SignPath.io

Code signing - simple & secure (and free for Open Source)

[SignPath.io @SignPathIO]

@studio__aaa We put a support bot on weekend shift. Let's get those evil Okta spirits banned!

[SignPath.io @SignPathIO]

Cybernews interview with our CEO about code signing and how it relates to software supply chains and current cyber threats https://t.co/Q5174w20YT

[SignPath.io @SignPathIO]

More on Sunburst: what can we do to prevent this kind of supply chain attacks in the future? https://t.co/qrB0R30VFW
Reviews, secure build chains... and SignPath, maybe, to make sure reviews and security are in place before code signing.

[SignPath.io @SignPathIO]

Connecting build systems to HSMs is not enough, nor are specialized HSM proxies dressed up as code signing solutions. We need policy management & enforcement, airtight & verifiable integration from source code to build to signing. That's what we do. 4/4

[SignPath.io @SignPathIO]

Most in-depth SunBurst analysis we've seen so far: https://t.co/4xvEfk4wDz
Build systems and code singing are primary targets for suply chain attacks, allowing hackers to "evade millions of dollars of security investment" at their eventual targets. 1/4

[SignPath.io @SignPathIO]

It has happend before, and we've been warned it would only get worse: https://t.co/Z45IsyjDc6 3/4

[SignPath.io @SignPathIO]

While SignPath can help with driver cross-signing, attestation *and* HLK signing, customers express concern about consequences of Microsoft dropping cross-signing for good https://t.co/rqvA5Ddf3N via @OSRDrivers /cc @vcsjones @clairernovotny

[SignPath.io @SignPathIO]

@matkoch87 @sforkmann @buhakmeh @PaketManager When autocorrect feels the need to remind you that you're German ;-)

[SignPath.io @SignPathIO]

@sforkmann @matkoch87 @buhakmeh @PaketManager Our if you find another cert sponsor, they can provide the cert through a free OSS SignPath subscription. It's then up to them to define policy, they'll be in charge of the cert anyway. After all, certs are less about the cost than the name you put on it.

[SignPath.io @SignPathIO]

@sforkmann @matkoch87 @buhakmeh @PaketManager Yes, for automatic build+release you'd have to split your build script: 1. build unsigned artifact and submit for signing, 2. upload for release (can be triggered by Webhook). That's what we need to automatically verify each build.

[SignPath.io @SignPathIO]

@natemcmaster @nuget Problem: policy mgmt is designed for enterprises, but b/c of huge share of @nuget projects, requires OSS prj buy-in. https://t.co/TmP4cTePOM aims to turn this around by offering real trust to OSS: signature connects the binary to the source repo, not just sbdy's reputation.

[SignPath.io @SignPathIO]

@clairernovotny @minter @shanselman Many thanks @clairnovotny! @minter: https://t.co/u34rNgiMUj is even a bit cheaper for multi-year certs + you don't get the mess that comes with reseller accounts. You might need an EV cert though: https://t.co/6J9bLR4pJU. No dongles when using https://t.co/TmP4cTePOM

[SignPath.io @SignPathIO]

@onovotny @vcsjones @IgorRussKie @migueldeicaza Association with Azure AD seems to be the most they do. No legal ID vetting afaik. (Know how they identify device driver publisher identities for portal signing via AAD? Make them show EV cert.) Even if they did, solution for OSS still required.

[SignPath.io @SignPathIO]

@onovotny @vcsjones @IgorRussKie @migueldeicaza Not on the level they require from CAs afaik, but could be wrong. Dev from my org had no trouble publishing in our name, verification never happened.

[SignPath.io @SignPathIO]

@onovotny @IgorRussKie @migueldeicaza @vcsjones Couldn't find it, asked around, all I heard was "it was mentioned in some CAB meeting"

[SignPath.io @SignPathIO]

@onovotny @IgorRussKie @migueldeicaza @vcsjones You've asked me before. 3 strikes is just a rumour so far.

[SignPath.io @SignPathIO]

@onovotny @IgorRussKie @migueldeicaza @vcsjones No, same publisher, individual certs (need to be able to revoke)