Windows Installer (MSI) causes warnings due to missing digital signature
idg10 opened this issue · 2 comments
Expected Behavior
When I install a legitimate .msi file from a trusted source, it should have a digital signature enabling me to be confident that I've installed the real thing. (Windows will try quite hard to discourage you from installing unsigned software.) This should be true for dapr.msi.
Actual Behavior
The dapr.msi in the current (1.13.0) release does not contain a signature, causing scary warnings from Windows. If you download the dapr.msi from the https://github.com/dapr/cli/releases page with Edge, it tries quite hard to discourage you from using the file, warning that it's from an unknown source and that it might cause your computer harm. If you push through this and run the installer, then once you get through the installer's first couple of pages, you'll see an elevation prompt but it's the scary yellow one designed to warn you that you might be able to compromise your machine.
You get the same yellow warning elevation prompt if you use winget because that just downloads and installs the same dapr.msi file.
Steps to Reproduce the Problem
Run the installer with WinGet as described in the getting started docs:
winget install Dapr.CLI
Go through the install process. Toward the end, Windows will show an elevation prompt, but it will have a yellow heading and will warn you that it can't verify that the code is of trustworthy origin. It does this because the installer does not include a digital signature.
Alternatively, download the msi file in the https://github.com/dapr/cli/releases/tag/v1.13.0 release, using the Edge browser and notice that it strongly suggests that you don't want to touch the file with a 10 foot bargepole. Push through, overriding its various attempts to protect you from yourself and run the installer file, and notice that as you get close to the end of the installation process, you get a yellow-bannered warning in the elevation prompt.
Release Note
RELEASE NOTE: ADD digital signature in Windows Installer (msi)
This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged (pinned, good first issue, help wanted or triaged/resolved) or other activity occurs. Thank you for your contributions.
This issue has been automatically closed because it has not had activity in the last 37 days. If this issue is still valid, please ping a maintainer and ask them to label it as pinned, good first issue, help wanted or triaged/resolved. Thank you for your contributions.