Repository signing

[isidorn]

We now support repository signing. This means that every extension uploaded to the VS Marketplace from today will be code signed by the VS Marketplace.
Once a user installs a signed extension through VS Code's extensions view, VS Code will verify the signature and thus prove this extension is indeed coming from the VS Marketplace. The verification process on the VS Code is not yet active, but we expect to turn it on later this month.

Repository signing is still work in progress, and we are looking out for potential issues. Please let us know if you see any errors when uploading your extension.

[PEZ]

Thanks! Will we extension authors need to do anything? Upgrade vsce, or such. And what happens if we do nothing?

[isidorn]

Good question. No action required by the extension authors.
Once we introduce publisher signing, this will require action by extension authors. More details about that here #137

[filiptronicek]

Hi @isidorn 👋, are there any plans on open-sourcing the node-vsce-sign package? It sparked me as weird that this addition would be proprietary, so I'm curious 😄.

Also, will VS Code indefinitely support unsigned extensions or will unsigned extensions fail to install in the future?

[isidorn]

Hi @filiptronicek 👋
We currently have no plans to open source the node-vsce-sign package - though that might change in the future. Keep in mind that it's implementation is tightly based on our NuGet signing which is already open source. You can inspect that if you are curious.

As for supporting installing unsigned extensions we will make that decision in a couple of months once we are sure all VS Marketplace extensions are signed - which is currently not the case. Thanks

[xsrvmy]

Will sided-loaded vsix extensions from other sources still work as normal? If not this would prevent running sided-loaded extensions over ssh or wsl (since oss builds don't support remote).

[isidorn]

Side loading extensions is a "developer" feature and it does not verify an extension signature currently. So this will still work.

Slight clarification regarding my previous comment that repository signing is based on Nuget signing: NuGet package signing also uses signed CMS, but uses a novel way of including the signature in the package such that the whole (unsigned) package is covered by the signature without having a detached signature. VS Code simply uses a detached signed CMS signature.