Signed binaries.

[BenAveling]

Would it be possible to sign the released binaries?

Without a signature, Pomerium is getting blocked by end point protection software, and quarantined.

Unknown Publisher...
... prevented an unrecognized app from running.

[desimone]

@BenAveling can you provide a bit more details on your environment?

• What binaries?
• What operating system?
• What architecture?
• Version of pomerium?
• etc

Thanks!

[BenAveling]

What binaries?

Immediate issue is Pomerium desktop, but I understand CLI client is the same.

What operating system?

Windows.

What architecture?

64 bit, but I'm sure it doesn't matter.

Version of pomerium?

Observed with 0.17.1 and 0.18.0. Presumably others.

Etc....

This is what the properties for a random signed binary looks like:

Pomerium binaries are lacking that tab (because they aren't signed)

Because the binary is unsigned/unknown/untrusted, this can cause malware detection to trigger, and either block, or even quarantine (delete) the binary:

[BenAveling]

We've asked our vendor to allow-list this release.

Once enough other customers do the same, this will stop being a problem, for this release.