Page MenuHome GnuPG - static
Create Task
Maniphest T7070

Missing signature on uninstallers (leads to Windows warning when trying to deinstall)
Closed, WontfixPublic
Actions

Description

Find the Gpg4win app in the system config dialog and try to uninstall.
Result: UAC question allowing manipulation from an unknown vendor.

Expected result: UAC question to allow manipulation from binary signed by g10code.

Analysis

Code signatures missing for unstallers.

Get-AuthenticodeSignature -FilePath  'C:\Program Files (x86)\Gpg4win\gpg4win-uninstall.exe'
Verzeichnis: C:\Program Files (x86)\Gpg4win
SignerCertificate                         Status                                 Path
-----------------                         ------                                 ----
                                          NotSigned                              gpg4win-uninstall.exe
                                          
Get-AuthenticodeSignature -FilePath  'C:\Program Files (x86)\Gnupg\gnupg-uninstall.exe'
Verzeichnis: C:\Program Files (x86)\Gnupg
SignerCertificate                         Status                                 Path
-----------------                         ------                                 ----
                                          NotSigned                              gnupg-uninstall.exe

Tested on Windows 10.

Details

Version
4.3.1

Event Timeline

bernhard created this task.Apr 3 2024, 8:59 AM
• werner closed this task as Wontfix.Apr 3 2024, 9:30 AM
• werner claimed this task.
• werner added a subscriber: • werner.

This is long known and we won't fix this for gpg4win.

bernhard added a comment.Apr 3 2024, 11:45 AM

Sorry, I did not know (or had forgotten, I did search the tracker first).
What is the rationale for not signing the uninstallers?