Is code signing necessary?

[wiktor-k]

Hi,

We've just released a new version of OpenPGP Card SSH Agent with support for Windows and we're wondering about distributing the service via winget but it's not clear if we need to acquire code signing certificates for the installer (we're planning to use cargo-wix to build the installer) or not.

Sorry if this is a basic question but I couldn't find it in Discussions and Issues.

Thanks for your time! 👋

[denelon]

WinGet doesn't require code signing, but some users are likely to be concerned about unsigned installers.

[wiktor-k]

Is there any indication that the code is unsigned that the user will see? (Eg a prompt with a warning).

Given recent developments with xz I'd rather use signed installers but if there's no practical difference for the end user making the build process more complex wouldn't be worth it.

Thanks for your time! 🙇‍♂️

[denelon]

Currently, not from WinGet. We're gradually beefing up the UX to include more things related to security, but for now, those checks happen during validation, and aren't blocking.

[wiktor-k]

Thanks for the answer. So I'll build the unsigned version and push the manifest to winget and in parallel setup signing to be ready when you flip the improved security flag.