Issue 119017 - The Windows installation file has missing properties and lacks a code signature
Summary: The Windows installation file has missing properties and lacks a code signature
Status: CLOSED FIXED
Alias: None
Product: Installation
Classification: Application
Component: code (show other issues)
Version: 3.4.0 Beta (OOo)
Hardware: PC Windows, all
: P3 Normal (vote)
Target Milestone: 4.1.11
Assignee: AOO issues mailing list
QA Contact:
URL:
Keywords:
: 92489 120261 120614 127418 127702 (view as issue list)
Depends on:
Blocks:
 
Reported: 2012-03-04 23:24 UTC by orcmid
Modified: 2022-10-28 12:54 UTC (History)
6 users (show)

See Also:
Issue Type: DEFECT
Latest Confirmation in: 4.1.10
Developer Difficulty: ---

Attachments
Typical empty Description Properties on AOO Windows install .exe files (41.11 KB, image/png)
2012-03-04 23:24 UTC, orcmid 		no flags Details
The OOo 3.3.0 Signature Details on the Microsoft installer .exe (59.85 KB, image/png)
2012-03-04 23:27 UTC, orcmid 		no flags Details
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description orcmid 2012-03-04 23:24:49 UTC 
Created attachment 77295 [details]
Typical empty Description Properties on AOO Windows install .exe files

Neither the r1293550 OOo-Dev 3.4 or OOo 3.4 pre-candidate developer snapshots have completed property information on the downloaded .EXE.

In addition to any origin-identifying property information, there is also no digital signature on the .EXE.

The consequence is the inability of a casual user to use the available Windows provisions for verifying what the executable is described to be and what authority signed the executable.  There is therefore no straightforward means of learning that a code signature is not verifiable for any reason.

I note that the last OOo 3.3.0 that I have downloaded, OOo_3.3.0_Win_x86_install-wJRE_it.exe is digitally signed by Oracle America, Inc., was countersigned by a Verisign time service, and there is detailed certificate information.  The Property Details are also omitted on the OOo 3.3.0 installer .exe.
Comment 1 orcmid 2012-03-04 23:27:26 UTC 
Created attachment 77296 [details]
The OOo 3.3.0 Signature Details on the Microsoft installer .exe

This image provides comparison with the Digital Signature tab that is provided on previous Oracle releases.  The tab and signature are not present among the file properties of the AOO builds for Windows.

The properties Details tab is as empty on OO.o 3.3.0 as on the AOO builds though.
Comment 2 Olaf Felka 2012-07-12 09:13:14 UTC 
*** Issue 120261 has been marked as a duplicate of this issue. ***
Comment 3 Olaf Felka 2012-08-19 09:02:13 UTC 
*** Issue 120614 has been marked as a duplicate of this issue. ***
Comment 4 Marcus 2018-02-13 23:15:28 UTC 
*** Issue 127418 has been marked as a duplicate of this issue. ***
Comment 5 Marcus 2018-02-13 23:16:04 UTC 
*** Issue 127702 has been marked as a duplicate of this issue. ***
Comment 6 oooforum (fr) 2018-08-04 16:47:24 UTC 
*** Issue 92489 has been marked as a duplicate of this issue. ***
Comment 7 Matthias Seidel 2021-04-21 16:18:06 UTC 
Since AOO 4.1.8 the Windows installer is signed with a certificate from "The Apache Software Foundation".

The properties detail tab is still empty. This is for the NSIS installer exe.
Comment 8 Matthias Seidel 2021-05-05 21:02:54 UTC 
Added Product Information to NSIS installer.

Committed to trunk with:
https://github.com/apache/openoffice/commit/087cc0409cac70ad09f613a8178fad7bd99216d6

Cherry-picked for AOO42X with:
https://github.com/apache/openoffice/commit/b45fc1969014a1d5a79b04fbca2c66c8e083bead
Comment 9 Matthias Seidel 2021-05-13 10:41:58 UTC 
Cherry-picked for AOO41X.