rustup-init.exe needs to be code-signed
**NOTE**: Edited by @kinnison Mozilla are prepared to offer access to their Autograph signing service. Thus if you want to help, the relevant useful comment is https://github.com/rust-lang/rustup.rs/issues/1568#issuecomment-509503964 which will guide you through what needs to be done. @jethrogb has indicated they are prepared to mentor this process. --- Original posting comes below... --- `rustup-init.exe` (downloaded from https://win.rustup.rs/) is not signed with an EV code signing certificate. As a result, there isn't an obvious way for Windows users to verify the download. (Neither https://www.rust-lang.org/tools/install nor https://rustup.rs/ shows any gpg keys or even checksums for use.) Moreover, the `rustup-init.exe` can get blocked by SmartScreen. Even though users can bypass it by clicking on "More Info" then "Run anyway", it doesn't bring any confidence. SmartScreen operates on the basis of reputation. The SmartScreen warning might eventually go away when the `rustup-init.exe` gets used by more users, but it resets whenever a new version is built and published. If `rustup-init.exe` is code-signed, the reputation will be inherited by any programs signed with the same certificate, which should make SmartScreen happy. (See: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-extended-validation-ev-code-signing-certificates/)
Posted by alvinhochun on Dec 11, 2018, 8:44 AM
Tags
Related issues
Raise real-world problems, find people facing the same issue, and discuss solutions.4,000 issues0 comments
onboarding (Software)
Minecraft Dungeons II (1912410)
We are seeing the realtime result of MS buying Github and buying influence.
macOS 15 Sequoia clobbers _nixbld1-4 users
News + Polls
Implement Pylint
Add Zig
Unable to run sandboxed process when run as elevated under applocker
[Feature request] Show browser error overlay for runtime errors
rustup-init.exe needs to be code-signed
**NOTE**: Edited by @kinnison Mozilla are prepared to offer access to their Autograph signing service. Thus if you want to help, the relevant useful comment is https://github.com/rust-lang/rustup.rs/issues/1568#issuecomment-509503964 which will guide you through what needs to be done. @jethrogb has indicated they are prepared to mentor this process. --- Original posting comes below... --- `rustup-init.exe` (downloaded from https://win.rustup.rs/) is not signed with an EV code signing certificate. As a result, there isn't an obvious way for Windows users to verify the download. (Neither https://www.rust-lang.org/tools/install nor https://rustup.rs/ shows any gpg keys or even checksums for use.) Moreover, the `rustup-init.exe` can get blocked by SmartScreen. Even though users can bypass it by clicking on "More Info" then "Run anyway", it doesn't bring any confidence. SmartScreen operates on the basis of reputation. The SmartScreen warning might eventually go away when the `rustup-init.exe` gets used by more users, but it resets whenever a new version is built and published. If `rustup-init.exe` is code-signed, the reputation will be inherited by any programs signed with the same certificate, which should make SmartScreen happy. (See: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-extended-validation-ev-code-signing-certificates/)
Comments (0)
No comments yet. Start the discussion.