Changes between Version 4 and Version 5 of CodeSigning


Ignore:
Timestamp:
Jun 10, 2009, 2:11:06 PM (15 years ago)
Author:
davea
Comment:

--

Legend:

Unmodified
Added
Removed
Modified
  • CodeSigning

    v4 v5  
    33BOINC uses digital signatures to allow the core client to authenticate executable files.
    44
    5 '''It is important that you use a proper code-signing procedure for publicly-accessible projects. If you don't, and your server is broken into, hackers will be able to use your BOINC project to distribute whatever malicious code they want. This could result in the end of your project, and possibly the end of all BOINC projects.'''
     5'''It is important that you use a proper code-signing procedure for publicly-accessible projects. If you don't, and your server is broken into, hackers will be able to use your BOINC project to distribute malware. This could result in the end of your project, and will negatively impact all BOINC projects.'''
    66
    77 * Choose a computer (an old, slow one is fine) to act as your "code signing machine". After being set up, this computer '''must remain physically secure and disconnected from the network''' (i.e. keep it in a locked room and put duct tape over its Ethernet port). You'll need a mechanism for moving files to and from the code-signing machine. A USB-connected disk or CD-RW will work, or if your files are small you can use a floppy disk.
     
    1111 * Use [UpdateVersions update_versions] to install your application, including its signature files, in the download directory and database.
    1212
    13 There are less-secure variants; e.g. you could keep the private key on a CD-ROM that is only mounted during signature generation, on a machine that is disconnected during signature generation. But we do not recommend this; a hacked computer could be running a hidden program that steals the private key and transmits it when the computer is connected again.
     13There are less-secure variants; e.g. you could keep the private key on a CD-ROM that is only mounted during signature generation,
     14on a machine that is disconnected during signature generation.
     15But we do not recommend this;
     16a hacked computer could be running a hidden program that steals the private key
     17and transmits it when the computer is connected again.
    1418
    1519== Changing your code-signing key ==