: Symantec WS.Reputation.1 Errors: What we can do
From: Dave Fisher <dave2wave@comcast.net>
In-Reply-To: 
 <CAP-ksojJ8nkCMgsT_1U7m3J4L1YCiDU6tzjbOQddr1JSWzaMJg@mail.gmail.com>
Date: Fri, 2 Mar 2012 10:15:23 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <A2693DFA-A969-48B1-8593-8E2432975F3B@comcast.net>
References: 
 <CAP-ksohkJPZkPx4rvsvkeKa_RzaXVW9b3bE7ySi=wnX=r5rQhQ@mail.gmail.com>
 <FC637421-86AC-41B0-B9C6-6D1E9CE0C788@comcast.net>
 <CAP-ksojJ8nkCMgsT_1U7m3J4L1YCiDU6tzjbOQddr1JSWzaMJg@mail.gmail.com>
To: ooo-dev@incubator.apache.org


On Mar 2, 2012, at 9:52 AM, Rob Weir wrote:

> On Fri, Mar 2, 2012 at 12:25 PM, Dave Fisher <dave2wave@comcast.net> =
wrote:
>>=20
>> On Mar 2, 2012, at 7:00 AM, Rob Weir wrote:
>>=20
>>> Several testers have mentioned this anti-virus error when installing
>>> the AOO 3.4 dev snapshot build.   This is not a virus.
>>> "WS.Reputation" errors come from Symantec Antivirus based on their
>>> "reputation-based" threat assessments.  Essentially, they evaluate
>>> software that you are about to install according to a range of
>>> factors, including how new the file is, how many other people have
>>> installed it, whether the installer is digitally signed, etc.  It is
>>> not just one factor, but a proprietary mix of weighted factors.
>>>=20
>>> We're probably getting penalized based on several of these factors.
>>> Note that with the final AOO 3.4 release we'll be in the same
>>> position, since that installer will also be new,etc.
>>>=20
>>> A few things we should consider doing:
>>>=20
>>> 1) Make sure the readme file and install instructions cover this =
case
>>> and explain what the user should do, e.g. "Run anyways"
>>>=20
>>> 2) We can make a request to Symantec to "whitelist" our installer.
>>> This takes a couple of weeks for them to process.  And we can';t =
start
>>> this work in advance since they need the SHA-256 hash of our
>>> installer:
>>>=20
>>> https://submit.symantec.com/whitelist/isv/
>>>=20
>>> 3) We could digitally sign our Windows installers.   Apache already
>>> requires a detached signature.  But Symantec has no idea about =
these.
>>> We need traditional Windows exe code signing.  This will help us =
with
>>> Windows 8 as well.  So it is something we probably want to look into
>>> at some point.
>>=20
>> This is likely to be a release requirement. Remember all artifacts in =
an Apache Release must be signed and installers are artifacts. (This =
touches  your discussion on the other thread about what is AOO, what is =
powered by, and what is "White Label")
>>=20
>=20
> Right.  But all that is required are *detached* signatures.  These are
> fine for human verification, but they don't help in this case.
>=20
>> I believe that signing process is being worked on elsewhere in the =
foundation in a way that can make this an easy part of the release =
process. I've a little experience with signing installers a few years =
ago, but I won't have many cycles for it for a few weeks. I'll look in =
my ML archives and ask the question on the appropriate Incubator ML =
about our participation in these tests.
>>=20
>=20
> With current approach, it is based on "web of trust". So Release
> Manager, and other PMC members verify and sign.   But normal code
> signing on Windows is more hierarchical, and based on a trusted root
> CA, etc.  Is the plan to have each PMC have its own signing cert?  In
> this case the IPMC?

I'll need to confirm the status with Infrastructure, but I think that an =
ASF wide certificate was being considered. There was a lot of debate and =
it is hard to know without followup what happened. I'll ask now.

Regards,
Dave


>=20
> -Rob
>=20
>> Regards,
>> Dave
>>=20
>>>=20
>>> My recommendation:
>>>=20
>>> Plan on doing 1.  Do 2. as soon as we have a release.  Look into 3. =
for AOO 4.0.
>>>=20
>>> Regards,
>>>=20
>>> -Rob
>>=20