search

mattermost / docs

Mattermost documentation
https://docs.mattermost.com
BSD 3-Clause "New" or "Revised" License
210 stars 580 forks source link

Help Wanted: Document how to codesign a build with you own certificates #3872

Open matterdoc opened 4 years ago

matterdoc commented 4 years ago

Context

The Mattermost Product Documentation doesn't currently include details on how to code sign a build with a user's own certificates.

Code signing is the process of digitally signing software to verify the author's identity and ensure the code hasn't been altered since it was signed. It involves creating a digital signature using a private key and a hash of the code, then attaching this signature and a digital certificate to the software.

Benefits

Process Outline

  1. Generate a hash of the code.
  2. Sign the hash with a private key, creating a digital signature.
  3. Attach the signature and digital certificate to the software.
  4. Verification: When run, the software's signature is checked using a public key to confirm authenticity and integrity

Documentation Request

Document how to code sign a build with you own certificates for a custom Mattermost build. Include process steps for all supported platforms, including: Windows, Mac, and Linux.

Here's a step-by-step guide on how to code sign a custom Mattermost build with your own certificates for Windows, Mac, and Linux as noted below.

General note for all platforms:

Ensure you follow each operating system's guidelines and best practices for signing applications to maintain security and trustworthiness for your custom Mattermost build.

Windows

Prerequisites:

  1. Code Signing Certificate: Either purchase one from a Certificate Authority (CA) or use a self-signed certificate if appropriate.
  2. SignTool: This is part of the Windows SDK.

Steps:

  1. Install SignTool: Install the Windows SDK to get the SignTool utility.
  2. Obtain a Code Signing Certificate:
    • Purchase or create a certificate (.pfx file) via a CA.
  3. Import the Certificate:
    • Open the .pfx file and follow the steps to import it into the Windows Certificate Store.
  4. Sign the Executable:
    • Open the command prompt as Administrator.
    • Use the SignTool to sign your executable: 
      signtool sign /v /s "My" /sha1 <cert hash> /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 <path-to-your-executable>

Mac

Prerequisites:

  1. Developer ID Application Certificate: Purchase one from Apple (requires an Apple Developer account).
  2. Xcode: Make sure you have Xcode installed.

Steps:

  1. Obtain a Code Signing Certificate:

    • Go to Apple Developer account, create a Developer ID Application certificate, and download it.

  2. Import the Certificate:

    • Double-click the certificate to import it into the Keychain.

  3. Sign the Application:

    • Use the codesign tool, which comes with Xcode, to sign your application: 
      codesign --deep --force --verify --verbose --sign "Developer ID Application: Your Name (TeamID)" /path/to/your.app

  4. [Optional] Verify the Signature:

    • Verify the signature to ensure everything is correctly signed: 
      spctl --assess --verbose=4 /path/to/your.app
codesign -dv --verbose=4 /path/to/your.app

Linux

Prerequisites:

  1. GPG Key: Create a GPG key if you don't have one.
  2. GnuPG: Install GnuPG if not already installed.

Steps:

  1. Create or Import Your GPG Key:

    • If you don't already have a GPG key, create one: 
      gpg --full-generate-key
    • Import an existing GPG key, if you have one: 
      gpg --import /path/to/your-key.asc

  2. Sign the Package:

    • Use dpkg-sig to sign a Debian package: 
      dpkg-sig --sign builder your-package.deb
    • Use rpmsign to sign an RPM package: 
      rpmsign --addsign your-package.rpm

  3. Verify the Signature:

    • Verify the signature of a .deb package: 
      dpkg-sig --verify your-package.deb
    • Verify the signature of an .rpm package: 
      rpm --checksig your-package.rpm

Summary:

Lorem703 commented 4 years ago

I am a beginner in open source and would like to contribute to this issue. Pl assign this issue

justinegeffen commented 4 years ago

Hi @Lorem703! Thank you for your interest in this issue. I have assigned it to you as requested. :) Please let me know if you have any questions.

yash2189 commented 4 years ago

Hello is this issue still available to work on ? As I am new to opensource and I would like to contribute to the documentation part of mattermost/docs. Thanks

justinegeffen commented 4 years ago

Hi @yash2189. Thanks for your offer! @Lorem703, are you currently working on this? :)

yash2189 commented 4 years ago

@justinegeffen Is this issue resolved or can it be taken?

justinegeffen commented 4 years ago

Hi @yash2189. It has not yet been resolved so I am happy to reassign it to you and take it off @Lorem703's plate. @Lorem703, thank you for your offer to take this on. Looking forward to working with you in the future! :)

yash2189 commented 4 years ago

@justinegeffen I wish to contribute to this issue post the Hacktoberfest if that is fine?

cwarnermm commented 2 years ago

@Willyfrog - I'm unable to access the original Mattermost thread and context behind this docs request. Can you summarize the request here, please?

Willyfrog commented 2 years ago

I'm unable to access the original Mattermost thread and context

That's weird as that thread is in a public channel.

What needs to be documented is the process to codesign a build with you own certificates in case someone wants to do a custom build.

yesbhautik commented 2 days ago

@cwarnermm Assign me, let's do it!