{"thread":{"id":"60310","subject":"Microsoft Smart App Control - Git - git-bash.exe File Unsigned","startedAt":"2023-10-05T20:41:47Z","lastAt":"2023-10-09T17:22:04Z","messageCount":3,"participants":["Rolland Swing (Insight Global LLC)","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"482713","messageId":"SJ1PR21MB369933C2C879EAD0D5EAFBD1E3CAA@SJ1PR21MB3699.namprd21.prod.outlook.com","threadId":"60310","inReplyTo":"SJ1PR21MB3699CA030DE035CA42582AF5E3CAA@SJ1PR21MB3699.namprd21.prod.outlook.com","subject":"Microsoft Smart App Control - Git - git-bash.exe File Unsigned","fromName":"Rolland Swing (Insight Global LLC)","fromEmail":"v-roswing@microsoft.com","sentAt":"2023-10-05T20:41:39Z","receivedAt":"2023-10-05T20:41:47Z","isPatch":false,"sender":{"key":"v-roswing@microsoft.com","avatar":null},"body":"Hi Git Team,\n\nWe're part of the Microsoft team that owns Smart App Control (https://learn.microsoft.com/en-us/windows/apps/develop/smart-app-control/overview), which requires applications to sign all of their executable files (exe, dll, msi, tmp, and a few other file formats).\n \nWe found during internal testing and/or from user feedback that your app, git-bash.exe, is not correctly signed. \n\nBlock Event:   FileName: \\Device\\HarddiskVolume7\\Program Files\\Git\\git-bash.exe\n  Calling Process: \\Device\\HarddiskVolume7\\Windows\\explorer.exe\n  Sha256 Hash: 42F2E685686FB6356A195709AF912C7B9D424466BD7C6D69258AADA5E80AC3C2 \n\nSigning your app is in your best interest, as it positively identifies you as the developer of your application to your customers installing and running your apps, and they can rest assured that your app hasn't been tampered with. For the purposes of Smart App Control, all app binaries including .exe, .dll, .tmp files, and uninstallers all need to be signed.\n\nFor more information on code signing, please refer to: https://learn.microsoft.com/en-us/windows/apps/develop/smart-app-control/code-signing-for-smart-app-control\n \nPlease confirm if the unsigned file(s) will be signed in this or a future build, or if there is no intent to rectify the unsigned executable file(s). \n\nThanks,\n\nRolland Swing | Azure E&P Program Manager\nEnterprise & Security - Platform Integrity Team\nmailto:v-roswing@microsoft.com\n\n\n"},{"id":"482781","messageId":"ZSCvaWuPJ1peZ3KF@tapette.crustytoothpaste.net","threadId":"60310","inReplyTo":"SJ1PR21MB369933C2C879EAD0D5EAFBD1E3CAA@SJ1PR21MB3699.namprd21.prod.outlook.com","subject":"Re: Microsoft Smart App Control - Git - git-bash.exe File Unsigned","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2023-10-07T01:07:53Z","receivedAt":"2023-10-07T01:07:59Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2023-10-05 at 20:41:39, Rolland Swing (Insight Global LLC) wrote:\n> Hi Git Team,\n\nHey,\n\n> We're part of the Microsoft team that owns Smart App Control (https://learn.microsoft.com/en-us/windows/apps/develop/smart-app-control/overview), which requires applications to sign all of their executable files (exe, dll, msi, tmp, and a few other file formats).\n>  \n> We found during internal testing and/or from user feedback that your app, git-bash.exe, is not correctly signed. \n> \n> Block Event:   FileName: \\Device\\HarddiskVolume7\\Program Files\\Git\\git-bash.exe\n>   Calling Process: \\Device\\HarddiskVolume7\\Windows\\explorer.exe\n>   Sha256 Hash: 42F2E685686FB6356A195709AF912C7B9D424466BD7C6D69258AADA5E80AC3C2 \n\nThe Git project doesn't distribute any binaries at all. We distribute\nonly source code. Many distributors compile these to produce binaries.\n\nThe project you are probably thinking of is Git for Windows, which,\nwhile related, is a separate project. They do indeed distribute\nbinaries, and this looks like a binary that's theirs. If you'd like to\ncontact them, you can use their issue tracker\n(https://github.com/git-for-windows/git/issues) to inquire.\n\nHowever, I will note that a cursory search there found\nhttps://github.com/git-for-windows/git/issues/798, where the maintainer\npoints out that there are over 400 exe files and 250 dll files, which\nwould make signing them all excessively burdensome. I expect the\nupcoming requirements for HSM-backed keys for Windows code signing may\nmake that even slower and more burdensome. That being said, perhaps\nwith automation, the maintainer may feel differently than they did in\n2016, so it might be worth asking again.\n-- \nbrian m. carlson (he/him or they/them)\nToronto, Ontario, CA\n"},{"id":"482879","messageId":"SJ1PR21MB3699885158AABEE6392388ECE3CEA@SJ1PR21MB3699.namprd21.prod.outlook.com","threadId":"60310","inReplyTo":"ZSCvaWuPJ1peZ3KF@tapette.crustytoothpaste.net","subject":"RE: [EXTERNAL] Re: Microsoft Smart App Control - Git - git-bash.exe File Unsigned","fromName":"Rolland Swing (Insight Global LLC)","fromEmail":"v-roswing@microsoft.com","sentAt":"2023-10-09T17:21:49Z","receivedAt":"2023-10-09T17:22:04Z","isPatch":false,"sender":{"key":"v-roswing@microsoft.com","avatar":null},"body":"Thanks Brian - I'll reach out to them via their issue tracker.\n\nThanks,\n\nRolland\n\n-----Original Message-----\nFrom: brian m. carlson \nSent: Friday, October 6, 2023 6:08 PM\nTo: Rolland Swing (Insight Global LLC) \nCc: git@vger.kernel.org; Anthony Chuang \nSubject: [EXTERNAL] Re: Microsoft Smart App Control - Git - git-bash.exe File Unsigned\n\nOn 2023-10-05 at 20:41:39, Rolland Swing (Insight Global LLC) wrote:\n> Hi Git Team,\n\nHey,\n\n> We're part of the Microsoft team that owns Smart App Control (https://learn.microsoft.com/en-us/windows/apps/develop/smart-app-control/overview), which requires applications to sign all of their executable files (exe, dll, msi, tmp, and a few other file formats).\n>  \n> We found during internal testing and/or from user feedback that your app, git-bash.exe, is not correctly signed. \n> \n> Block Event:   FileName: \\Device\\HarddiskVolume7\\Program \n> Files\\Git\\git-bash.exe\n>   Calling Process: \\Device\\HarddiskVolume7\\Windows\\explorer.exe\n>   Sha256 Hash: \n> 42F2E685686FB6356A195709AF912C7B9D424466BD7C6D69258AADA5E80AC3C2\n\nThe Git project doesn't distribute any binaries at all. We distribute only source code. Many distributors compile these to produce binaries.\n\nThe project you are probably thinking of is Git for Windows, which, while related, is a separate project. They do indeed distribute binaries, and this looks like a binary that's theirs. If you'd like to contact them, you can use their issue tracker\n(https://github.com/git-for-windows/git/issues) to inquire.\n\nHowever, I will note that a cursory search there found https://github.com/git-for-windows/git/issues/798, where the maintainer points out that there are over 400 exe files and 250 dll files, which would make signing them all excessively burdensome. I expect the upcoming requirements for HSM-backed keys for Windows code signing may make that even slower and more burdensome. That being said, perhaps with automation, the maintainer may feel differently than they did in 2016, so it might be worth asking again.\n--\nbrian m. carlson (he/him or they/them)\nToronto, Ontario, CA\n"}]}