Mailing-List: contact infrastructure-dev-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: infrastructure-dev@apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Message-ID: <4FE8E5D5.9090403@rowe-clan.net>
Date: Mon, 25 Jun 2012 17:27:33 -0500
From: "William A. Rowe Jr." <wrowe@rowe-clan.net>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:13.0) Gecko/20120614 Thunderbird/13.0.1
MIME-Version: 1.0
To: infrastructure-dev@apache.org
Subject: Re: Official code signing certificate
References: 
 <CADBq88C+-KhLXhWDOkQseQCjmikEHazH+JNDbPCqXg8YpG9EPg@mail.gmail.com>
 <CAP-ksoiRO1JueKRX122uiMabmuC1Z-FKnU1ta+fqDhRLyXnnZA@mail.gmail.com>
 <CAFG6u8EyKt9FnK0Ukam6N9r_XSQ5FKs13q+_-HAn3JHUii7Zzw@mail.gmail.com>
 <CAP-ksohSq7DENHPLYrMNK4MtMeSMtnQZfgoJ3NdBtWeqbS2XQQ@mail.gmail.com>
 <CAFG6u8EWosWgQ-dAakjTcDFyM9a=VOq0zUF9-c1ohTLpv6FgQQ@mail.gmail.com>
 <CAP-ksojzBHqKOWQiXMe=c28AJutTydKWqNfV0GC6vmza1P1bEg@mail.gmail.com>
 <CADBq88AScy=uudn_eZXigki65KxLFx2MGuiPNXsnJbXtxNEvMw@mail.gmail.com>
 <a423c46b-e505-4465-b7f7-9ddf8c4ff546@blur>
 <CAFG6u8F2WRq1PTMrT5QwvMtU_m5tpcHMo3o6TG402=VoRH0w-g@mail.gmail.com>
In-Reply-To: 
 <CAFG6u8F2WRq1PTMrT5QwvMtU_m5tpcHMo3o6TG402=VoRH0w-g@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

On 6/23/2012 4:40 PM, Sam Ruby wrote:
> On Sat, Jun 23, 2012 at 5:33 PM, William A Rowe Jr <wrowe@rowe-clan.net> wrote:
>>
>> If we now have 5-7 projects looking for code signing, I'd suggest it is time
>> for Sam as VP infra, or his delegate, to re-approach the Symantec team and
>> find out the terms and conditions on their code signing service and the
>> cost.  Have a couple infra team members act as admins.  As I may be signing
>> objects I would prefer not to also be an admin, but would serve if pressed.
> 
> I've already stated that I'm willing to authorize the purchase of an
> ASF certificate should we need one.

Reiterating two options;

 1. Obtain an ASF code signing organization cert.  Build a service to automate
    the submission for signing in an audit-able and automated manner.  Unsigned
    blobs from svn in, signed blobs committed back to subversion for the project
    to then package or deploy.  Complete transparency over who submitted what
    binary bits.  A malicious or unintentionally viral package signature cannot
    be withdrawn.  We have an offer for such a cert, free, from Symantec.

 2. Sign up for the Symantec Code Signing service.  Several current infra root
    folks gain admin rights to create accounts for release managers.  RM's send
    up unsigned bits, get back signed bits.  Each binary has it's own unique
    cert which can be later invalidated due to malicious or unintentionally
    viral package contents.  We have an offer for such a service, free, from
    Symantec.

Reinventing the wheel seems so foolish now that Symantec went from initially
discussing prices for option 2 to telling us we would be invited to use that
service for free.

Bill