Re-compile and re-code sign files... SHA-1 switch-off day

[NewsArchive]

All,

Yes, we have developed a migration plan for our old SHA-1 code signing
certificate. SHA-1 "switch-off" day is in 2568 hours. After 1 January
2016, you have to dual SHA-1/SHA-2 (or SHA-2) code-sign your files using
Microsoft Authenticode compatible time stamp and RFC 3161 compliant trusted
time stamp servers. In other words, we have to re-compile all SetupBuilder
codes and code-sign all the DLLs and EXEs with our new SHA-2 certificate.
Why? Because Windows, Internet browsers, anti-virus and anti-spyware don't
like invalid code-sign signatures at all!

No problem, right? Wrong :-(

There are some SetupBuilder components which work rock solid for 7+ years --
there was no need to touch the source code, not in SetupBuilder 6.x or 7.x
or 8.x. They are still signed with a code-signing certificate that expired
in September 2010. But the files are timestamped and so the signatures are
perfectly valid. This will change on January 2nd, 2016.

Our original plan was to re-compile all components. To be honest, it makes
me a bit nerveous to re-compile perfectly working components just to
code-sign them. It's complex process that leaves lots of room for errors
:-(

So perhaps I'll change plans and try to find the original (not signed)
DLLs/EXEs and then re-sign them with the new SHA-2 certificate.

IMO, all this is a nightmare. So my suggestion to you is, developed a
migration plan for your old SHA-1 code-signing certificate and SHA-1
signinged files soon !!!

Friedrich

--
Friedrich Linder
Lindersoft | SetupBuilder | www.lindersoft.com
954.252.3910 (within US) | +1.954.252.3910 (outside US)

--SetupBuilder "point. click. ship"
--Helping You Build Better Installations
--Create Windows 10 ready installations in minutes
--Official COMODO Code Signing and SSL Certificate Partner

[NewsArchive]

Hi Friedrich,

So a re-compile *is* necessary?!
And we can't just RE-code-sign (old) DLLs and (old) EXEs that are
already SHA-1 signed?

Best regards,
Jeffrey

[NewsArchive]

Hi Jeffrey,

> So a re-compile *is* necessary?!
> And we can't just RE-code-sign (old) DLLs and (old) EXEs that are already
> SHA-1 signed?

No, it is recommended to use "fresh" files because the dual SHA-1/SHA-2 code
signing process embeds two signatures :-(

Friedrich

[NewsArchive]

Hi Friedrich,

Das ist Schei... ;-)

Best regards,
Jeffrey

[NewsArchive]

>
> Das ist Schei... ;-)
>

YEEEESSS ;-)

Friedrich

[NewsArchive]

Friedrich,

> > So a re-compile *is* necessary?!
> > And we can't just RE-code-sign (old) DLLs and (old) EXEs that are already
> > SHA-1 signed?
>
> No, it is recommended to use "fresh" files because the dual SHA-1/SHA-2 code
> signing process embeds two signatures :-(

But if you still have unsigned copies of the DLL/EXE they do not need
to be recompiled, just signed. Most libraries I have are left unsigned
and are copied and signed only during install generation. The folks
that wrote my installer were smart enough to give me the option to NOT
make the signing permanent!<g>

--
Lee White

RPM Report Viewer.: http://www.cwaddons.com/products/rpm/
RPM Review........: http://www.clarionmag.com/cmag/v11/v11n06rpm.html
Report Faxing.....: http://www.cwaddons.com/products/afe/
---Enroll Today---: http://CWaddons.com

Creative Reporting: http://www.CreativeReporting.com

Product Release & Update Notices
http://twitter.com/DeveloperPLUS

Windows 8 brings us "The Oval, Bumper Car, Roller Coaster of Wait!"
And, now, Windows 10 brings us "The Inch Worm, Bumper Car of Wait!"


The life of a Clarion Developer: https://youtu.be/ozitqabi6UM

[NewsArchive]

Lee,

> But if you still have unsigned copies of the DLL/EXE they do not need
> to be recompiled, just signed. Most libraries I have are left unsigned
> and are copied and signed only during install generation. The folks
> that wrote my installer were smart enough to give me the option to NOT
> make the signing permanent!<g>

<ROFL> ;-)

Friedrich