Signature wrong on installer HandBrake-1.1.2-x86_64-Win_GUI.exe

[sandy]

Description of problem or question:
Signature for download HandBrake-1.1.2-x86_64-Win_GUI.exe is "Open Source Developer Scott Rae" instead of "Handbrake Team". I had my Mac computer infected last year by rogue handbrake update. Don't want that to happen again. Please clarify signature name in your downloads page.

Steps to reproduce the problem (If Applicable):
Open Installer in Win 10

HandBrake version (e.g., 1.0.0):
see above installer

Operating system and version (e.g., Ubuntu 16.04 LTS, macOS 10.13 High Sierra, Windows 10 Creators Update):
Win 10 build 17134

HandBrake Activity Log ***required*** (see How-to get an activity log)
Not applicable before installation

Code: Select all

Please replace this text with the contents of your log file between the two code tags - OR -  provide a pastebin URL in place of these 3 lines.

[s55]

The signature is not wrong. Since there is no legal entity behind HandBrake, we cannot have a project level cert. Cert authorities won't allow it.
In fact, even getting this cert was a major pain in the ass. So I sign on behalf of the HandBrake team.

[BradleyS]

Sandy, I'm sorry to hear about your Mac, that was a bad situation indeed.

Needless to say, we continue to work tirelessly on security measures, signatures being one. Scott and Damiano are graciously signing our Windows installer and Mac app, respectively.

Is there any part of the documentation or our GitHub that led you to believe the signature should read HandBrake Team? If so, I would like to clarify those areas so other security-conscious people like yourself know what to expect.

[s55]

Maybe off our a PGP public key which is "The HandBrake Team"?

We deliberately publish the PGP public key/sigs with every download for this reason. (On both the site and github, incase one or the other ever got compromised you'd have two points of verification).

No one has a trust relationship with myself or Damiano. The exe signing is more there to allow Operating system level trust to avoid an awkward install experience. It's also possible that someone else could get a certificate in our names, or in the project name if they were to setup a legal entity for example, so you really can't trust the name on the code sign cert.

[BradleyS]

Ah, yes, the PGP signature. Indeed, those serve a somewhat different purpose and syncing names with the code sign cert is of little value.