Task: Migrate Espanso project from Federico's code signing key

[joh6nn]

In order to allow more timely releases, we need to migrate code signing away from Federico's private key(s) and instead switch to key(s) belonging to the project as a whole. This issue is for researching and tracking that work

[AucaCoyan]

Thank you for submitting the issue and leading the investigation! 🚀 . For context, here is the link to the message in discord where it describes what you have found: quote...

joh6nn: well, based on my initial reading, it seems like getting it fixed properly will probably take time and money. So I'm guessing that we probably need to start working on it now so that it can be ready when we need it 😅
The most helpful information I've found so far was intended for Electron based apps on Mac, but I think it applies to all apps on Mac regardless of whether they use Electron or not. And the steps it outlined seem like they will probably be very similar on Windows. In brief:

• get a new certificate/key
• sign our next release (eg 2.2.2) Federico's cert/key, but add a metadata field saying that our new cert/key is also valid.
• sign the release after that (eg 2.2.3) with only the new key

...and quote! Now, I'm completely new to code signing, so maybe this is a silly question. With my googling I found that there are "less strong" type of signatures, (for example from GitHub, who doesn't sign the executable, but the package release). And Windows/Mac signatures are for verified developers that want to publish to Microsoft Store / App Store.
Now, we don't publish espanso to either of the stores, so in the scenario that we decide to drop the signature, what are we losing? It's just some security on the certificate and that cost us a hundred dollars per year? Am I reading that correctly?

[joh6nn]

I'm still researching, so this could be wrong, but my understanding is that, in addition to being a requirement for the App Stores, app signing also has the following features (on both Windows and Mac):

• unsigned apps display a security warning when you try to run them: Windows Mac. So if Espanso isn't signed, we need to tell users to ignore the security warnings, which is not ideal. It will also make it harder for users (myself included) to be able to use Espanso at work 😕
• Windows and Mac compare the signing key for the current version of installed software to the version you are trying to upgrade to. So since the current versions are signed with Federico's key, if we stop signing, then our next release users won't be able to upgrade, and instead they'll have to uninstall and re-install. And when they reinstall, they'll get the security warning from above.

As I mentioned, I'm still researching, so that might not all be correct, but that's my understanding so far

[AucaCoyan]

to be able to use Espanso at work 😕

Oh, that's right! I forgot about that because I use a kinda friendly VPN (for now). My guess is that probably many users use espanso to write down forms and respond emails, which usually pollute work computers, not home computers

[n8henrie]

I would like to help here!

I spent months learning the basics of this process and eventually got a fully automated macOS signing process working for Quicksilver. I was actually brought into the QS team in large part for this exact purpose. On mobile now but will link to the relevant GitHub Actions stuff soon.

The only part I didn't set up personally was the acquisition of the signing certificate itself. I know that it does cost $100 per year, and as far as I'm aware there is no way to provide a first-class experience on macOS (just downloading a dmg of a .app that runs without warnings or awkward workarounds) without paying for this certificate.

If unwilling to pay for the macOS developer certificate, the next best approach IMO is using something like nix (my preference) or homebrew that effectively builds the project from source on the user's computer and then signs it locally using an "ad hoc" signature that is only valid on that specific device, but frankly this is not much better end-user experience than telling them to "just clone the repo and use cargo."

[AucaCoyan]

We welcome your know-how in a heavenly way! Almost everybody except federico has null experience on signatures ❤️ , we are learning by doing.
I think we "escape the situation" by doing hombrew builds, but I prefer to have the signature, either:

• by investigating if it's possible to have one for open source organizations, or
• by having one of us signing the code in the name of espanso org.

One question that I have is: is it possible to sign the code as an organization? does that cost the same as the 100$ per year license? or is it another license?
And with that license, can we have at least 2 admins/owners?

[n8henrie]

Awesome.

For the big picture overview, here's the GitHub Action that does the bulk of the signing and notarization: https://github.com/quicksilver/Quicksilver/blob/main/.github/workflows/ci.yml

We keep the following "Organization secrets" stored as GitHub Actions secrets, which allows the action above to access them in CI, but does a good job hiding any of their content in the build logs:

• KEYCHAIN_PASSWORD
• MACOS_CERTIFICATE
• MACOS_CERTIFICATE_PASSWORD
• NOTARIZING_ID
• NOTARIZING_PASS
• SIGNING_IDENTITY

In short, the idea is to have the developer certificate content stored as a base64-encoded value, and do something like

$ keyfile=/tmp/key
$
$ # "belt and suspenders" delete on exit (including errors)
$ trap "rm -f $keyfile" EXIT
$
$ echo "$CONTENT" | base64 -d > "keyfile"
$
$ # import the key into the macOS keychain and use for signing
$ 
$ # delete as soon as possible
$ rm -f $keyfile

For your questions, I'm not much of an authority on this, as our development certificate for Quicksilver is owned by one of the other devs. AFAIK:

• I don't think they have a special FOSS license
• There are special requirements for organizations: https://developer.apple.com/programs/enroll/
• I don't think there is any way around the $100 fee if you want a good user experience
  • Here is the process required to open apps that are signed without a paid developer certificate: https://support.apple.com/en-us/102445
• It appears that you can add additional team members to a certificate: https://developer.apple.com/help/account/manage-your-team/invite-team-members/
• You can change roles for team members, including an option for "admin": https://developer.apple.com/help/account/manage-your-team/change-team-member-roles

[AucaCoyan]

Thank you! that's really clear ❤️