Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

111–120 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#111

Post by vasdae »

rand846633 wrote: post #62
keepamovin wrote: post #59

It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature. It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon. Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves. It’s a sobering…

It’s also not clear why the IM project should be paying MS and not the other way round…

MS does not sell certificates.

Re: The Windows installer of ImageMagick will no longer be signed

#112

Post by thequux »

galkk wrote: post #107
1letterunixname wrote: post #68

Earlier quoted context omitted.

Nawh, it's just a Scheme.

lol, I never thought about scheme/racket naming in this context. Is this an inside joke in the community or maybe even a an official take?

Scheme was the third in a series of languages designed at the MIT AI lab; the first two were Planner and Conniver. The third was going to be called Schemer, but ITS only allowed 6-character filenames (because, encoded in sixbit, that fits in one machine word). Thus the pattern was established from the very beginning.

Also consider that another widely-used scheme implementation is called Guile.

Re: The Windows installer of ImageMagick will no longer be signed

#113

Post by orra »

justinclift wrote: post #82

Has anyone here tried out that SignPath ( https://signpath.org ) thing mentioned in one of the responses? From their website: SignPath Foundation provides reliable code signing for Open Source projects. If it's legit, then it could be a useful option.

It appears legit, in that vim and transmission link back to it.

Right now the "foundation" is run by the SignPath company. But TBF they say they hope the foundation will eventually scale, and become independent and community run.

Re: The Windows installer of ImageMagick will no longer be signed

#114

Post by quickthrower2 »

toastal wrote: post #83
theanonymousone wrote: post #52

Let's normalise using WSL for all such command-line utilities. Everyone's life will be easier, from developrs to users.

Skip the ‘WS’ part & just use the ‘L’

With some GNU too!

Re: The Windows installer of ImageMagick will no longer be signed

#115

Post by electroly »

jborean93 wrote: post #78
electroly wrote: post #38

Earlier quoted context omitted.

I'm in exactly the same boat; doing the same thing to store my OV .pfx certificate in a GitHub Actions secret. My certificate expires in November 2024 and I'm undecided what I'll do. It was hard enough to get a certificate as a solo developer and not a corporation. Still, though, it should just be a matter of money. The $629/year cloud-hosted HSM mentioned in the OP will do it. If you pay that, you can use this proce…

I’ve found the easiest option available here is through using Azure KeyVault to store the keys. I use a custom module to sign my PowerShell scripts and dlls [1] for this because I can integrate it with OIDC to sign the code using the keys stored in the Azure HSM. While the builtin pwsh Set-Authenticode cmdlet can’t do this currently there are other options that rely on Window’s authenticode APIs like AzureSignTool [2…

I was looking into Azure Key Vault Managed HSM and it appears to be vastly more expensive than the $629/year from Digicert. A Managed HSM Pool is $3.20/hour. Am I missing something?

Re: The Windows installer of ImageMagick will no longer be signed

#116

Post by orra »

DaiPlusPlus wrote: post #20
jabroni_salad wrote: post #17

Earlier quoted context omitted.

Some PDF-related apps used to bundle ghostscript's installer as a silent install and it would just appear in your programs list. Then those users would see a mysterous entity named ghostscript in their start menu and complain online about it being malware or whatever. The ghostscript people decided to disable their silent installer because of it. The fallout has been that corpos can build it from their source and shi…

> Let that stick in your brain for next time you wonder why Windows still hasn't gotten a competent package manager that can wrangle dependencies. winget?

Winget just runs installers and uninstallers. I don't think it wrangles dependencies. That is, it won't install a dependency as its own package, nor will it uninstall a dependency when the last dependent is uninstalled.

Re: The Windows installer of ImageMagick will no longer be signed

#117

Post by woodruffw »

layer8 wrote: post #98
woodruffw wrote: post #9

Earlier quoted context omitted.

That’s the idea behind Sigstore[1]. The larger challenge is the vendors themselves: Sigstore (or anyone else, really) can give code-signing certificates and tooling to developers for free, but that tooling has limited value if the host OS doesn’t bundle the CA certificates that would enable native validation. [1]: https://www.sigstore.dev/

Sigstore doesn’t seem to verify actual legal identity, just control over a GitHub account or similar. It therefore doesn’t provide the same level of assurance as a code-signing certificate. OSs thus do well to not bundle their CA certificate as a trusted root.

I don't think your OS intends to imply or guarantee a legal entity relationship with every CA certificate in your trust store. It's not even clear what that guarantee, as an end user, would get you: the presence of a legal entity doesn't somehow make that entity accountable to you or your locality.

Re: The Windows installer of ImageMagick will no longer be signed

#118

Post by vkazanov »

pjmlp wrote: post #87
theanonymousone wrote: post #52

Let's normalise using WSL for all such command-line utilities. Everyone's life will be easier, from developrs to users.

Windows developers are perfectly fine without WSL. WSL is meant for UNIX developers to bring their habits into non-UNIX OS, just like IBM mainframes and micros have PASE.

Aren't that many pure windevs left these days... In many professional circles Windows itself is no more than a vintage curiosity.

So in many ways, WSL is a survival strategy - it makes it possible to stay a relevant developer while working in windows.

BTW, I know a case where WSL is nothing short of brilliant: online game development. A lot of times, the backend is running linux only, while the client is windows only. WSL is the only decent solution here.

Re: The Windows installer of ImageMagick will no longer be signed

#119

Post by veeti »

electroly wrote: post #115
jborean93 wrote: post #78

Earlier quoted context omitted.

I’ve found the easiest option available here is through using Azure KeyVault to store the keys. I use a custom module to sign my PowerShell scripts and dlls [1] for this because I can integrate it with OIDC to sign the code using the keys stored in the Azure HSM. While the builtin pwsh Set-Authenticode cmdlet can’t do this currently there are other options that rely on Window’s authenticode APIs like AzureSignTool [2…

I was looking into Azure Key Vault Managed HSM and it appears to be vastly more expensive than the $629/year from Digicert. A Managed HSM Pool is $3.20/hour. Am I missing something?

You don't need a HSM, just a HSM backed key. It costs like $5 a month.
Post reply on HN