 |
See further discussion in 0001011. |
 |
It's not hard, but expensive. You need to send out all sorts of legal documents to proof your identity to shady companies and that's not really something I want to do, and it costs a non-trivial amount of money that I think is better spent otherwise. |
|
|
Also, in the current situation, signing is actually infeasible for automated builds because we are building on at least 6 hosts for Windows, which are controlled by 2 different people and 1 unrelated organization (AppVeyor). A single signature certificate cannot be distributed to various hosts without defeating its very purpose. |
 |
Ah I see |
|
|
Basically, the only way I personally can see the official installer that is downloadable from the front page (and which is currently only built by me, not by the buildbots) could get an official code-signing certificate is: Someone decides to sponsor a code-signing certificate for OpenMPT and commits to paying for it every year no matter if the certificate becomes more expensive or not. I don't want to rely on our regular donation pool for this because it's not predictable, and the cheapest available option for open-source code signing certificates (a company called Certum) have increased their prices multiple times in the past so one day those costs might be more than what we get in donations, in particular if maybe one day Certum decides to no longer offer their cheap(er) certificates for open-source software and we'd have to resort to a regular certificate (which is multiple hundreds of Euros typically). But I won't use my personal funds for buying a code-signing certificate, that's for sure. |
|
|
The world of open source seems to need a crowd-funded certificate organisation, like Creative Commons is a crowd-funded license organisation. |
|
|
I'm currently in the process of obtaining a code signing certificate, as an OpenMPT user will generously sponsor it. |
|
|
Certificate works, signing support added in r16010. |
- Anonymous
