influxdata / influxdata/influxdb
[Feature request] PE sign InfluxDB executables
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
We currently currently sign files in https://www.influxdata.com/downloads/ with a detached signature (.asc file) for pgp/gpg to verify. This is all fine.
Only the `telegraf` Windows binary (PE executable) is signed using Microsoft code-signing (eg, authenticode). See:
* https://github.com/influxdata/telegraf/blob/master/.circleci/config.yml#L422
* https://github.com/influxdata/telegraf/blob/master/scripts/sign-windows.sh
We aren't currently doing this for InfluxDB (1.x, 2.x or 3.x). Eg, if I unzip the influxdb2-2.7.11-windows.zip I see:
```
$ osslsigncode extract-signature ./influxd.exe ./out
PE file does not have any signature: ./influxd.exe
Failed
[255]
```
Adding PE signing to all downloadable executables for Windows would reduce barriers to entry for people using them in certain environments (eg, some site-specific security policies require binaries signed in the manner). The proper way to do this is to update https://github.com/influxdata/code-sign (private repo) to support PE signing (eg, in addition to detached signature, apt InRelease files and rpm signing) and then adjust the InfluxDB CircleCI jobs for 1.x, 2.x and 3.x to send the windows binary to be signed (similar to how we do rpm). Once that is done, it should be trivial to adjust all the different projects to start using this and migrate telegraf to it.
cc @gunnaraasen, @davidby-influx, @srebhan
References:
- https://github.com/influxdata/telegraf/issues/6423
- https://github.com/influxdata/telegraf/blob/master/.circleci/config.yml#L422
- https://github.com/influxdata/telegraf/blob/master/scripts/sign-windows.sh
Contributor guide
Research direction
Start by reviewing the referenced Telegraf .circleci/config.yml section and scripts/sign-windows.sh, then compare the InfluxDB 1.x, 2.x, and 3.x CircleCI jobs. Confirm how the private code-sign repository handles existing signing workflows and define completion as signed Windows executables being produced and verifiable in each downloadable release.
Written by the indexing model from the issue text.
Assessment
- Domain
- build-system, ci-cd, release, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100