Turns out that the Windows signing process seem to be the most sane one

Apple is basically the same. Codesign is trivial, with similar limitations and annoyance. (Notarize is a separate beast)

Oh. Unmentioned here is windows smart screen reputation. This part is horrible Windows code signing is based on easy to get x509 certs. This means malware authors have them too. Microsoft’s “solution” to this is to add reputation to the smart screen checks. If you don’t have enough reputation, when you exec things, you get an extra “are you sure you want to click this” link. Reputation may be build by buying an expensive EV cert (which requires hardware HSMs). Or by having an unknown number of downloads of a regular cert.

There’s some indication that you can use cloud HSMs, but there’s a lot of poorly documented ground,

I think Windows is almost ready, then it's macOS time

and after that, we'll need keys

I’d assume it’s a dedicated key)

i think i had access to 1password, but it was on the other laptop

We could rotate it, but 🤷

I’d say use a self signed key, and we’ll swap it out later?

I was wondering what the next steps are when we need to start

seems like we have a plan for all three keys!

Long term, obviously buy. But maybe there’s an argument for something else.

For macOS, do you know what format that key should be in? And where I should upload it?

I was able to run codesign and do the notarization in the past, but for the keys I always had to log into Xcode and ask it to download them locally through the UI

Looking at secrets — github supports repo level secrets, and also org ones, And it looks like the org ones need to be opted in for repos

That makes me think our secrets should be org level, and then only exposed to this repo?

But it feel like an okay pattern since we might move this code around

I’d feel less okay if it wasn’t selectable how it was shared

https://github.com/osquery/osquery-codesign/settings/secrets/actions is org level. I’m not even sure you can see the contents outside of the org management panel and the workflow jobs

Sorry for the delay in my response!

Lemme know what y'all wanna do either way!