As in the title - the VSCodium.exe binary deployed by the installer is unsigned. This introduces the same security risk that signing the installer mitigates: Windows Defender will prevent the signed binary from executing if the file hash doesn't match the certificate. Where this becomes especially problematic is when more advanced security tools like Carbon Black App Control are in use. If properly configured, CBAC will allow the unsigned binary to execute if it was deployed by a signed installer, but it will still often prevent it from launching any child application processes regardless of signing state.
Example block from the user side:
From the server side:
This is showing that the signed installer that VSCodium attempted to run for auto update was blocked because the parent process is an unsigned binary. Here is what CBAC knows about this particular VSCodium binary:
Running the installer manually works because we already trust the signer, but hopefully I've illustrated how having an unsigned payload binary can lead to unexpected results especially when dealing with enterprise level security.
TL;DR: Pretty please with sugar on top can we get signed payload binaries in future releases? I really don't want to go back to Microsoft's build. 😭
As in the title - the
VSCodium.exebinary deployed by the installer is unsigned. This introduces the same security risk that signing the installer mitigates: Windows Defender will prevent the signed binary from executing if the file hash doesn't match the certificate. Where this becomes especially problematic is when more advanced security tools like Carbon Black App Control are in use. If properly configured, CBAC will allow the unsigned binary to execute if it was deployed by a signed installer, but it will still often prevent it from launching any child application processes regardless of signing state.Example block from the user side:
From the server side:
This is showing that the signed installer that VSCodium attempted to run for auto update was blocked because the parent process is an unsigned binary. Here is what CBAC knows about this particular VSCodium binary:
Running the installer manually works because we already trust the signer, but hopefully I've illustrated how having an unsigned payload binary can lead to unexpected results especially when dealing with enterprise level security.
TL;DR: Pretty please with sugar on top can we get signed payload binaries in future releases? I really don't want to go back to Microsoft's build. 😭