and re the build pipeline I doubl

Question

< seph> and < alessandrogario> re the build pipeline I double checked that the Gist I made previously is good it still more or less looks like the steps I follow to produce the signed packages I ll update it with my test plan also

seph · Answer

I think I have a slightly older version of that in <https gist github com directionless 767825510afc3cce99dfeb1d4eadb67a>

thor · Answer

Ah yeah probably I did a few updates this evening

alessandrogario · Answer

This is great Thanks slightly smiling face I am integrating this in the signing workflow

alessandrogario · Answer

Turns out that the Windows signing process seem to be the most sane one

seph · Answer

I wouldn t go that far

alessandrogario · Answer

it seems to be a simple call to signtool exe regardless of target exe or msi thinking face

seph · Answer

Windows code signing natively uses signtool Poorly documented and it offers the promise of power and plugins but the reality is ugly And I think you have to be at a console I can t get signtool to work remotely

seph · Answer

Apple is basically the same Codesign is trivial with similar limitations and annoyance Notarize is a separate beast

alessandrogario · Answer

Ah yes i was also considering notarization

seph · Answer

Other than the async part it s pretty simple

seph · Answer

Oh Unmentioned here is windows smart screen reputation This part is horrible Windows code signing is based on easy to get x509 certs This means malware authors have them too Microsoft s solution to this is to add reputation to the smart screen checks If you don t have enough reputation when you exec things you get an extra are you sure you want to click this link Reputation may be build by buying an expensive EV cert which requires hardware HSMs Or by having an unknown number of downloads of a regular cert

seph · Answer

There s some indication that you can use cloud HSMs but there s a lot of poorly documented ground

alessandrogario · Answer

I am currently using a simple self signed cert I am not sure how we are going to proceed here

alessandrogario · Answer

I think Windows is almost ready then it s macOS time

alessandrogario · Answer

and after that we ll need keys

seph · Answer

I expect we ll buy a standard cert

alessandrogario · Answer

Do you happen to know what kind of key we are using for Linux

seph · Answer

Pretty sure we have a gpg key that Teddy uses It s in 1password

alessandrogario · Answer

i m assuming we are going to rotate it can you become our keymaster smile

seph · Answer

I don t have any plans to rotate it

alessandrogario · Answer

is that key personal or dedicated to osquery

seph · Answer

No clue Let s see

seph · Answer

I d assume it s a dedicated key

alessandrogario · Answer

if it s personal it may not be the best to make it available through the CI

alessandrogario · Answer

i think i had access to 1password but it was on the other laptop

seph · Answer

It s key 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B Which is <mailto osquery fb com|osquery fb com>

seph · Answer

We could rotate it but shrug

seph · Answer

I d say use a self signed key and we ll swap it out later

alessandrogario · Answer

oh yeah I ll use a self signed key for now

alessandrogario · Answer

I was wondering what the next steps are when we need to start

alessandrogario · Answer

seems like we have a plan for all three keys

seph · Answer

We should check with Nick for windows I don t know if we want to use his or buy anew

seph · Answer

Long term obviously buy But maybe there s an argument for something else

seph · Answer

For macOS do you know what format that key should be in And where I should upload it

alessandrogario · Answer

macOS is where I ll need help the most

alessandrogario · Answer

I was able to run codesign and do the notarization in the past but for the keys I always had to log into Xcode and ask it to download them locally through the UI

seph · Answer

I wonder if I should iterate on a github workflow

alessandrogario · Answer

i would appreciate a lot to get some help on the macOS side

seph · Answer

I suspect we need to find prior art my experience so far is that this all requires a console login else the keychain stuff is weirdly locked

alessandrogario · Answer

your go code is way cleaner than my hackish bash approach

seph · Answer

That s why I wrote go stuck out tongue

seph · Answer

Looking at secrets github supports repo level secrets and also org ones And it looks like the org ones need to be opted in for repos

seph · Answer

That makes me think our secrets should be org level and then only exposed to this repo

alessandrogario · Answer

Are those secrets going to be shared to multiple repos

seph · Answer

No idea

seph · Answer

But it feel like an okay pattern since we might move this code around

seph · Answer

I d feel less okay if it wasn t selectable how it was shared

seph · Answer

<https github com osquery osquery codesign settings secrets actions> is org level I m not even sure you can see the contents outside of the org management panel and the workflow jobs

thor · Answer

The only argument I d make for continuing to use mine is what y all have already uncovered my rep is high enough that we don t get flagged I don t think so I d be happy to continue using mine That being said we ll inevitably need to switch over to an osquery based Windows cert anyway so might as well start building that rep now stuck out tongue

thor · Answer

Sorry for the delay in my response

thor · Answer

Lemme know what y all wanna do either way