Driver signing certificates expired

[dlabun]

While installing IDE 1.8.0 on Windows I found that the signing certificates for the Linino boards have been expired for over a year. All of the Arduino drivers will be expiring over the next weeks.

[Coding-Badly]

What was the error message?
When was the error message displayed?

[dlabun]

Who said anything about an error message?

[Coding-Badly]

Then why are you complaining the signing certificates are expired / expiring?

[dlabun]

There was no complaining but rather a factual issue reported to Arduino.

[Coding-Badly]

Ugh. Stop playing childish games.

Why do you believe an expired / expiring signing certificate is an issue?

[PaulStoffregen]

Indeed, this isn't anything like the recently expired SSL certificate on the website, where users will be impacted. With driver signing, the certificate expiration merely means new drivers can't be signed. Whoever does the signing may have already renewed their certificate, for all we know. If they haven't, they'll do so when they need to sign drivers again.

[dlabun]

@Coding-Badly If you want to be unprofessional, that's fine with me as I'll just let Github support deal with you. BTW, for someone that went on a rant about leaving Github over harassment it's funny you're being childish over an issue report for a project you're not associated with.

@PaulStoffregen 1.8.0 will start throwing driver signature errors if you opt to have the installer install the drivers (which I normally don't). It appears the linino-boards_x86, slabvcp and cdc_vista drivers were all countersigned by now revoked certificates. These drivers did not appear in 1.6.12.

[Coding-Badly]

1.8.0 will start throwing driver signature errors...

Only if the signed file does not include a timestamp. Which has nothing to do with when the signing certificate expires.

You have yet to provide any evidence that the expiration is an actual issue.

[NicoHood]

@Coding-Badly man chill! He wanted to let the arduino team know the issue. So if any problem MAY occur next time we do not have thousand of failed installations on windows (similar to the website https issue). It was a hint, no matter if the world end with arduino tomorrow or not. Good that he let us know.

[cmaglie]

The drivers are timestamped, so the signature will still be valid even if the certificate used for signing expires, because the timestamp guarantee that the signature has been done before the certificate expiration.
The worst that can happen is that we can't sign new drivers, but this will produce an error early in the codesign tool during the build.

This is different from the SSL certificates issue where the update procedure failed to propagate the renewed SSL certificate to the arduino.cc subdomains. In that case you (or a cron job) must actively replace expired certificates.

Thanks for the report BTW!

[PaulStoffregen]

Just for fun, I re-imaged my Windows test machine to a clean Windows 7, and then ran the Arduino 1.8.0 installer. Looks like @dlabun has a point. Seven driver install dialogs appeared, some of them the unsigned driver warning.

[PaulStoffregen]

Here are screenshots of the 7 dialog boxes, in their order or appearance, I saw while installing to a clean system.

It's not my intention to "stir the pot" in this already somewhat unpleasant conversation. I'm going to refrain from commenting on why this happens.

But hopefully these first-time user experience screenshots help?

[cmaglie]

Oh! thanks I'm doing about the same thing (except that my VM is currently stuck doing updates...).
So it looks like @dlabun was right after all :-). I'll check what's happening with the drivers that fail signature verification.