Weird Cert on Windows Installer

[NickETH]

Description

The cert, which is used to sign the window installer can not be verified!
Please do not sign this installer like this.
Either use a cert from a well known vendor, which roots are widely distributed
Or do not sign at all!
A signature like this produces a lot more questions as it is able to answer.

Reproduce

Just download the Windows Installer.
Powershell:
Get-AuthenticodeSignature -FilePath "JupyterLab-Setup-Windows.exe"

[welcome]

Thank you for opening your first issue in this project! Engagement like this is essential for open source projects! 🤗

If you haven't done so already, check out Jupyter's Code of Conduct. Also, please try to follow the issue template as it helps other other community members to contribute more effectively.

You can meet the other Jovyans by joining our Discourse forum. There is also an intro thread there where you can stop by and say Hi! 👋

Welcome to the Jupyter community! 🎉

[JasonWeill]

What certificate do you see, and which certification vendors would you prefer be used instead?

[JasonWeill]

For example, are there other open source projects that you use on your Windows installation that use signed installers? If so, which certification authorities do they use?

[NickETH]

You are using a developer cert from Apple. This seems to be self signed.
There is no chain of trust behind this, as on a real cert.

You can use a code signing cert from any vendor.
We use one from Digicert e.g.
Thanks

[krassowski]

I think this is a duplicate of #202 which tracks code signing on Windows (and Mac - this one was done).

@mbektas what is blocking us here? Is there something we could do to unblock this, i.e. is this something we need to take up to the Jupyter EC to get a certificate paid for, or is this a software problem to be solved?

[NickETH]

You will definitely need a Code Signing Cert for Windows.
Should be not that expensive for open source (30-80$/y).

[mbektas]

@krassowski NumFocus was going to purchase a Windows signing certificate and pass the information to me last time we discussed. We haven't synced on that for a very long time.

[NickETH]

Any news on this one?

[mbektas]

I am working with NumFOCUS to get a signing certificate purchased.
Is this a blocking issue for you? Our Apple signing certificate is not self-signed and we have been using it to sign macOS application. It turns out our build tool (electron builder) is using it also to sign the Windows binaries.

[JasonWeill]

Resolving as a duplicate of #202.