influxdata / influxdata/influxdb

[Feature request] PE sign InfluxDB executables

Open
#25,625 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

We currently currently sign files in https://www.influxdata.com/downloads/ with a detached signature (.asc file) for pgp/gpg to verify. This is all fine.

Only the `telegraf` Windows binary (PE executable) is signed using Microsoft code-signing (eg, authenticode). See:
* https://github.com/influxdata/telegraf/blob/master/.circleci/config.yml#L422
* https://github.com/influxdata/telegraf/blob/master/scripts/sign-windows.sh

We aren't currently doing this for InfluxDB (1.x, 2.x or 3.x). Eg, if I unzip the influxdb2-2.7.11-windows.zip I see:
```
$ osslsigncode extract-signature ./influxd.exe ./out
PE file does not have any signature: ./influxd.exe
Failed
[255]
```

Adding PE signing to all downloadable executables for Windows would reduce barriers to entry for people using them in certain environments (eg, some site-specific security policies require binaries signed in the manner). The proper way to do this is to update https://github.com/influxdata/code-sign (private repo) to support PE signing (eg, in addition to detached signature, apt InRelease files and rpm signing) and then adjust the InfluxDB CircleCI jobs for 1.x, 2.x and 3.x to send the windows binary to be signed (similar to how we do rpm). Once that is done, it should be trivial to adjust all the different projects to start using this and migrate telegraf to it.

cc @gunnaraasen, @davidby-influx, @srebhan

References:
- https://github.com/influxdata/telegraf/issues/6423
- https://github.com/influxdata/telegraf/blob/master/.circleci/config.yml#L422
- https://github.com/influxdata/telegraf/blob/master/scripts/sign-windows.sh

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the referenced Telegraf .circleci/config.yml section and scripts/sign-windows.sh, then compare the InfluxDB 1.x, 2.x, and 3.x CircleCI jobs. Confirm how the private code-sign repository handles existing signing workflows and define completion as signed Windows executables being produced and verifiable in each downloadable release.

Written by the indexing model from the issue text.

Assessment

Domain
build-system, ci-cd, release, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.