Issue 119017

Summary: The Windows installation file has missing properties and lacks a code signature
Product: Installation Reporter: orcmid <orcmid>
Component: codeAssignee: AOO issues mailing list <issues>
Status: RESOLVED FIXED QA Contact:
Severity: Normal    
Priority: P3 CC: automatice, kyanha.apacheopenofficebugzilla, louqingle, malte_timmermann, mseidel, suelette
Version: 3.4.0 Beta (OOo)   
Target Milestone: 4.2.0   
Hardware: PC   
OS: Windows, all   
Issue Type: DEFECT Latest Confirmation in: 4.1.10
Developer Difficulty: ---
Attachments:
Description Flags
Typical empty Description Properties on AOO Windows install .exe files
none
The OOo 3.3.0 Signature Details on the Microsoft installer .exe none

Description orcmid 2012-03-04 23:24:49 UTC
Created attachment 77295 [details]
Typical empty Description Properties on AOO Windows install .exe files

Neither the r1293550 OOo-Dev 3.4 or OOo 3.4 pre-candidate developer snapshots have completed property information on the downloaded .EXE.

In addition to any origin-identifying property information, there is also no digital signature on the .EXE.

The consequence is the inability of a casual user to use the available Windows provisions for verifying what the executable is described to be and what authority signed the executable.  There is therefore no straightforward means of learning that a code signature is not verifiable for any reason.

I note that the last OOo 3.3.0 that I have downloaded, OOo_3.3.0_Win_x86_install-wJRE_it.exe is digitally signed by Oracle America, Inc., was countersigned by a Verisign time service, and there is detailed certificate information.  The Property Details are also omitted on the OOo 3.3.0 installer .exe.
Comment 1 orcmid 2012-03-04 23:27:26 UTC
Created attachment 77296 [details]
The OOo 3.3.0 Signature Details on the Microsoft installer .exe

This image provides comparison with the Digital Signature tab that is provided on previous Oracle releases.  The tab and signature are not present among the file properties of the AOO builds for Windows.

The properties Details tab is as empty on OO.o 3.3.0 as on the AOO builds though.
Comment 2 Olaf Felka 2012-07-12 09:13:14 UTC
*** Issue 120261 has been marked as a duplicate of this issue. ***
Comment 3 Olaf Felka 2012-08-19 09:02:13 UTC
*** Issue 120614 has been marked as a duplicate of this issue. ***
Comment 4 Marcus 2018-02-13 23:15:28 UTC
*** Issue 127418 has been marked as a duplicate of this issue. ***
Comment 5 Marcus 2018-02-13 23:16:04 UTC
*** Issue 127702 has been marked as a duplicate of this issue. ***
Comment 6 oooforum (fr) 2018-08-04 16:47:24 UTC
*** Issue 92489 has been marked as a duplicate of this issue. ***
Comment 7 Matthias Seidel 2021-04-21 16:18:06 UTC
Since AOO 4.1.8 the Windows installer is signed with a certificate from "The Apache Software Foundation".

The properties detail tab is still empty. This is for the NSIS installer exe.
Comment 8 Matthias Seidel 2021-05-05 21:02:54 UTC
Added Product Information to NSIS installer.

Committed to trunk with:
https://github.com/apache/openoffice/commit/087cc0409cac70ad09f613a8178fad7bd99216d6

Cherry-picked for AOO42X with:
https://github.com/apache/openoffice/commit/b45fc1969014a1d5a79b04fbca2c66c8e083bead