Phillipus
commented
8 months ago ImageMagick has the same problem. See https://github.com/ImageMagick/ImageMagick/discussions/6826
"Today our code signing certificate will expire. For many years LeaderSSL sponsored us with a code singing certificate but they are no longer able to do so. Since June of 2023 the CA/B Forum requires that OV code signing private keys be stored on a FIPS 140-2 Level 2 or Common Criteria Level EAL4+ certified device. This means we are no longer able to export our code signing certificate with its private key and use this in GitHub actions. We would now either need to have our own GitHub agent and hardware token or use a cloud solution (e.g. digicert). Our preference would be to use a cloud solution that integrates with GitHub. Digicert seems to be our only option now but a certificate there would cost $629 (tax excluded) for a single year. If your organization requires a signed installer then please consider sponsoring us with a code signing certificate."
This is to track the issues around signing Archi's Windows binaries:
In January 2023 I paid $99 for an OV Sectigo code signing certificate from the Code Signing Store lasting one year. Since then the Archi Windows binaries have been signed.
That certificate expires in January 2024 but things have changed:
"Starting in May 2023, new industry requirements from the CA/B Forum require that all code signing certificate keys are stored on an HSM or compliant hardware token. As part of implementing these changes, Sectigo has increased code signing certificate prices."
Since January 2023 the Archi build process has been done using GitHub Actions, storing the certificate keys in GitHub secrets. A hardware key would mean that this is no longer possible and would have to be done manually on a local machine.
An option is to use cloud signing with GitHub Actions integration, but the cost can be greater ($600 a year)
Note that there are two types of code signing - Organization Validated (OV), and Extended Validation (EV). To get EV you need to be a legal entity with legal documents and backing. Therefore we can only apply for an OV certificate.
I'm looking for a cheap solution that favours open source projects. Some OSS projects are sponsored by companies who pay for the certificate and optionally host the certficate.
We need to find a solution by January 2024.