The Windows installer of ImageMagick will no longer be signed

Original Article ↗ Hacker News Discussion ↗

ImageMagick’s maintainers say they will stop signing the Windows installer after new rules effectively require a hardware-backed or cloud HSM certificate that would cost around $600 per year, prompting them to seek sponsors instead. Commenters argue over whether code-signing on Windows has become a rent-seeking “racket” that disadvantages volunteer open-source projects, or a necessary response to real malware and key-theft incidents. The debate widens into questions about how open source should be funded, whether major platforms and corporations ought to support critical tools like ImageMagick, and if alternatives such as app stores, web apps, or Linux-based workflows are more sustainable.

Economics of Open Source vs. $629 Certificate

  • Many note the irony: ImageMagick represents massive unpaid labor yet struggles to cover a few hundred dollars per year.
  • Explanations offered: contributing code is “fun” and reputation-building; paying money is neither fun nor easy to justify inside companies.
  • Some argue OSS has no inherent business model; others say it must start treating itself as a business to cover real costs.
  • Several commenters object on principle: they can afford certs but refuse to pay to ship software they already give away for free.

Code Signing Requirements and Security Rationale

  • New CA/B Forum rules require hardware-backed keys (HSM or tokens), breaking many CI-based signing workflows.
  • Proponents say stolen keys have been abused in real attacks; HSMs and stricter identity checks improve revocation and accountability.
  • Critics see this as security theater, a protection racket, and a push toward a “corporate web of trust” where publishing software requires being a legal entity tied into Microsoft/CA ecosystems.

Impact on Windows Users and Developers

  • Unsigned binaries trigger SmartScreen, Defender, and browser warnings, confusing non-technical users and harming trust.
  • Some say ImageMagick’s typical usage (bundled in other apps, server-side, or on *nix) makes unsigned Windows installers a minor issue.
  • Others stress that on Windows, unsigned binaries are effectively second-class citizens; signing is practically required for smooth distribution.

Alternatives and Workarounds

  • Suggestions:
    • Use other OSes (Linux, macOS), or run ImageMagick via WSL or containers.
    • Ship portable ZIPs or integrate ImageMagick as a vendored dependency.
    • Distribute via the Microsoft Store (cheaper, MS signs for you).
    • Use cheaper CAs or special OSS offers (e.g., lower-cost code-signing, foundation-backed signing like SignPath).
    • Use cloud HSMs (Azure Key Vault, DigiCert, SSL.com) to restore CI signing.

Calls for a “Let’s Encrypt for Code”

  • Many want a free or very cheap, automated code-signing CA.
  • Objection raised: TLS only proves domain control; code signing is meant to bind binaries to a legal entity for liability and policy reasons.
  • Projects like Sigstore and GitHub/npm provenance are cited as partial solutions, but OS vendors do not yet trust them as roots.

Broader Concerns

  • Thread widens into:
    • Frustration with Windows’ security UX and ecosystem “enshittification.”
    • Debates over sandboxing, app stores, and the erosion of general-purpose computing.
    • The chronic underfunding and governance fragility of critical OSS like ImageMagick.