Release D 2.100.2

[Guillaume Piolat]

On Friday, 4 November 2022 at 02:44:57 UTC, Iain Buclaw wrote:
> On Tuesday, 1 November 2022 at 21:56:39 UTC, Ruby The Roobster 
> wrote:
>> On Tuesday, 1 November 2022 at 19:57:11 UTC, JN wrote:
>>> Windows is showing SmartScreen warnings when trying to run 
>>> the Windows installer. Also, the installed version reports as 
>>> v2.100.2-dirty.
>>
>> The next few releases are unsigned as those with the keys 
>> cannot be contacted (or, that's from what I've heard.)
>
> Code signing certs have been expired for nearly two years now, 
> and are no longer functional.  It is not yet decided what this 
> should be replaced with, granted that buying a cert now is both 
> eye-wateringly more expensive compared to 2016, and appears to 
> force you to have some form of 2FA - be it hardware token or 
> cloud signing platform.

Last time I had to do this:

Basically you have Certum.pl which provides cloud-signing, this 
company responds quickly, getting a individual OV certificate 
takes about 2-3 days.
"cloud" signing with needs a phone token, a phone app SimplySign, 
that last 15 minutes or so.

On the other hand, .p12/.pfx vendors are almost entirely 
COMODO/Sectigo now, it works offline, getting a certificate is 
more painful with them and will require a hardware token even for 
OV beginning this month.

0. It's less hassle not to do anything, but well we could have a 
supply-chain attack one day.
1. If cloud/simplysign workflow is OK, Certum may be less hassle.
2. Possibly safer / less problems in build to just get the EV 
from Sectigo in a hardware token. Especially if you commit the 
secret in CI.

Since November signing will require hardware token or private key 
in cloud (2FA).