the download experience: lemonade.msi is marked Unsafe by Edge

[tpg-tahc]

This is not a big issue, or maybe not a technical issue at all, but if we want to have more people to try out lemonade and improve their first impression, we should fix this.

[jeremyfowers]

Thanks for the issue @tpg-tahc

as far as I know, my only option for fixing this would be to register an IV (individual verification) certificate and sign the code with that.

Then downside is the code would say “Published by Jeremy Fowers” or similar, which wouldn’t properly credit the great community that works on this code.

What do people think @Geramy @ramkrishna2910 @bitgamma @vgodsoe @danielholanda @sofiageo ?

status quo or IV route?

[bitgamma]

for me the IV option sounds reasonable. However with a quick googling I found this:

https://shop.certum.eu/open-source-code-signing-code.html

not 100% sure if they are reliable or not, but could be what we need?

[jeremyfowers]

This looks like IV, in that they would need my personal info. But then they’d write “open source developer” as the name/org on the cert instead of using my name. I don’t mind this path, just need to establish if they have a good rep.

[bitgamma]

or even this: https://signpath.org/

[jeremyfowers]

This sounds interesting but it’s a very bare bones website. Their rep is the main question.

[jeremyfowers]

They seem to have some very popular OSS projects on board so it could be a great option! I need to look into it a bit more.

[jeremyfowers]

Application submitted! Hope it works out.