How to distribute codesigned launchers?

[jaimergp]

Anaconda has signed the currently distributed launchers in both conda and conda-build. That was done locally and the committed to the repo.

How can we sign binaries as part of this package now?

• Public pipeline in CI?
• Repackage the public conda-launchers package and then commit the signed artifacts in the repo?

[wolfv]

That would be ideal, if we had an transparent workflow that builds & signs the binaries. It might be a lot of work though ...

[jezdez]

Pinging @chenghlee @Callek for visibility

[jaimergp]

Turns out we now have win-arm64 launchers, so they could be vendored in conda and conda-build like we have been doing. I'll submit them to conda and conda-build soon but they'll have to be re-signed... I guess we'll find out about the process soon.

[jaimergp]

See:

• Add MSVC-built win-arm64 launcher conda#14401
• Add MSVC-built win-arm64 launchers conda-build#5545

[jezdez]

Following the merge of #7, this ticket is on hold, pending further review of the changes committed.