8

In order to submit a desktop application for the Windows 8 app store, you need to digitally sign any driver or .exe associated with the application. However, the application I was trying to submit contains several files that are redistributions of other companies' software, and some of these are not signed. My application was rejected on these grounds. Is it legal (or ethical) to sign other companies' work so that we can submit our application? I think it might be considered some form of false representation but I'm not sure.

| improve this question | | | | |
  • 3
    I've seen similar problems with mobile apps (for BlackBerry you needed to use signed binaries to access some APIs, for example). And there the summary was basically: by signing, you vouch for the binary and assume responsibility for it. So it's not like you're claiming its your binary, you simply claim that you're responsible for it, if it does naughty stuff ;-) As always, that's not legal advice, yada yada ... – Joachim Sauer Jul 15 '13 at 14:52
  • By the way, if someone feels this question is more appropriate in another section of the site, please let me know. – PixelArtDragon Jul 15 '13 at 14:54
  • 1
    I would ask the creators of the unsigned files if they can get them signed. If their license allows redistribution I don't see why they wouldn't want to do this as I bet there are other users of their files in the same position as you. If they don't want to sign their files for some reason, you could always ask if they minded you doing so for your application – razethestray Jul 15 '13 at 14:57
  • 1
    Will the store accept files that have different signatories? Or must it all be signed by the same? For example, I know in java web start, a signed app must have one, and only one signatory of all the files (have to unsign and resign any jars that have been signed by a third party first). – user40980 Jul 15 '13 at 15:40
  • @MichaelT They are just looking for a digital signature; who's doesn't matter. That's why I'm asking if my company would be permitted to use ours in order to get the app approved. – PixelArtDragon Jul 15 '13 at 15:42
9

I can only answer this question on an ethical basis. Whether my ethical viewpoint is reflected in law is totally outside of my domain of expertise. (Also, I don't know the ins-and-outs of Microsoft's signing practices, so please correct me if I say something that's inconsistent with MS's way of doing things.)

Suppose you sign some file F (having some contents C) with a signing key K. The resulting file/signature pair [F, S(K,C)] says:

The owner of key K hereby asserts that file F has contents C.

Assuming you have the right to distribute the files unsigned, it would seem that you would also have the default right to distribute them with a signature. A signature is a purely programmatic cryptographic transformation of the file that carries the above assertion. (Saying that you can't cryptographically sign something is quite close to claiming you're not allowed to produce a hash of it.)

Your signature doesn't assert that you're the author of the code, but rather it asserts that you are a point of trust in the distribution of the code. That's not being misleading; that's merely a perfectly accurate representation of what is happening. The end recipient must decide whether they trust code distributed by you. The identity of the original author isn't relevant for our trust model, because you are the last person that touched the code before it arrived at their computer.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.