DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 543IMSGV3783472
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 4ABB93858D21
MIME-Version: 1.0
Date: Sat, 3 May 2025 20:21:19 +0200
Message-ID: <CAKAoaQn=-jVLnrO1hmM_4JAPodO-YnUuw+fcnDScHa=d2G48=A@mail.gmail.com>
Subject: Signing cygwin.com binaries with signtool by default ?
To: cygwin AT cygwin DOT com
From: Roland Mainz via Cygwin <cygwin AT cygwin DOT com>
Reply-To: Roland Mainz <roland DOT mainz AT nrubsig DOT org>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>

Hi!

----

Is it somehow possible that the CI+Release binaries (*.exe, *.dll) can
be signed with signtool
(https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool) ?
It seems that Microsoft Defender has become overly aggressive to some
Cygwin binaries (mostly /usr/bin/hostname, /usr/bin/find, /usr/bin/tar
etc.) in the last couple of weeks and just blocks them.

Our IT supports that they can "whitelist" binaries based on their
cryptographic signature... but neither the binaries from the CI nor
the Release binaries have any signatures...

----

Bye,
Roland
-- 
  __ .  . __
 (o.\ \/ /.o) roland DOT mainz AT nrubsig DOT org
  \__\/\/__/  MPEG specialist, C&&JAVA&&Sun&&Unix programmer
  /O /==\ O\  TEL +49 641 3992797
 (;O/ \/ \O;)

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple