SignPath code sign certificate

[janisozaur]

Component

Other

Details

I've noticed in your release notes for https://github.com/LegacyUpdate/LegacyUpdate/releases/tag/v1.12.1.0 you're struggling for support and one of the problems you face is a codesign certificate. Having dealt with the same (paying out of my own pocket for said cert), I eventually stumbled upon SignPath foundation and entered an agreement with them letting us use their cert free of charge.

I would like to suggest following similar avenue.

References:
https://signpath.org/terms
OpenRCT2/OpenRCT2#23236

Confirmation

• I have checked that this issue hasn’t already been reported

[kirb]

Hi, thanks for the suggestion! We went with Certum for another year, in the hope that Azure Trusted Signing will start allowing Australian business applicants again before this renewal is up (Jan 2027). ATS were struggling with fraud a year ago (article), so they locked down to US/Canada-only, only recently expanding back into the EU. Our recent 1.13 release is signed by the new Certum cert.

I did look at SignPath, but found it difficult to trust the way they place all open source projects under one certificate. It ties the project to a company name that isn’t directly associated with it, and any malware signed with the cert could affect AV reputation of legitimate projects. Because they’re worried about the reputation of their cert, their rules are also quite strict in ways I can’t agree with, e.g. not allowing dependencies to be signed. I have heard positive reviews of their dashboard and tools from a friend though - definitely far better than Certum’s. It also felt more trustworthy to keep my business name in the certificate, and we received a minor discount as a repeat customer.

If ATS doesn’t become available in time, we’ll revisit SignPath as an option. The most preferable would still be a CA that has a chain to a root known by XP SP2/SP3 due to this bug, but it seems that’s not likely except by paying the even higher prices at one of those legacy CAs.

p.s. By coincidence I played OpenRCT2 with a friend a few days ago. It’s super cool 😉