DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 543IoqKe3796930
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 4218E3858D21
MIME-Version: 1.0
References: <CAKAoaQn=-jVLnrO1hmM_4JAPodO-YnUuw+fcnDScHa=d2G48=A AT mail DOT gmail DOT com>
In-Reply-To: <CAKAoaQn=-jVLnrO1hmM_4JAPodO-YnUuw+fcnDScHa=d2G48=A@mail.gmail.com>
Date: Sat, 3 May 2025 20:49:48 +0200
Message-ID: <CAKAoaQkwnZ2LJeKwHFmJ7yWLxFvJrdp+3iewqzS6ujj0cupuJQ@mail.gmail.com>
Subject: Re: Signing cygwin.com binaries with signtool by default ?
To: cygwin AT cygwin DOT com
From: Roland Mainz via Cygwin <cygwin AT cygwin DOT com>
Reply-To: Roland Mainz <roland DOT mainz AT nrubsig DOT org>
Content-Type: text/plain; charset="utf-8"
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit

On Sat, May 3, 2025 at 8:21 PM Roland Mainz <roland DOT mainz AT nrubsig DOT org> wrote:
> Is it somehow possible that the CI+Release binaries (*.exe, *.dll) can
> be signed with signtool
> (https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool) ?
> It seems that Microsoft Defender has become overly aggressive to some
> Cygwin binaries (mostly /usr/bin/hostname, /usr/bin/find, /usr/bin/tar
> etc.) in the last couple of weeks and just blocks them.
>
> Our IT supports that they can "whitelist" binaries based on their
> cryptographic signature... but neither the binaries from the CI nor
> the Release binaries have any signatures...

BTW: The Windows Defender rule which causes /usr/bin/find.exe,
/usr/bin/hostname.exe etc. to be blocked is "Block use of copied or
impersonated system tools" (C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB) ...

----

Bye,
Roland
-- 
  __ .  . __
 (o.\ \/ /.o) roland DOT mainz AT nrubsig DOT org
  \__\/\/__/  MPEG specialist, C&&JAVA&&Sun&&Unix programmer
  /O /==\ O\  TEL +49 641 3992797
 (;O/ \/ \O;)

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple