Repository navigation
[C++][CI][Packaging][FlightPRC] Manual ODBC Windows MSI installer signing #49404
Description
Describe the enhancement requested
The Apache Arrow Flight SQL ODBC Windows MSI installer needs to be signed in order for Windows defender to allow install.
Acceptance Criteria:
Implement manual code signing process to:
- Sign ODBC Windows MSI installer
- Sign ODBC DLL files that will be installed by MSI installer
Reference comment for this issue: #48934 (comment)
Component(s)
FlightRPC, Packaging
Activity
amoeba commentedon Feb 27, 2026
I've sent a request to ASF Infra requesting access to code signing. I'll update here when that's done and I can continue with this.
alinaliBQ commentedon Feb 27, 2026
Thanks Bryce!
alinaliBQ commentedon Mar 11, 2026
Hi @amoeba do you know if Windows MSI signing could be included in Arrow 24.0?
amoeba commentedon Mar 11, 2026
My request with ASF for access to code signing is still in progress. I just pinged them. Once we get that, I think we can move ahead with a patch to implement manual code signing. I did some research on how hard it would be to make the Windows .DLL and .MSI files reproducible and it looks hard if not impossible.
[-][C++][CI][Packaging][FlightPRC] ODBC Windows MSI installer signing[/-][+][C++][CI][Packaging][FlightPRC] Manual ODBC Windows MSI installer signing[/+]alinaliBQ commentedon Mar 11, 2026
Got it, I have changed the issue description to indicate manual code signing process instead. Thanks Bryce for helping out!
amoeba commentedon Mar 12, 2026
I now have access to Windows code signing. This weekend I'll work on doing a dry-run with the cert and jsign so we can know if it will work at release time. I'm almost set up for macOS too.
amoeba commentedon Mar 16, 2026
I did a test signing today with jsign to confirm everything from ASF infra is set up. It was just a single
jsigncommand as indicated in #48934 (comment) and it works with SmartScreen as expected.I think we need a few more things here:
odbc-msvcjob needs to be modified to upload the raw materials for the installer (as many files as needed socpackwill run) and the later steps in that workflow may need to be tweaked.arrow_flight_sql_odbc.dllis dynamically linked to{arrow,arrow_compute,arrow_flight,arrow_flight_sql}.dll. Can we investigate static linkage (i.e., makearrow_flight_sql_odbc.dllonly depend on system deps) @alinaliBQ?04-binary-download.shto download the raw WiX installer artifacts instead of the MSI05-binary-upload.shto jsign thearrow_flight_sql_odbc.dllinside the WiX installer artifacts dir, build the installer, and jsign the installer. Both the jsign command and WiX are hard for existing release managers to run (jsign requires credentials and WiX is Windows only). We should talk about the best way to integrate this into the release process and whether a separate step should be added.I did a quick research into reproducible builds for Windows .DLL and .MSI and my initial findings weren't that promising but I think more research could be done here. @raulcd @kou what do you think about having a manual step that requires setup and Windows in the release process?
kou commentedon Mar 16, 2026
How about using GitHub Actions to build MSI with WiX and signed artifacts?
(Uploading the signed artifacts to GitHub Releases -> Run GitHub Actions via
workflow_dispatch-> Build the MSI on GitHub Actions and upload it to GitHub Releases -> Download the MSI from GitHub Releases and sign it)amoeba commentedon Mar 16, 2026
That would be better. How about making a new script like
07-flightsqlodbc-upload.shto handle those steps + the jsign commands.alinaliBQ commentedon Mar 16, 2026
07-flightsqlodbc-upload.sh, this is my understanding based on the discussion:How does this flow sound?
i. Download materials from workflow run id -> sign ODBC DLL -> upload to GitHub release.
ii.
gh workflow runto trigger workflow that retrieves signed materials from GitHub release and runscpackto generate MSI, then uploads unsigned MSI to GitHub release. Wait until the workflow run is finished withgh run watch.iii. Download ODBC MSI -> sign ODBC MSI -> upload to GitHub release.
If we have new script
07-flightsqlodbc-upload.sh, then I imagine the existing ODBC-related code in04-binary-download.shand05-binary-upload.shwill need to be removed as well.Later I can create issues for 1) upload the raw materials for installer and 2) static Windows ODBC linkage and post here. I can raise the issues for 3)
07-flightsqlodbc-upload.shafter we reach consensusalinaliBQ commentedon Mar 17, 2026
I have raised issues for 1) uploading the raw materials for Windows MSI installer #49537 and 2) static linkage support for Windows ODBC #49538
alinaliBQ commentedon Mar 19, 2026
@amoeba @kou Regards to GH-49537, I checked and it appears that
cpackis not designed to run using build artifact materials produced on another machine.cpackrelies on hard-coded paths such as paths to WiX files within the repository. Instead of uploading all artifact materials, we just upload the ODBC DLLarrow_flight_sql_odbc.dll.To expand on kou's point, may I suggest this approach for
07-flightsqlodbc-upload.sh:arrow_flight_sql_odbc.dlland upload the DLL to GitHub release asarrow_flight_sql_odbc_unsigned.dllto differentiate from signed DLL.arrow_flight_sql_odbc.dll.arrow_flight_sql_odbc.dllfrom GitHub release, and then replace unsigned DLL with the signed DLL locally. Then runcpackand build the unsigned MSI, and upload the MSI to GitHub release. This MSI will pick up the signed DLL.If it sound good, I can work on the CI A and B needed in step 1 and 3. Please let me know what you guys think.
amoeba commentedon Mar 20, 2026
Hi @alinaliBQ, that sounds good.
amoeba commentedon Apr 18, 2026
I marked my two PRs as ready for review:
Once the current release is over, we can start getting these PRs reviewed and merge.
GH-49686: [C++][FlightRPC][ODBC][Release] Create signing script for W…
apacheGH-49686: [C++][FlightRPC][ODBC][Release] Create signing script…
GH-49538: [C++][FlightRPC][ODBC] Use static linkage in Windows Flight…