Synology Trusted Publisher Certificate

I don’t see one around so I’m assuming it doesn’t exist, but can you guys publish a certificate to verify your authenticity when installing on a Synology NAS? I’d rather have my package install settings set to “Synology and trusted publishers” (which I had due to Plex and a few others) than “Any”.

The DVR is great so far!

Happy to do this, but will have to lookup what we need to publish and where.

Their documentation on it is lacking, but it looks like you can sign the package when you create it. I’m assuming the certificate is just the public key from signing? If I find something more informative I will post it. It’s not a top priority, just a nice to have.

We are signing the package. Can you import keys into your system somehow? I can publish in whatever format it expects.

I checked the cert I have from plex and it’s just their public key so your .key file. If you can publish I’m happy to test it out.

Here you go: https://channels-dvr.s3.amazonaws.com/synology/package.key

Thanks. That installed as a Fancy Bits cert, but if I try to install the SPK package I still get that it’s from an unknown publisher. Is this the same key from the signed package?

For what it’s worth, it’s not blocking me and I installed the DVR package anyways a while back. The Synology process just caught my attention when I had to change the package manager’s trust settings to the lowest setting. I’d recommend either adding this commentary to the Synology instructions or, preferably, the key instructions once that’s working.

Definitely plan to add key instructions once we figure this out. Pretty sure I used the key we are signing the package with.

Oops, it was the wrong key. I have updated the url to point to the correct key.

I installed the new key.

Oddly, now it doesn’t complain about the key not matching, but that the SPK a corrupt package. I redownloaded and still no luck

If I change the trust settings back to allow anything it brings up the wizard to install the package just fine. So, I’m guessing the key is right, but the package signing may have gone awry? Not sure here.