When I run the MozillaBuild 2.1.0 installer, Windows says the publisher is unknown. The installer executables should be signed. Until then, I suggest that in the announcements of new releases, we provide HTTPS download URLs. For example, https://ftp.mozilla.org/pub/mozilla.org/mozilla/libraries/win32/MozillaBuildSetup-Latest.exe instead of http://ftp.mozilla.org/pub/mozilla.org/mozilla/libraries/win32/MozillaBuildSetup-Latest.exe

I have no idea what it would take to properly sign the installer. Do you have suggestions on where to start, catlee?

It would have to be a manual process by releng at this point, assuming we want to use the same certs that we're using for Firefox. Would you just want the installer signed, or contents as well?

Chris: I am not sure what it means to sign just the installer vs. the contents as well. I want the installer signed, but I am not requesting that we sign the individual .exe files in the package. Did I understand your question correctly?

I think signing just the installer itself would suffice. I'd be hesitant to sign others' binaries anyway.

Rail, do you know what the process would be for doing this? I'm intending to ship the next MozillaBuild release soon and it would be great if we could do this as part of that.

The process would be something like: 1) provide the file URL and the checksums 2) ping someone who can access to the signing servers: catlee bhearsum nthomas rail coop hwine

This was done for the 2.2 release with help from Rail. For now, I guess it'll need to be a manual process (albeit not horribly burdensome since it only takes a few minutes and MozillaBuild releases aren't terribly frequent). To document this for future reference, a copy of the unsigned installer and its sha-512 hash were provided so Rail could run it through a Taskcluster-based signing job. We initially ran into problems with Windows SmartScreen because the old sha1 certificate was used for signing instead of the newer sha256 one, so we'll want to verify that in the future for later releases.

When I installed the 2.2 release, Windows showed a verified publisher of Mozilla Corporation. Thank you! Nit: in the release notes, it would be good to use HTTPS in the download URL (and also the changelog URL): https://ftp.mozilla.org/pub/mozilla.org/mozilla/libraries/win32/MozillaBuildSetup-Latest.exe

(In reply to Wan-Teh Chang from comment #8) > Nit: in the release notes, it would be good to use HTTPS in > the download URL (and also the changelog URL): Yeah, that came up in the dev-platform thread already. It was an oversight on my part and won't happen next release.