Learn more about these different git repos.
Other Git URLs
The new version fixes https://bugzilla.redhat.com/show_bug.cgi?id=1840663. Link to the release: https://github.com/FedoraQt/MediaWriter/releases/tag/4.1.6
When do you need this? (YYYY/MM/DD) The sooner the better.
If we cannot complete your request, what is the impact? MediaWriter not working on Mac OS X Catalina
We have a way to sign the macos build, but we need to figure out the windows signing as our cert is expired and the way to sign windows builds got changed.
Metadata Update from @mohanboddu: - Issue tagged with: groomed, high-gain, high-trouble
We have requested a new windows signing cert... I'll look at the mac side soon. Sorry for the delay here, but we will get there...
@kevin do you have an ETA? (not looking for any particular answer, just any answer :smile:)
I hope to have something next week? We got the windows cert, but I need to sit down and sort out how to use it and setup the signing mac thats currently in a box...
I may have an additional request, not sure if you want a separate ticket for it.
In https://silverblue.fedoraproject.org/download there are links to unexisting FMW packages. Ideally we would like to have some links there which don't have version in their names so we don't need to update them all the time?
Like: 1) https://getfedora.org/fmw/FedoraMediaWriter-osx.dmg 2) https://getfedora.org/fmw/FedoraMediaWriter-win32.exe
Which would always link to the latest signed packages.
It's not just https://silverblue.fedoraproject.org/download.. The same links[0][1] are used in https://getfedora.org/en/workstation/download/ and probable elsewhere as well.
[0] - https://github.com/FedoraQt/MediaWriter/releases/download/4.1.5/FedoraMediaWriter-win64-4.1.5.exe [1] - https://github.com/FedoraQt/MediaWriter/releases/download/4.1.5/FedoraMediaWriter-osx-4.1.5.unnotarized.dmg
edited: added links that are used
@jgrulich can you please open a ticket for this on the websites repo?
Done: https://pagure.io/fedora-web/websites/issue/130
@kevin do you have an update for this?
Yes.
We got a new windows side cert, but there's some issues internally about this cert, who can use it, etc. It's being discussed with infosec now. I can provide more details in private if you like. In the mean time @humaton has the cert and was going to see about signing this version, but I don't know if he's had a chance to look at it yet.
The mac one I'm afraid I haven't made much progress on. I will really try and move it forward.
We got a new windows side cert, but there's some issues internally about this cert, who can use it, etc. It's being discussed with infosec now. I can provide more details in private if you like.
If there's anything I can do to help move things along from that side, I'm happy to discuss it privately. Otherwise, I'll just stay out of your way for a bit and hope you have an update soon :-)
Hi, the SOP for FMW signing is updated with new instruction about certificate conversion so the signing script can pickup.
Anything we can do to unblock the signing?
Status update:
On the windows side: We have finally jumped through every hoop and have the cert ready to use. I have handed it to @humaton to work on signing the windows build.
On the mac side: I used some of my holiday yesterday to find, unpack and connect up my mac mini signing box. I am not sure if it needs to be upgraded, or if we can just sign like we used to. It might be helpfull for me to have some macos tester folks that could test signed builds and let me know if they work as expected or if we need to upgrade/adjust our process. Hopefully I will have something to test very soon.
Thanks for the update @kevin. I have an old Macbook Pro that I could test on when you have a signed build ready for testing.
Thanks @bcotton will let you know when I have something to test.
ok, first cut: https://scrye.com/~kevin/fedora/FedoraMediaWriter-osx-4.1.6.dmg
Let me know how that behaves...
Status update: On the windows side: We have finally jumped through every hoop and have the cert ready to use. I have handed it to @humaton to work on signing the windows build. On the mac side: I used some of my holiday yesterday to find, unpack and connect up my mac mini signing box. I am not sure if it needs to be upgraded, or if we can just sign like we used to. It might be helpfull for me to have some macos tester folks that could test signed builds and let me know if they work as expected or if we need to upgrade/adjust our process. Hopefully I will have something to test very soon.
Thanks a LOT! We are planning for a test day on the 18th , can we use these new builds? https://testdays.fedorainfracloud.org/events/93
ok, first cut: https://scrye.com/~kevin/fedora/FedoraMediaWriter-osx-4.1.6.dmg Let me know how that behaves...
Hi,
I'm basically unexperienced with Mac OS X, but trying it, it shows a dialog that "Fedora Media Writer" can't be opened because Apple cannot check it for malicious software.
Is this how it's supposed to work? How it should be installed when Finder doesn't allow me to?
@jgrulich Hi I am trying to sign the windows binaries running script in dist/win/build.sh, got through one obstacle with missing osslsigncode in fedora. I have the upstream version packaged locally. But invoking the script raises this exception: + cp -r /usr/i686-w64-mingw32/sys-root/mingw/bin/libgcc_s_sjlj-1.dll . cp: cannot stat '/usr/i686-w64-mingw32/sys-root/mingw/bin/libgcc_s_sjlj-1.dll': No such file or directory
+ cp -r /usr/i686-w64-mingw32/sys-root/mingw/bin/libgcc_s_sjlj-1.dll . cp: cannot stat '/usr/i686-w64-mingw32/sys-root/mingw/bin/libgcc_s_sjlj-1.dll': No such file or directory
I had no luck searching for that file in fedora packages...
Not unless they test out as working... please don't distribute them until we are sure they are right.
Hi, I'm basically unexperienced with Mac OS X, but trying it, it shows a dialog that "Fedora Media Writer" can't be opened because Apple cannot check it for malicious software. Is this how it's supposed to work? How it should be installed when Finder doesn't allow me to?
I think thats now default and you need to "In System Preferences, click Security & Privacy, then click General. Click the lock and enter your password to make changes. Select App Store under the header “Allow apps downloaded from.” and change that to "app store and identified developers"
If you do that does it let you launch it?
Ref: https://support.apple.com/en-us/HT202491
Works for me on macOS Catalina (10.15.6)
@jgrulich Hi I am trying to sign the windows binaries running script in dist/win/build.sh, got through one obstacle with missing osslsigncode in fedora. I have the upstream version packaged locally. But invoking the script raises this exception: + cp -r /usr/i686-w64-mingw32/sys-root/mingw/bin/libgcc_s_sjlj-1.dll . cp: cannot stat '/usr/i686-w64-mingw32/sys-root/mingw/bin/libgcc_s_sjlj-1.dll': No such file or directory I had no luck searching for that file in fedora packages... Does https://stackoverflow.com/questions/12921911/mingw-libgcc-s-sjlj-1-dll-is-missing help?
Does https://stackoverflow.com/questions/12921911/mingw-libgcc-s-sjlj-1-dll-is-missing help?
It says: You have to use -static-libgcc while compiling with mingw’s g++ to eliminate the dependency on LIBGCC_S_SJLJ-1.DLL. You can do that by adding static-libgcc to the linker flags.
Thanks a LOT! We are planning for a test day on the 18th , can we use these new builds? https://testdays.fedorainfracloud.org/events/93 Not unless they test out as working... please don't distribute them until we are sure they are right. Hi, I'm basically unexperienced with Mac OS X, but trying it, it shows a dialog that "Fedora Media Writer" can't be opened because Apple cannot check it for malicious software. Is this how it's supposed to work? How it should be installed when Finder doesn't allow me to? I think thats now default and you need to "In System Preferences, click Security & Privacy, then click General. Click the lock and enter your password to make changes. Select App Store under the header “Allow apps downloaded from.” and change that to "app store and identified developers" If you do that does it let you launch it? Ref: https://support.apple.com/en-us/HT202491
That's what I already had configured. It works now after updatde to macOS 10.15.6, because the Media Writer app appeared in the "Allow apps downloaded from" list and from there I was able to enable it.
ok, then. Shall we pushed the new osx one out? Or wait for the windows one to be ready too?
@humaton any news on the windows binary signing?
Let's get the macOS version published now. The current one is broken, so we should publish the fix even if Windows isn't ready yet.
ok, it should sync out the bottom of the next hour. (17:30UTC).
So here a final build: https://fedorapeople.org/~humaton/FMW/FedoraMediaWriter-win32-4.1.6.exe
it should have all executables signed.
@sgallagh verified it for us:
[11:34:25] <sgallagh> Windows protected your PC [11:34:25] <sgallagh> Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk. [11:34:25] <sgallagh> App: [11:34:25] <sgallagh> FedoraMediaWriter-win32-4.1.6.exe [11:34:26] <sgallagh> Publisher: [11:34:26] <sgallagh> Red Hat, Inc.
Filed a websites ticket to update them - https://pagure.io/fedora-web/websites/issue/150
Metadata Update from @mohanboddu: - Issue close_status updated to: Fixed - Issue status updated to: Closed (was: Open)
Login to comment on this ticket.