[Cscwg-public] Minutes of Code Signing Working Group July 18, 2019

[Dean Coclin]

Approved Minutes:

 

1.	Call to Order - Completed
2.	Reading of AntiTrust Statement - Bruce read the anti-trust statement
3.	Role Call - Atsushi Inaba, Bruce Morton, Frank Corday, Gordon Bock,
Joanna Fox, Karthik Ramasamy, Rich Smith, Robin Alden
4.	Status of Ballot for current code signing guidelines: 

a.	In IPR review until August 13, 2019
b.	It was asked if there are any changes to the current code signing
guidelines and answered that the new code signing guidelines have no
technical changes.

5.	Additional changes to current guidelines and EV guidelines: 

a.	No new items were offered.
b.	Did discuss High Risk certificate requests. We need data to mitigate
impersonation and certificate requests from known malware signers. The
guidelines do not provide information on how high risk requests should be
done. If this cannot be improved, then a possible solution will be to remove
the requirement. Gordon stated that there is data, but there are no tools
for the CAs to use the data, nor is there a policy on how the data should be
used. Still more work to be done.

6.	Any other business: 

a.	Bruce discussed the email sent to consider moving the code signing
documents from 2 documents on code signing to 1 code signing document and 1
time-stamping document. Both would be in RFC 3647 format. The goal would be
to merge the same content together to simplify deployment and auditing.
Robin suggested that changing the documents is not the highest priority.
Bruce agreed that we should first address urgent items which are currently
broken in the code signing guidelines.
b.	No other any other business was discussed.

7.	Adjourn

 

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/cscwg-public/attachments/20190801/f3e40ac1/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4916 bytes
Desc: not available
URL: <http://cabforum.org/pipermail/cscwg-public/attachments/20190801/f3e40ac1/attachment-0001.p7s>